Cookie欺骗 腾讯拍拍秒杀活动的验证码漏洞

Cookie欺骗 腾讯拍拍秒杀活动的验证码漏洞

请猛击下载：http://blog.csdn.net/wyw308/archive/2011/05/10/6408159.aspx

结合网络上前辈的宝贵经验，配合自己手动抓包分析。发现：

1：再进入倒计时时无论你点刷新有多快，其实页面都是5秒钟才给你提交一次。（可恶的拍拍，蒙了多少朴实鞋童，没分析之前按一到抢拍时间就狂点“刷新”按钮，现在才明白白瞎了）

2：腾讯的验证码来源于第三方服务器，其Set-Cookie并不是保存到本地的cookie，它是一个标志为httponly的cookie，只 存储在标头。具体的验证码地址为专门服务器http://captcha.qq.com/getimage，因此可以进行cookie欺骗。

开发思路：

1：考虑人性化效果，利用webBrowser模拟页面登陆进入抢拍界面，利用webBrowser动态生成主要cookie及post数据元素。

2：手动提前获取多组验证码，保存到容器。

3：时间一到，利用提前获取的验证码，手工构造post数据以及cookie数据，利用httpwebrequest进行底层自动提交。

4：查看返回结果。

[这里只是给出了思路及核心实现代码，细节优化略]

请猛击下载 ：http://blog.csdn.net/wyw308/archive/2011/05/10/6408159.aspx

一：取宝贝的开始剩余时间: 注意，拍拍网对于宝贝的开始抢拍时间有延时处理，比如倒计时到了3,2,1，娘的，他不开始，又重新回到了3,3,3。。。然后忽然就开始了，这里需要进 行一些技术处理，如自己延时或者直接网上核对，但各有利弊，具体方法大家自己想。这里只给取倒计时by/ http://blog.csdn.net/wyw308

/// <summary>
        /// 返回倒计时毫秒by/ http://blog.csdn.net/wyw308
        /// </summary>
        /// <returns></returns>
        private double RemainTime(out string jsonstr)
        {
            Random ran = new Random();
            double c = ran.NextDouble();//随机处理by /http://blog.csdn.net/wyw308

            string url = "http://ext.paipai.com/oneaday/comdynum?" + GetInputValue("ComdyId") + "&t=" + c.ToString();//宝贝抢拍上架地址by/ http://blog.csdn.net/wyw308

            CookieContainer cc = new CookieContainer();

            HttpHelper.NetworkDelay =0 ;
            HttpHelper.Encoding = Encoding.GetEncoding("GB2312");
            string result = HttpHelper.GetHtml(url, cc);
            result = HttpFunction.Regex_str(result, "{.+?}");
            jsonstr = result;
            Dictionary<string, object> aa = bym.Json.jsonFormat.Deserialize(result); //json格式化返回数据by /http://blog.csdn.net/wyw308
            string a = aa["UploadSec"].ToString();
            if (a != null && a != "")
                return double.Parse(a) * 1000;
            else
                return -1;
        }

二：验证码容器 ，将提前获取的验证码及cookie值保存到此，然后使用

 /// <summary>
        /// 验证码cookie极点队容器 by/ http://blog.csdn.net/wyw308

///将提前获取的验证码及cookie值保存到此，然后使用

   /// </summary>
        public class PPCode
        {

 //by/ http://blog.csdn.net/wyw308

            private string vcode;
            private string vcookie;
            public PPCode()
            {

            }
            public PPCode(string VCODE, string VCOOKIE)
            {
                this.vcode = VCODE;
                this.vcookie = VCOOKIE;
            }
            public string VCODE
            {
                get
                {
                    return this.vcode;
                }
                set
                {
                    this.vcode = value;
                }
            }
            public string VCOOKIE
            {
                get
                {
                    return this.vcookie;
                }
                set
                {
                    this.vcookie = value;
                }
            }
        }

