篇幅有限

完整内容及源码关注公众号：ReverseCode，发送 冲

https://www.zol.com.cn/

抓包

本登录页面既然是框架，找到php页面，https://service.zol.com.cn/user/siteLogin.php?type=small&callback=userLoginCallback&backurl=https://www.zol.com.cn/

直接访问该php网址，避免其他请求干扰分析

登录url:

POST https://service.zol.com.cn/user/ajax/siteLogin/login.php

请求头：

:authority: service.zol.com.cn
:method: POST
:path: /user/ajax/siteLogin/login.php
:scheme: https
accept: application/json, text/javascript, */*; q=0.01
accept-encoding: gzip, deflate, br
accept-language: zh-CN,zh;q=0.9
content-length: 138
content-type: application/x-www-form-urlencoded; charset=UTF-8
cookie: ip_ck=5cKC7/vxj7QuMjUzODE2LjE2MTgxOTc3OTM%3D; lv=1618197793; vn=1; Hm_lvt_ae5edc2bc4fc71370807f6187f0a2dd0=1618197793; questionnaire_pv=1618185602; Hm_lpvt_ae5edc2bc4fc71370807f6187f0a2dd0=1618197883
origin: https://service.zol.com.cn
referer: https://service.zol.com.cn/user/siteLogin.php?type=small&callback=userLoginCallback&backurl=https://www.zol.com.cn/
sec-fetch-mode: cors
sec-fetch-site: same-origin
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.70 Safari/537.36
x-requested-with: XMLHttpRequest

参数：

userid: 15806204096
pwd: 74ce2ba17b2c218246e778fb5e895c95
isAuto: 1
backurl: http://www.zol.com.cn/
tmallBtn: 0
activeBtn: 0
headPicid: 0

分析

全局搜索siteLogin/login.php

中关村非常的耿直，加密使用md5,var md5Password = CryptoJS.MD5(password+"zol") + '';输入123提交的pwd为74ce2ba17b2c218246e778fb5e895c95，通过md5比对

爬虫实现

拷贝Form Data到请求头加引号.py中自动生成dict格式

import requests
from hashlib import md5

username = '15806204095'
pwd = '123'
md5_pwd = md5((pwd + 'zol').encode('utf8')).hexdigest()
print(md5_pwd)
url = 'https://service.zol.com.cn/user/ajax/siteLogin/login.php'
data = {
    'userid': username,
    'pwd': md5_pwd,
    'isAuto': '1',
    'backurl': 'http://www.zol.com.cn/',
    'tmallBtn': '0',
    'activeBtn': '0',
    'headPicid': '0',
}
r =requests.post(url,data)
print(r.text)

完整源码请关注微信公众号：ReverseCode，回复：JS逆向