知识铺垫
data-postsbox="{"id":2382,"title":"关于密码MD5生成和解密方法 文末附视频讲解","author":"FancyPig","author_id":1,"cover_image":"","cover_video":"","views":7521,"comment_count":455,"category":"knowledge","is_forum_post":false}">{"id":2382,"title":"关于密码MD5生成和解密方法 文末附视频讲解","author":"FancyPig","author_id":1,"cover_image":"","cover_video":"","views":7521,"comment_count":455,"category":"knowledge","is_forum_post":false}
data-postsbox="{"id":8262,"title":"【在线学习】全世界最好的python 零基础教程 6小时学会Python","author":"FancyPig","author_id":1,"cover_image":"https://static.pigsec.cn/wp-content/uploads/2022/01/20220121223545378.png","cover_video":"","views":10965,"comment_count":1087,"category":"lsources","is_forum_post":false}">{"id":8262,"title":"【在线学习】全世界最好的python 零基础教程 6小时学会Python","author":"FancyPig","author_id":1,"cover_image":"https://static.pigsec.cn/wp-content/uploads/2022/01/20220121223545378.png","cover_video":"","views":10965,"comment_count":1087,"category":"lsources","is_forum_post":false}
相关阅读
通过抓包,你还可以完成更多有趣的事情
data-postsbox="{"id":305,"title":"如何使用Charles抓包手机APP","author":"FancyPig","author_id":1,"cover_image":"","cover_video":"","views":7958,"comment_count":8,"category":"cybersecurity","is_forum_post":false}">{"id":305,"title":"如何使用Charles抓包手机APP","author":"FancyPig","author_id":1,"cover_image":"","cover_video":"","views":7958,"comment_count":8,"category":"cybersecurity","is_forum_post":false}
data-postsbox="{"id":8173,"title":"如何查看QQ空间隐藏的图片相册内容","author":"FancyPig","author_id":1,"cover_image":"","cover_video":"","views":13891,"comment_count":28,"category":"knowledge","is_forum_post":false}">{"id":8173,"title":"如何查看QQ空间隐藏的图片相册内容","author":"FancyPig","author_id":1,"cover_image":"","cover_video":"","views":13891,"comment_count":28,"category":"knowledge","is_forum_post":false}
问题场景
之前有个热心网友问到,在QQ手游中可以收到游戏消息
比方说有小姐姐的留言,当然你可以选择右上角直接加为好友
这里不知道QQ为什么这么设计,只有加好友的选项,却看不到好友QQ
很多人表示很好奇她的QQ是多少,就想看看,并不想加好友,那这个时候应该怎么操作呢?
图文教程
我们这里以苹果手机为例,默认你已经设置好了代理端口
如果您还不会的话,点这里查看详细步骤
打开Charles选择Help>SSL Proxying>Install Charles Root Certificate on a Mobile or Remote Browser
这里会提示你手机上应该设置的IP地址及代理端口
我们这里要设置的是192.168.1.13:8888
我们打开苹果手机,选择WIFI后面的详情
HTTP代理>配置代理
然后设置IP地址为192.168.1.13,端口为8888
然后存储
这时,打开了Charles,我们这时手机上的流量,电脑上就可以监控到了,我们点开其相应的主页
在游戏中心的请求包中,我们这里可以看到头像的地址
http://thirdqq.qlogo.cn/g?b=oidb&k=MXUhIicdKLX65qaJn3bNmSA&s=100
这里其实关键的MD5就是
MXUhIicdKLX65qaJn3bNmSA
那么我们如何通过这串MD5找到其对应的QQ号呢?
这里我们又要涉及到QQ头像相关的加密算法,我们之前讲过,但是旧版本的MD5(MD5(MD5(QQ号)+QQ号)+QQ号)貌似已经失效,而且存储的时候会有很多串MD5,但是这里第三方QQ头像加密算法是一直没有变的
data-postsbox="{"id":1267,"title":"由王者荣耀查QQ引发的思考:抓包?头像接口找qq?uid找qq?","author":"FancyPig","author_id":1,"cover_image":"","cover_video":"","views":59605,"comment_count":3191,"category":"sg","is_forum_post":false}">{"id":1267,"title":"由王者荣耀查QQ引发的思考:抓包?头像接口找qq?uid找qq?","author":"FancyPig","author_id":1,"cover_image":"","cover_video":"","views":59605,"comment_count":3191,"category":"sg","is_forum_post":false}
那我们今天教大家是通过QQ官方提供的头像加密接口,来实现一个反向查找。
https://ptlogin2.qq.com/getface?&imgtype=1&uin=你的QQ号
比方说,我们的QQ号是663962,则我们访问https://ptlogin2.qq.com/getface?&imgtype=1&uin=663962
得到了下面的结果
pt.setHeader({"663962":"https://thirdqq.qlogo.cn/g?b=sdk&k=SwqialA9fd4OZiblxjwOxgOw&s=40&t=1618822915"})
我们可以看到这里的MD5是
SwqialA9fd4OZiblxjwOxgOw
因此当抓包的时候如果你抓到这个值的时候,就可以证明是我的QQ号。
当然,我们现在是正向生成验证,那么如果拿到一个陌生的MD5怎么办呢?就像我们刚才拿到这串MXUhIicdKLX65qaJn3bNmSA,我们怎么找到对应的QQ号呢?
我们这里给大家提供一个思路,其实我们之前在这篇文章时候就用过feapder框架
data-postsbox="{"id":8635,"title":"securityspace漏洞库Python爬虫分享 可以爬取约10万条漏洞情报","author":"FancyPig","author_id":1,"cover_image":"","cover_video":"","views":2430,"comment_count":6,"category":"cybersecurity","is_forum_post":false}">{"id":8635,"title":"securityspace漏洞库Python爬虫分享 可以爬取约10万条漏洞情报","author":"FancyPig","author_id":1,"cover_image":"","cover_video":"","views":2430,"comment_count":6,"category":"cybersecurity","is_forum_post":false}
你可以写一个python脚本将生成的MD5记录下来,存到数据库中,这样你就可以反向查询了,这里是写到txt文件了,你还可以将其生成到excel表,我这里只是举个很简单的例子供大家参考,重点还是思路要清晰!
import feapder
import pandas as pd
import requests
import re
class SpiderTest(feapder.AirSpider):
def start_callback(self):
print("爬虫开始")
def end_callback(self):
print("爬虫结束")
def start_requests(self):
for i in range(10001,99999):
yield feapder.Request("https://ptlogin2.qq.com/getface?&imgtype=1&uin={}".format(i))
def download_midware(self, request):
request.headers = {'User-Agent': "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/73.0.3683.86 Safari/537.36"}
return request
def validate(self, request, response):
if response.status_code != 200:
raise Exception("response code not 200") # 重试
def parse(self, request, response):
qq = response.re(r'{"(.*?)"')
qqmd5 = response.re(r'&k=(.*?)&s')
# print(qqmd5)
qqmd5_ = "".join(qqmd5)
qq_ = "".join(qq)
print(qqmd5_)
f = open("qq.txt", "a")
print(qq_ + "----" +qqmd5_, file=f)
if __name__ == "__main__":
SpiderTest().start()
比方说这个10001马总的QQ对应的MD5就是Vjic48anMfN6ovAxw4eN94w,分别存储下来,后面你就可以做一个像cmd5一样的小工具,是不是还挺酷的!