/// <summary>
        /// 访问验证码,取cookie及验证码值  by/ http://blog.csdn.net/wyw308
        /// </summary>
        private void GetPPcode()
        {
            // by/ http://blog.csdn.net/wyw308
            Random ran = new Random();
            double c = ran.NextDouble();
            HttpHelper.Referer = HttpFunction.UrlEnCode(webBrowser1.Url.ToString(), "GB2312").Replace("%3D", "=");//当前页面地址
            string url = "http://ptlogin2.paipai.com/getimage?aid=17000101&CacheTime=" + c;
            url = "http://captcha.qq.com/getimage?aid=17000101&CacheTime=" + c;//验证码的真实地址 by /http://blog.csdn.net/wyw308
            // url = "http://captcha.qq.com/getimage";
            CookieContainer ckcode = new CookieContainer();
            pictureBox1.Image = new Bitmap(HttpHelper.GetStream(url, HttpHelper.CookieContainer, out c_v));
            txt_code.Text = "";
            txt_code.Focus();
        }

三：根据页面动态手工构建post方法 ，这样比较灵活机动，操作起来交互效果好，by/ http://blog.csdn.net/wyw308

  /// <summary>
        /// 动态构造post的数据  by/ http://blog.csdn.net/wyw308
        /// </summary>
        /// <param name="vcode"></param>
        /// <returns></returns>
        private string GetPostD()
        {
            // by/ http://blog.csdn.net/wyw308
            string pd = string.Empty;
            string PostInput = "ComdyId,clsId,Address1,Address,Region,AddressId,PostCode,Name,Mobile,Phone,BuyNum,shippingFeeItem,commodityattr,Encrypt,Rule,BcLevel,sendtype";
  //post的input数据列表，根据抓包和webbrorser分析得到，by /http://blog.csdn.net/wyw308        

string[] s_input = PostInput.Split(new char[] { ',' });
            for (int i = 0; i < s_input.Length; i++)
            {
                if (i == 0)
                    pd = GetInputValue(s_input[i]);
                else
                    pd = pd + "&" + GetInputValue(s_input[i]);
            }

            string PostSelect = "mProvince,mCity,mTown";//post的select数据列表by /http://blog.csdn.net/wyw308
            string[] s_select = PostSelect.Split(new char[] { ',' });
            for (int j = 0; j < s_select.Length; j++)
            {
                pd = pd + "&" + GetSelectValue(s_select[j]);
            }
            pd = pd + "&Remark=";

            return pd;
        }
        /// <summary>
        /// 取页面input控件值 by/ http://blog.csdn.net/wyw308
        /// </summary>
        /// <param name="InputName"></param>
        /// <returns></returns>
        private string GetInputValue(string InputName)
        {
            // by/ http://blog.csdn.net/wyw308
            string str = string.Empty;
            HtmlDocument doc = webBrowser1.Document;
            HtmlElement ipt = doc.GetElementsByTagName("input")[InputName];

            str = InputName + "=" + HttpFunction.UrlEnCode(ipt.GetAttribute("value"), "GB2312");
            return str;
        }
        /// <summary>
        /// 取页面select控件值  by/ http://blog.csdn.net/wyw308
        /// </summary>
        /// <param name="InputName"></param>
        /// <returns></returns>
        private string GetSelectValue(string InputName)
        {
            // by/ http://blog.csdn.net/wyw308
            string str = string.Empty;
            HtmlDocument doc = webBrowser1.Document;

            HtmlElement sels = doc.GetElementsByTagName("select")[InputName];
            HtmlElementCollection opts = sels.Children;//取页面select的有效值时坎坷了老半天，立标留念by /http://blog.csdn.net/wyw308
            for (int i = 0; i < opts.Count; i++)
            {
                if (opts[i].OuterHtml.Contains("selected"))
                    str = InputName + "=" + opts[i].GetAttribute("value");
            }
            return str;
        }

