前言本文目标接口api/pc/list/feed此接口只校验了a_bogus一个时效性参数hook关键参数a_bogus向上翻阅堆栈分析何处是核心加密位置。打上日志断点观察a_bogus如何被生成的可以看见此处的apply在很多地方都有被调用所以接下来我们下条件断点条件是由我们观察来的a_bogus参数的长度是168位。再次刷新页面后成功断到a_bogus生成位置我们点击步入后在return出断点观察发现return处就是生成a_bogus参数的核心位置。a_bogus的生成逻辑就是向 e._u函数中传入五个参数r和e函数都是又e得来的然后把e函数赋值给了u所以我们只需要将bdms.js文件全部拿下来然后在关键位置将u赋值给全局即可。使用自吐环境代理开始补全环境代理很简单需要可以私信我。环境代码如下windowglobal window.topwindow.selfwindow.parentwindowdeleteglobal window.devicePixelRatio1window.location{href:about:blank,protocol:http:,host:,hostname:,port:,pathname:/,search:,hash:}window.requestAnimationFramefunction(tag_name){console.log(requestAnimationFrame:::,tag_name)}functionEventSource(url){this.readyState0this.CONNECTING0this.OPEN1this.CLOSED2}EventSource.prototype.addEventListenerfunction(type,listener){}EventSource.prototype.removeEventListenerfunction(type,listener){}EventSource.prototype.closefunction(){}window.EventSourceEventSource window._sdkGlueVersionMap{sdkGlueVersion:1.0.0.55,bdmsVersion:1.0.1.7,captchaVersion:4.0.2}window.onwheelx{_Ax:0X21}window.innerWidth1707window.innerHeight179window.outerWidth1707window.outerHeight1019window.screenX0window.screenY0window.pageYOffset200window.XMLHttpRequestfunctionXMLHttpRequest(){}XMLHttpRequest.prototype.openfunction(){}XMLHttpRequest.prototype.sendfunction(){}XMLHttpRequest.prototype.setRequestHeaderfunction(){}XMLHttpRequest.prototype.getAllResponseHeadersfunction(){}span{classList:{add:function(){},remove:function(){},contains:function(){returnfalse}},style:{},innerHTML:,parentNode:null,getAttribute:function(name){returnnull},setAttribute:function(name,value){}}functionDocument(){}Document.prototype.cookieDocument.prototype.referrerDocument.prototype.all{length:0,item:function(){returnnull}}Document.prototype.body{tagName:BODY,appendChild:function(node){returnnode},removeChild:function(node){returnnode},style:{},offsetHeight:800,offsetWidth:1707,clientHeight:779,clientWidth:1707}Document.prototype.createElementfunction(tag_name){console.log(createElement:::,tag_name)if(tag_namespan){returnspan}}Document.prototype.documentElement{}Document.prototype.createEventfunction(tag_name){console.log(createEvent:::,tag_name)}documentnewDocument()functionNavigator(){}Navigator.prototype.userAgentMozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36Navigator.prototype.platformWin32Navigator.prototype.webdriverfalseNavigator.prototype.languages[zh-CN,zh]Navigator.prototype.plugins{length:0}Navigator.prototype.mimeTypes{length:0}Navigator.prototype.vendorSubs{ink:1781240349654}navigatornewNavigator()functionStorage(){this.xmstxXYeU5qviNSFDHJlZZ0C1mPWSrep7qeJ8UGH6eEe8UXzY9jne9T_3pdqaHX5gRDzTC9wPiTtp49rU9ACz8aM_Rg8afmk2ya2QHJf2-bno3oMB9_qBEbM9KCN8u-hvG32}Storage.prototype.getItemfunction(a){console.log(sessionStorage