PHP Curl imitate the user to login Sina Weibo micro Bo example

The day before yesterday received a demand need to simulate landing micro-blog and then carry out Weibo, have done a lot of analog login Ali mother, micro-letter, and some other internal system, has not been able to log on, haha, so there is no time to do things, but when the analysis of Sina's landing process to feel the pressure,? Dan? Descurainiae the raise with Qian stranded reef weary Huan driving.?? Shrimp du sigh mu invasion? Dark raised with the Qin Jake SHA1 (SHA1 (SHA1 (PWD)). Once.servertime), must not be used, mainly make this encryption algorithm is not possible so the password can not talk about login, and then on the Internet to find code, one hours without the obtained,? 辶 play? 獯 Stomach fan immigrations window moxa Wu? Ammonia 6 that party 鋈 チ m locust the spade envy Neon bake 蛴 lucky Huan 龃? So, is not I use the Micro-blog account password can also login to Sina Mail or other Sina products to go, feel the hope is very big, haha, sure enough micro Bo account can directly login to all Sina products, and then visit the microblogging I have been in the state of To prove this God-made horse?

Actually it is very useful, a big company in a project investment technology and the project profitability and prospects have a lot of relationship, Micro Bo he can spend a lot of mind to do, but other not necessarily, haha, in the case of finding that place password is not encrypted that is not very much to say. (PS: More interested in network security, this way for hackers is called a side note, side note is that when hackers attack a website, this site security to do very well, no known loopholes, more difficult to break, so hackers will look for the site under the server under the other sites, and then find a more easily breached, Through this website hangs the horse, the shell, to raise the right, then the target website also falls, thought in the same server, therefore .... The goal is to get to the target station, either way, just take it off, it's a dirty idea.

Https://login.sina.com.cn/sso/login.php?client=ssologin.js (v1.4.15) &_=1403138799543 simple grab bag found the password is not encrypted, haha, Can't we simulate a login? Well, actually, it's a little early for fun.

First login to Sina's bar, the code minutes will be done. Returns a JSON array

The code is as follows

Copy Code

$password = $p; $username = Base64_encode ($u); $LOGINURL = ' Https://login.sina.com.cn/sso/login.php?client=ssologin.js (v1.4.15) &_=1403138799543 '; $loginData [' entry '] = ' SSO '; $loginData [' gateway '] = ' 1 '; $loginData [' from '] = ' null '; $loginData [' savestate '] = ' 30 '; $loginData [' useticket '] = ' 0 '; $loginData [' pagerefer '] = '; $loginData [' vsnf '] = ' 1 '; $loginData [' su '] = Base64_encode ($u); $loginData [' service '] = ' SSO '; $loginData [' sp '] = $password; $loginData [' sr '] = ' 1920*1080 '; $loginData [' encoding '] = ' UTF-8 '; $loginData [' cdult '] = ' 3 '; $loginData [' domain '] = ' sina.com.cn '; $loginData [' prelt '] = ' 0 '; $loginData [' returntype '] = ' TEXT '; Var_dump ($loginData); exit; $login = Json_decode (Loginpost ($LOGINURL, $loginData), true); Var_dump ($login); exit;function loginpost ($url, $data) { Global $cookie _file; echo $cookie _file; exit; $tmp = '; if (Is_array ($data)) { foreach ($data as $key => $value) { $tmp. = $key. " = ". $value." & "; } $post = Trim ($tmp, "&"); }else{ $post = $data; } $ch = Curl_init (); curl_setopt ($ch, Curlopt_url, $url); curl_setopt ($ch, curlopt_returntransfer,1); curl_setopt ($ch, Curlopt_ssl_verifypeer, false); curl_setopt ($ch, Curlopt_ssl_verifyhost, false); curl_setopt ($ch, curlopt_post,1); curl_setopt ($ch, Curlopt_postfields, $post); curl_setopt ($ch, Curlopt_cookiejar, $cookie _file); curl_setopt ($ch, Curlopt_cookiejar, $cookie _file); $return = curl_exec ($ch); $info = Curl_getinfo ($ch); Curl_close ($ch); return $return;

Returns an array of JSON data

The

code is as follows

copy code

Array (size=4)   ' retcode ' => string ' 0 ' (length=1)   ' UID ' => string ' 1920109964 ' (length=10)   ' Nick ' => string ' Grandpa Telling Stories ' (length=18)   ' crossdomainurllist ' =>     Array (size=2)       0 => string ' https:// passport.weibo.com/wbsso/login?ticket=st-mtkymdewotk2na%3d%3d-1403228192-gz-ab37dc0c18ba3bfcd90aefac6115149d &ssosavestate=1434764192 ' (length=140)       1 => string ' https:// crosdom.weicaifu.com/sso/crosdom?action=login&savestate=1434764192 ' (length=74)

This time that we login successfully, but in fact, the address of our microblog home is not weibo,com, but http://weibo.com/bipeng0405/home?wvr=5 such address, how we get this address, very simple, Direct crawl Weibo. COM then he will automatically give you jump back, you just need to take the address of the jump to record it

The code is as follows	Copy Code
$ch = Curl_init (); curl_setopt ($ch, Curlopt_url, "http://weibo.com"); curl_setopt ($ch, curlopt_returntransfer,1); curl_setopt ($ch, Curlopt_cookiefile, $cookie _file); curl_setopt ($ch, Curlopt_cookiejar, $cookie _file); $return = curl_exec ($ch); $info = Curl_getinfo ($ch);

Curl_close ($ch); there is a problem here, this time you may find that did not jump to their microblog home page, this is why, you can look at the landing time has two connection addresses, which have a Weibo domain under an address, Guessing should be done with cookies set so get one side of him first.

The code is as follows	Copy Code
Get ($login [' crossdomainurllist '][0]);

This code has to be weibo.com before you get it, otherwise there will be a problem.

This is the logic of the login, the process is very long spent almost a day, alas. No mood to write an article

Original from: http://www.mapenggang.com