四：动态构建提交需要的cookie by/ http://blog.csdn.net/wyw308

/// <summary>
        /// 动态构建cookie容器  by/ http://blog.csdn.net/wyw308
        /// </summary>
        /// <param name="ck_str"></param>
        /// <param name="domain"></param>
        /// <returns></returns>

public static CookieContainer GetCookieFromStr(string ck_str, string domain)
        {

by/ http://blog.csdn.net/wyw308

            CookieContainer myCookieContainer = new CookieContainer();
            string cookieStr = ck_str;
            string[] cookstr = cookieStr.Split(';');
            foreach (string str in cookstr)
            {
                string[] cookieNameValue = str.Split('=');
                if (cookieNameValue.Length > 1 )
                {
                    Cookie ck = new Cookie(cookieNameValue[0].Trim().ToString(), str.Substring(cookieNameValue[0].Trim().ToString().Length + 2));//网上一个写好的方法，做了调整by/ http://blog.csdn.net/wyw308
                  
                    ck.Domain = domain;
                    ck.Path = "/";
              
                    myCookieContainer.Add(ck);
                }

            }
            return myCookieContainer;
        }

五：自动通过底层提交post及cookie数据，模拟抢拍。

 /// <summary>
        /// 动态构建post及cookie，自动提交
        ///  by/ http://blog.csdn.net/wyw308
        /// </summary>
        private void PostToPai()
        {
            // by/ http://blog.csdn.net/wyw308
            int r_q = 0, r_succ = 0;
            bool qp_ok = false;

            string domain = "ext.paipai.com";//cookie的域名，一定要写对，by /http://blog.csdn.net/wyw308

            string url = HttpFunction.UrlEnCode(webBrowser1.Url.ToString(), "GB2312").Replace("%3D", "=");//当前页面地址

            HtmlElement hl = webBrowser1.Document.GetElementById("fixupformid");
            string PostUrl = string.Format(hl.GetAttribute("action"));//得到提交的地址

            //动态构建提交需要的cookie值 by/ http://blog.csdn.net/wyw308
            string ck_str = webBrowser1.Document.Cookie;//页面数据生成的cookie值
            string ck1 = "";
            string ck2 = "";
            int ver_num = ck_str.IndexOf("verifysession");//截取无用的验证码cookie串，用提前获取的验证码替换
            if (ver_num != -1)
            {
                ck1 = ck_str.Substring(0, ver_num);
                ck2 = ck_str.Substring(ver_num + 98);
            }
            else
                ck1 = ck_str;

            string postd = GetPostD();//得到post数据by/ http://blog.csdn.net/wyw308

            for (int i = 0; i < pp.Count; i++)//循环已经提前获取的验证码及cookie  by/ http://blog.csdn.net/wyw308
            {
                if (i == 0 && !ckb_sg.Checked)//第一次提交随机延时
                {
                    WriMsg("开始抢拍了....");
                    //Random r = new Random();
                    int tys = int.Parse(txt_ys.Text.Trim());
                    //int ys = r.Next(tys, 2 * tys + 1000);

                    WriMsg("延时" + tys.ToString() + "毫秒...");
                    Thread.Sleep(tys);
                }
                ck_str = ck1 + pp[i].VCOOKIE + ck2;
                CookieContainer PostCookie = new CookieContainer();
                PostCookie = HttpWeb.GetCookieFromStr(ck_str, domain);//构造最终提交的cookieby/ http://blog.csdn.net/wyw308

                string postdata = string.Format(postd + "&verifycode=" + pp[i].VCODE);//构造最终post数据by/ http://blog.csdn.net/wyw308

                HttpHelper.Encoding = Encoding.GetEncoding("GB2312");
                if (ckb_sg.Checked || i == 0)
                    HttpHelper.NetworkDelay = 0;
                else
                    HttpHelper.NetworkDelay = int.Parse(txt_jg.Text.Trim());//发送请求随机间隔时间
                HttpHelper.Referer = HttpFunction.UrlEnCode(url, "GB2312");

                WriMsg("正在发送请求...");

                r_q = r_q + 1;
                if (string.IsNullOrEmpty(postdata))//记录异常，由于拍拍反限制因此有莫名错误，调试时使用，by /http://blog.csdn.net/wyw308
                {
                    string errmsg = i.ToString() + "#Err#PostUrl:\r\n" + url + "\r\n" + PostUrl + "\r\n" + pp[i].VCODE + "#" + pp[i].VCOOKIE + "\r\n\r\nPostData:\r\n" + postdata + "\r\n\r\nCookie:\r\n" + ck_str + "\r\n\r\nResult:\r\n";
                    HttpPaipai.Msg(HttpFunction.UrlDeCode(errmsg, "GB2312"));
                    return;
                }
                string result = HttpHelper.GetHtml(PostUrl, postdata, true, PostCookie);//最终提交请求by /http://blog.csdn.net/wyw308
                result = HttpFunction.NoHTML(HttpFunction.Regex_goup_str(result, "<h5>.+?</h5>|<h5 id=\"errorMsg\">.+?</h5>|ErrMsg:\".+?\",")).Replace(",,", "");
                if (result.Contains("恭喜您"))
                {
                    r_succ = r_succ + 1;
                    if (r_succ >= int.Parse(txt_succ.Text.Trim()))
                        qp_ok = true;
                }
               