getItem:::,arguments)returnainthis?this[a]:null}Storage.prototype.removeItemfunction(a){console.log(sessionStorage removeItem:::,arguments)deletethis[a]}Storage.prototype.setItemfunction(a,b){console.log(sessionStorage setItem:::,arguments)returnthis[a]b}sessionStoragenewStorage()window.sessionStoragesessionStorage localStoragenewStorage()window.localStoragelocalStoragefunctionScreen(){}Screen.prototype.availWidth1707Screen.prototype.availHeight1019Screen.prototype.width1707Screen.prototype.height1067Screen.prototype.colorDepth32Screen.prototype.pixelDepth32screennewScreen()py代码如下importrequestsimportexecjsfromurllib.parseimporturlencode headers{accept:application/json, text/plain, */*,accept-language:zh-CN,zh;q0.9,cache-control:no-cache,pragma:no-cache,priority:u1, i,referer:https://www.toutiao.com/,sec-ch-ua:\Chromium\;v\148\, \Google Chrome\;v\148\, \Not/A)Brand\;v\99\,sec-ch-ua-mobile:?0,sec-ch-ua-platform:\Windows\,sec-fetch-dest:empty,sec-fetch-mode:cors,sec-fetch-site:same-origin,user-agent:Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36}cookies{ttcid:af5b3b1648c84c7391a36100fe90a4fd97,_ga:GA1.1.476297729.1769422665,csrftoken:fdd499064e837df03671803402c28f48,gfkadpd:24,6457,local_city_cache:%E5%AE%9C%E5%AE%BE,_ga_QEHZPBE5HH:GS2.1.s1781161730$o3$g0$t1781161730$j60$l0$h0,tt_scid:p3iMkJt4STrUfibsf7H2kdo6gPbdqYzPKu4CcCk.D8FeGhWKOf-8DM7475.eOLQv963a,s_v_web_id:verify_mq95pgf2_2yp68J9v_uf6R_48n6_8FN1_sgic6IKuBWlC,ttwid:1%7CnX3WQ0jRn2nFx5Jv3aanvKwmVPT1oImP487VlFenCUg%7C1781161741%7Cf369a97a000e641173c5a84e0fdf3c8fd75dd96b675799b872941fd4df0f4d3c,tt_webid:7650031394076788270,__druidClientInfo:JTdCJTIyY2xpZW50V2lkdGglMjIlM0ExNjkyJTJDJTIyY2xpZW50SGVpZ2h0JTIyJTNBOTMyJTJDJTIyd2lkdGglMjIlM0ExNjkyJTJDJTIyaGVpZ2h0JTIyJTNBOTMyJTJDJTIyZGV2aWNlUGl4ZWxSYXRpbyUyMiUzQTEuNSUyQyUyMnVzZXJBZ2VudCUyMiUzQSUyMk1vemlsbGElMkY1LjAlMjAoV2luZG93cyUyME5UJTIwMTAuMCUzQiUyMFdpbjY0JTNCJTIweDY0KSUyMEFwcGxlV2ViS2l0JTJGNTM3LjM2JTIwKEtIVE1MJTJDJTIwbGlrZSUyMEdlY2tvKSUyMENocm9tZSUyRjE0OC4wLjAuMCUyMFNhZmFyaSUyRjUzNy4zNiUyMiU3RA}urlhttps://www.toutiao.com/api/pc/list/feedparams{channel_id:3189398996,min_behot_time:0,offset:0,refresh_count:1,category:pc_profile_channel,client_extra_params:{\short_video_item\:\filter\},aid:24,app_name:toutiao_web,msToken:8t_QpJRRFqYcOGrcnH9SSZmYb8g9eAj66WvkKiE1qDKY60gTOmYLzBQl-48rPMNfp4H0McdNDAMQ0PzAuJoaM3UsiB0ECMudfrDTejsX7DJvWU02R8ONFt6bQaY2FcSU,# a_bogus: mjmhBmugDkgBhV6d532LfY3qV1B3YDZj0t9bMDhq1xf8BL39HMT19exEmzivGzRjET//IeSjy4hbTrOgrQ/n81wf9Skw/2CZm6T0t-P2so0j53inCgWME0hN-vW3SFqQ-wNAEOsQy75tzbi0AIQn4kIAPyZea1gOEisnOtg}withopen(./a_bogus.js,r,encodingutf-8)asf:ctxexecjs.compile(f.read())a_bogusctx.call(get_a_bogus,urlencode(params))params[a_bogus]a_bogus responserequests.get(url,headersheaders,paramsparams)print(response.text)print(response)结果展示结语文章内容仅供学习参考如有侵权立即删除。