京东m端 验证码分析

声明
本文章中所有内容仅供学习交流使用，不用于其他任何目的，抓包内容、敏感网址、数据接口等均已做脱敏处理，严禁用于商业用途和非法用途，否则由此产生的一切后果均与作者无关！

部分Python代码

cookies.update(dict(response.cookies))
capfp = data['fp']
st = data['st']
# getBg(st,sessionId)
data = huakuai.call('getBg',st,sessionId)
print(data)
response = requests.post('/cgi-bin/api/check', cookies=cookies, headers=headers, data=data)
data = response.json()
print(data)
cookies.update(dict(response.cookies))
imgStr = data["img"]
img = json.loads(imgStr)

b1 = img['b1']
b2 = img['b2']
with open('b1.jpg','wb') as f:
f.write(base64.b64decode(b1.replace('data:image/jpg;base64,','')))
with open('b2.png','wb') as f:
f.write(base64.b64decode(b2.replace('data:image/png;base64,','')))
# verify(st, sessionId, distance)
with open('b1.jpg','rb') as fp:
background_bytes = fp.read()
with open('b2.png','rb') as fp:
target_bytes = fp.read()
...........................
data = huakuai.call('verify',account,capfp,st,sessionId,imgStr,new_track,img)
response = requests.post('api/check', cookies=cookies, headers=headers, data=data)
data = response.json()
print(data)
vt = data.get('vt')

结果

总结

1.出于安全考虑,本章未提供完整流程,调试环节省略较多,只提供大致思路,具体细节要你自己还原,相信你也能调试出来。