1. 程式人生 > >python爬蟲-模擬微博登入

python爬蟲-模擬微博登入

微博模擬登入

這是本次爬取的網址:https://weibo.com/

一、請求分析

找到登入的位置,填寫使用者名稱密碼進行登入操作

看看這次請求響應的資料是什麼

這是響應得到的資料,儲存下來

exectime: 8
nonce: "HW9VSX"
pcid: "gz-4ede4c6269a09f5b7a6490f790b4aa944eec"
pubkey: "EB2A38568661887FA180BDDB5CABD5F21C7BFD59C090CB2D245A87AC253062882729293E5506350508E7F9AA3BB77F4333231490F915F6D63C55FE2F08A49B353F444AD3993CACC02DB784ABBB8E42A9B1BBFFFB38BE18D78E87A0E41B9B8F73A928EE0CCEE1F6739884B9777E4FE9E88A1BBE495927AC4A799B3181D6442443"
retcode: 0
rsakv: "1330428213"
servertime: 1568257059

繼續完善登入操作,輸入密碼,點選登入按鈕

經過分析呢,發現變化的引數就是sp,nonce,servetimeservetime就是當前的時間戳,我們只需找到其他兩個引數的生成方法就好了。對了su這個引數是通過base64加密生成的

二、找到sp,nonce的加密方式

這次就不通過search關鍵字去找加密位置了

找到呼叫函式的位置,打上斷點,再進行登入操作

經過js程式碼流程除錯分析,最終我們找到了加密的位置

簡單介紹下怎麼除錯js程式碼

找到sp,nonce的位置,通過python程式碼去實現它的加密方式

sp它是通過rsa加密方式,加密生成的。rsa的具體用法可以通過百度找到。或者通過sha1加密生成。至於me.rsaPubkey

他怎麼得到的,他就是我們還沒有點選登入前,就發了一個請求,那個請求的響應資料就有它。如果你測試的次數多了的話,會發現這個值它是固定下來的。所以我們也可以直接去用,不用請求獲取。

nonce:它呢也出現過在未點選登入前的那個請求響應的資料中,但是呢,我們點了幾次登入,都未發現這個請求了。nonce的值每次還不一樣。所以它肯定是本地js檔案的某個函式生成,不用請求伺服器獲取。我們在這裡找到了nonce的生成函式

import random
import rsa
import hashlib
from binascii import b2a_hex

def get_nonce(n):
    result = ""
    random_str = "ABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789"
    for i in range(n):
        index = random.randint(0, len(random_str) - 1)
        result += random_str[index]
    return result


def get_sp_rsa(password, servertime, nonce):
    key = "EB2A38568661887FA180BDDB5CABD5F21C7BFD59C090CB2D245A87AC253062882729293E5506350508E7F9AA3BB77F4333231490F915F6D63C55FE2F08A49B353F444AD3993CACC02DB784ABBB8E42A9B1BBFFFB38BE18D78E87A0E41B9B8F73A928EE0CCEE1F6739884B9777E4FE9E88A1BBE495927AC4A799B3181D6442443"
    pubkey = rsa.PublicKey(int(key, 16), int("10001", 16))
    res = rsa.encrypt(bytes("" + "\t".join([servertime, nonce]) + "\n" + password,encoding="utf-8"), pubkey)
    return b2a_hex(res)


def get_sp_sha1(password, servertime, nonce):
    res = hashlib.sha1(bytes("" + hashlib.sha1(bytes(hashlib.sha1(bytes(password, encoding="utf-8")).hexdigest(),encoding="utf-8")).hexdigest() + servertime + nonce,encoding="utf-8")).hexdigest()
    return res

三、響應資料

請求引數分析的差不多了,這次輸入正確的使用者名稱,密碼。檢視響應的資料的是什麼。

開啟fiddler,然後退出當前賬號,重新進行登入操作。fiddler上面就會出現很多請求。找到需要的請求,看看響應內容

這樣做,每個響應都會set-cookie。所以照著上面的流程實現,標識登入的cookie肯定能得到。之後的話,只要帶上這個cookie去做其他操作就行了。

最後附上程式碼

import requests, random, time, rsa, hashlib, base64, re, json
from binascii import b2a_hex


class WeiBo:

    def __init__(self):
        self.session = requests.Session()
        self.headers = {
            "user-agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/76.0.3809.132 Safari/537.36"
        }