                tsl4.Text = "请求:" + r_q.ToString() + "；成功:" + r_succ.ToString();
                WriMsg(result);
              
                //记录日志，方便调试用
                //string msg = "PostUrl:\r\n" + url + "\r\n" + PostUrl + "\r\n" + pp[i].VCODE + "#" + pp[i].VCOOKIE + "\r\n\r\nPostData:\r\n" + postdata + "\r\n\r\nCookie:\r\n" + HttpWeb.GetCookieFromCookieContainer(PostCookie, "http://" + domain) + "\r\n\r\nResult:\r\n" + result;
                //HttpPaipai.Msg(HttpFunction.UrlDeCode(msg, "GB2312"));

                if (qp_ok)
                {
                    pp.Clear();
                    label3.Text = pp.Count.ToString();
                  
                    return;
                }
            }
            //抢拍结束后如果没有抢到立即转到手工模式，补救 by/ http://blog.csdn.net/wyw308
            if (!qp_ok)
            {
                WriMsg("本轮运气不佳，请输入验证码快速补抢...");
                pp.Clear();
                label3.Text = pp.Count.ToString();
                ckb_sg.Checked = true;
                GetPPcode();
            }
        }

软件下载：http://blog.csdn.net/wyw308/archive/2011/05/10/6408159.aspx

用到的httphelp类（感谢原作者），这里做了些细微调整by/ http://blog.csdn.net/wyw308：

using System;
using System.Collections.Generic;
using System.Text;
using System.Net;
using System.IO;
using System.Threading;

namespace bym
{
    public class HttpHelper
    {
        #region 私有变量
        private static CookieContainer cc = new CookieContainer();
        private static string contentType = "application/x-www-form-urlencoded";
        private static string accept = "image/gif, image/x-xbitmap, image/jpeg, image/pjpeg, application/x-shockwave-flash, application/x-silverlight, application/vnd.ms-excel, application/vnd.ms-powerpoint, application/msword, application/x-ms-application, application/x-ms-xbap, application/vnd.ms-xpsdocument, application/xaml+xml, application/x-silverlight-2-b1, */*";
        private static string userAgent = "Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022)";
        private static Encoding encoding = Encoding.GetEncoding("utf-8");
        private static int delay = 1000;//延迟访问防止连续访问被发现 3秒
        private static int maxTry =2;
        private static int currentTry = 0;
        private static string referer;
        #endregion

        #region 属性
        /// <summary></summary>
        /// Cookie容器
        ///
        public static CookieContainer CookieContainer
        {
            get
            {
                return cc;
            }
           
        }

        /// <summary></summary>
        /// 获取网页源码时使用的编码
        ///
        /// <value></value>
        public static Encoding Encoding
        {
            get
            {
                return encoding;
            }
            set
            {
                encoding = value;
            }
        }

        public static int NetworkDelay
        {
            get
            {
                Random r = new Random();
                return (r.Next(delay , delay * 2));
            }
            set
            {
                delay = value;
            }
        }

        public static int MaxTry
        {
            get
            {
                return maxTry;
            }
            set
            {
                maxTry = value;
            }
        }
        public static string Referer
        {
            get
            {
                return referer;
            }
            set
            {
                referer = value;
            }
        }
        #endregion

        #region 公共方法
        /// <summary></summary>
        /// 获取指定页面的HTML代码
        ///
        /// <param name="url">指定页面的路径
        /// <param name="postData">回发的数据
        /// <param name="isPost">是否以post方式发送请求
        /// <param name="cookieCollection">Cookie集合
        /// <returns></returns>
        public static string GetHtml(string url, string postData, bool isPost, CookieContainer cookieContainer)
        {
            int err_num = 0;
            if (string.IsNullOrEmpty(postData))
            {
                err_num = 1;
               // return GetHtml(url, cookieContainer);
            }

