阿里V2 acw_sc__v3 无感验证码分析

声明:
本文章中所有内容仅供学习交流使用，不用于其他任何目的，抓包内容、敏感网址、数据接口等均已做脱敏处理，严禁用于商业用途和非法用途，否则由此产生的一切后果均与作者无关！
逆向分析

部分Python代码

data = cp.call('wuganverify',a,b)
print(data)
url = "captcha-open.aliyuncs.com/"
 
response = requests.post(url, data=data)
 
data = response.json()
print(data)
securityToken = data['Result']["securityToken"]
certifyId = data['Result']["certifyId"]
url = "data/userLoginV2"
if securityToken:
    captchaVerifyParam = cp.call('getCaptchaVerifyParam', securityToken, certifyId)
    headers = {
        "Language": "cn",
        "Sec-Fetch-Dest": "empty",
        "Sec-Fetch-Mode": "cors",
        "Sec-Fetch-Site": "same-origin",
        "User-Agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36 Edg/137.0.0.0",
        "sec-ch-ua": "\"Microsoft Edge\";v=\"137\", \"Chromium\";v=\"137\", \"Not/A)Brand\";v=\"24\"",
        "sec-ch-ua-mobile": "?0",
        "sec-ch-ua-platform": "\"Windows\""
    }
    data = {
        "type": 1,
        "userName": "",
        "password": "",
        "webPageSource": 1,
        "captchaVerifyParam": captchaVerifyParam,
        "sceneId": ""
    }
    cookies = {}
    data = json.dumps(data, separators=(',', ':'))
    response = requests.post(url, headers=headers, cookies=cookies, data=data)
 
    print(response.text)
    print(response)

结果

总结

1.出于安全考虑,本章未提供完整流程,调试环节省略较多,只提供大致思路