    def login(self, account, password):
        api = "https://login.sina.com.cn/sso/login.php?client=ssologin.js(v1.4.19)"
        nonce = self._get_nonce()
        servertime = self._get_now_time()
        sp = self._get_sp_rsa(password, servertime, nonce)
        su = self._get_su(account)
        data = {
            "entry": "weibo",
            "gateway": "1",
            "from": "",
            "savestate": "7",
            "qrcode_flag": "false",
            "useticket": "1",
            "pagerefer": "https://login.sina.com.cn/crossdomain2.php?action=logout&r=https%3A%2F%2Fpassport.weibo.com%2Fwbsso%2Flogout%3Fr%3Dhttps%253A%252F%252Fweibo.com%26returntype%3D1",
            "vsnf": "1",
            "su": su,
            "service": "miniblog",
            "servertime": servertime,
            "nonce": nonce,
            "pwencode": "rsa2",
            "rsakv": "1330428213",
            "sp": sp,
            "sr": "1920*1080",
            "encoding": "UTF - 8",
            "prelt": "149",
            "url": "https://weibo.com/ajaxlogin.php?framelogin=1&callback=parent.sinaSSOController.feedBackUrlCallBack",
            "returntype": "META",
        }
        headers = self.headers.copy()
        headers.update({
            "Host": "login.sina.com.cn",
            "Origin": "https://weibo.com",
            "Referer": "https://weibo.com/"
        })

        response = self.session.post(api, headers=headers, data=data, allow_redirects=False)
        search_result = self._re_search("location.replace\(\"(.*?)\"", response.text)
        redirct_url = search_result and search_result.group(1)
        if not redirct_url:
            raise Exception("重定向url獲取失敗")
        response = self.session.get(redirct_url, headers=headers.update({
            "Referer": "https://login.sina.com.cn/sso/login.php?client=ssologin.js(v1.4.19)"
        }), allow_redirects=False)
        search_result = self._re_search('"arrURL":(.*?)}', response.text)
        redirct_urls = search_result and search_result.group(1)
        if not redirct_urls:
            raise Exception("重定向url獲取失敗")
        redirct_url_list = json.loads(redirct_urls)
        userId = ""
        for url in redirct_url_list:
            response = self.session.get(url, headers=self.headers)
            if url.startswith("https://passport.weibo.com/wbsso/login"):
                userId = self._re_search('"uniqueid":"(.*?)"', response.text).group(1)
        if not userId:
            raise Exception("userId獲取失敗")
        user_details_url = "https://weibo.com/u/{}/home?wvr=5&lf=reg".format(userId)
        response = self.session.get(user_details_url, headers={
            "Referer": "https://weibo.com/",
            "user-agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/76.0.3809.132 Safari/537.36"
        })
        if self._re_search(userId, response.text):
            print("登入成功")
            print(self.session.cookies)
        else:
            print("登入失敗")

    def _get_nonce(self):
        nonce = ""
        random_str = "ABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789"
        for i in range(5):
            index = random.randint(0, len(random_str) - 1)
            nonce += random_str[index]
        return nonce

    def _get_now_time(self):
        return str(int(time.time()))

    def _get_sp_rsa(self, password, servertime, nonce):
        key = "EB2A38568661887FA180BDDB5CABD5F21C7BFD59C090CB2D245A87AC253062882729293E5506350508E7F9AA3BB77F4333231490F915F6D63C55FE2F08A49B353F444AD3993CACC02DB784ABBB8E42A9B1BBFFFB38BE18D78E87A0E41B9B8F73A928EE0CCEE1F6739884B9777E4FE9E88A1BBE495927AC4A799B3181D6442443"
        pubkey = rsa.PublicKey(int(key, 16), int("10001", 16))
        res = rsa.encrypt(bytes("" + "\t".join([servertime, nonce]) + "\n" + password, encoding="utf-8"), pubkey)
        return b2a_hex(res)

    def _get_sp_sha1(self, password, servertime, nonce):
        res = hashlib.sha1(bytes("" + hashlib.sha1(bytes(hashlib.sha1(bytes(password, encoding="utf-8")).hexdigest(),
                                                         encoding="utf-8")).hexdigest() + servertime + nonce,
                                 encoding="utf-8")).hexdigest()
        return res

    def _get_su(self, account):
        return str(base64.b64encode(bytes(account, encoding="utf-8")), encoding="utf-8")

    def _re_search(self, pattern, html):
        return re.search(pattern, html, re.S)

    def test(self):
        self.login("18716758777", "123456")


if __name__ == '__main__':
    wb = WeiBo()
    wb.test()