            Thread.Sleep(NetworkDelay);//延迟访问

            currentTry++;

            HttpWebRequest httpWebRequest = null;
            HttpWebResponse httpWebResponse = null;
            try
            {
                byte[] byteRequest = Encoding.Default.GetBytes(postData);
                err_num = 2;

                httpWebRequest = (HttpWebRequest)HttpWebRequest.Create(url);
                err_num = 3;
                httpWebRequest.CookieContainer = cookieContainer;
                err_num = 4;
                httpWebRequest.ContentType = contentType;
                err_num = 5;
                httpWebRequest.ServicePoint.ConnectionLimit = maxTry;
                err_num = 6;
                httpWebRequest.Referer = referer;
                err_num = 7;
                httpWebRequest.Accept = accept;
                err_num = 7;
                httpWebRequest.UserAgent = userAgent;
                err_num = 8;
                httpWebRequest.Method = isPost ? "POST" : "GET";
                err_num = 8;
                httpWebRequest.ContentLength = byteRequest.Length;
                err_num = 9;
                Stream stream = httpWebRequest.GetRequestStream();
                err_num = 10;
                stream.Write(byteRequest, 0, byteRequest.Length);
                err_num = 11;
                stream.Close();
                err_num = 12;
                httpWebResponse = (HttpWebResponse)httpWebRequest.GetResponse();
                err_num = 13;
                Stream responseStream = httpWebResponse.GetResponseStream();
                err_num = 14;
                StreamReader streamReader = new StreamReader(responseStream, encoding);
                err_num = 15;
                string html = streamReader.ReadToEnd();
                err_num = 16;
                streamReader.Close();
                err_num = 17;
                responseStream.Close();
                err_num = 18;
                currentTry = 0;
                err_num = 19;
                httpWebRequest.Abort();
                err_num = 20;
                httpWebResponse.Close();
                err_num = 21;
                return html;
               
            }
            catch (Exception e)
            {
                Console.ForegroundColor = ConsoleColor.Red;
                Console.WriteLine(DateTime.Now.ToString("HH:mm:ss ") + e.Message);
                Console.ForegroundColor = ConsoleColor.White;

                HttpWeb.WriteLog(err_num.ToString()+"#"+e.Message, "GetHtmlErr.log");
               
                if (currentTry <= maxTry)
                {
                    GetHtml(url, postData, isPost, cookieContainer);
                }
                currentTry--;

                if (httpWebRequest != null)
                {
                    httpWebRequest.Abort();
                } if (httpWebResponse != null)
                {
                    httpWebResponse.Close();
                }
                return string.Empty;
            }
        }

        /// <summary></summary>
        /// 获取指定页面的HTML代码
        ///
        /// <param name="url">指定页面的路径
        /// <param name="cookieCollection">Cookie集合
        /// <returns></returns>
        public static string GetHtml(string url, CookieContainer cookieContainer)
        {
            int a = 0;
            Thread.Sleep(NetworkDelay);
            a = 1;
            currentTry++;
            HttpWebRequest httpWebRequest = null;
            a = 2;
            HttpWebResponse httpWebResponse = null;
            try
            {
                a = 3;
                httpWebRequest = (HttpWebRequest)HttpWebRequest.Create(url);
                a = 4;
                httpWebRequest.CookieContainer = cookieContainer;
                a = 5;
                httpWebRequest.ContentType = contentType;
                a = 6;
                httpWebRequest.ServicePoint.ConnectionLimit = maxTry;
                a = 7;
                httpWebRequest.Referer = referer;
                a = 8;
                httpWebRequest.Accept = accept;
                a = 9;
                httpWebRequest.UserAgent = userAgent;
                a = 10;
                httpWebRequest.Method = "GET";
                a = 11;
                httpWebResponse = (HttpWebResponse)httpWebRequest.GetResponse();
                a = 12;
                Stream responseStream = httpWebResponse.GetResponseStream();
                a = 13;
                StreamReader streamReader = new StreamReader(responseStream, encoding);
                a = 14;
                string html = streamReader.ReadToEnd();
                a = 15;
                streamReader.Close();
                a = 16;
                responseStream.Close();
                a = 17;
                currentTry--;

                httpWebRequest.Abort();
                a = 18;
                httpWebResponse.Close();
                a = 19;
                return html;
            }
            catch (Exception e)
            {
                Console.ForegroundColor = ConsoleColor.Red;
                Console.WriteLine(DateTime.Now.ToString("HH:mm:ss ") + e.Message);
                Console.ForegroundColor = ConsoleColor.White;

                HttpWeb.WriteLog(a.ToString()+"#"+e.Message, "GetHtml2.log");

                if (currentTry <= maxTry)
                {
                    GetHtml(url, cookieContainer);
                }

                currentTry--;

                if (httpWebRequest != null)
                {
                    httpWebRequest.Abort();
                } if (httpWebResponse != null)
                {
                    httpWebResponse.Close();
                }
                return string.Empty;
            }
        }
      
        /// <summary></summary>
        /// 获取指定页面的HTML代码
        ///
        /// <param name="url">指定页面的路径
        /// <returns></returns>
        public static string GetHtml(string url)
        {
            return GetHtml(url, cc);
        }

        /// <summary></summary>
        /// 获取指定页面的HTML代码
        ///
        /// <param name="url">指定页面的路径
        /// <param name="postData">回发的数据
        /// <param name="isPost">是否以post方式发送请求
        /// <returns></returns>
        public static string GetHtml(string url, string postData, bool isPost)
        {
            return GetHtml(url, postData, isPost, cc);
        }

      
        /// <summary></summary>
        /// 获取指定页面的Stream
        ///
        /// <param name="url">指定页面的路径
        /// <param name="postData">回发的数据
        /// <param name="isPost">是否以post方式发送请求
        /// <param name="cookieCollection">Cookie集合
        /// <returns></returns>
        public static Stream GetStream(string url, CookieContainer cookieContainer, out string ck_vccode)
        {
            //Thread.Sleep(delay);
            int j = 0;
            currentTry++;
            HttpWebRequest httpWebRequest = null;
            HttpWebResponse httpWebResponse = null;

            try
            {

                httpWebRequest = (HttpWebRequest)HttpWebRequest.Create(url);
                j =1;
                j = 2;
                httpWebRequest.CookieContainer = cookieContainer;
                httpWebRequest.ContentType = contentType;
                j = 3;
                httpWebRequest.ServicePoint.ConnectionLimit = maxTry;
                j = 4;
                httpWebRequest.Referer = url;
                j = 5;
                httpWebRequest.Accept = accept;
                j = 6;
                httpWebRequest.UserAgent = userAgent;
                j = 7;
                httpWebRequest.Method = "GET";
                j = 8;

                httpWebResponse = (HttpWebResponse)httpWebRequest.GetResponse();
                j = 9;
                Stream responseStream = httpWebResponse.GetResponseStream();
                j = 10;
               ck_vccode = httpWebResponse.Headers["Set-Cookie"];
                j =11;
               ck_vccode = ck_vccode.Substring(0, ck_vccode.IndexOf("PATH") - 1);
                currentTry--;
                j = 12;
                //httpWebRequest.Abort();
                //httpWebResponse.Close();

                return responseStream;
            }
            catch (Exception e)
            {
                Console.ForegroundColor = ConsoleColor.Red;
                Console.WriteLine(DateTime.Now.ToString("HH:mm:ss ") + e.Message);
                Console.ForegroundColor = ConsoleColor.White;

                HttpWeb.WriteLog(j.ToString() + "#" + e.Message, "GetStreamErr.log");

                if (currentTry <= maxTry)
                {
                    GetHtml(url, cookieContainer);
                }

                currentTry--;

                if (httpWebRequest != null)
                {
                    httpWebRequest.Abort();
                } if (httpWebResponse != null)
                {
                    httpWebResponse.Close();
                }
                ck_vccode="";
                return null;
            }
        }

        #endregion

         //CookieContainer co = new CookieContainer();//设置cookie
         //   co.SetCookies(new Uri(server), cookie);//SERVER 抓包里的host
    }
}