"Sina Weibo automatic review software design and implementation of the simulation login"

Weibo login Analysis 1, packet capture analysis

Figure 1

We may need the following data:

General  Request url:http:Login.sina.com.cn/sso/login.php?client=ssologin.js (v1.4.18)Request HeadersHost:login.sina.com.cnOrigin:http://weibo.comReferer:http:weibo.com/Upgrade-insecure-requests:1User-agent:mozilla/5.0 (X11; Linux x86_64) applewebkit/537.36 (khtml, like Gecko) chrome/50.0.2661.94 safari/537.36 Form Dataentry:weibogateway:1 from: savestate:7Useticket:1pagerefer:http://login.sina.com.cn/sso/logout.php?entry=miniblog&r=http%3a%2f%2fweibo.com%2flogout.php %3fbackurl%3d% 252FVSNF:1su:mtgznji5nzi5mjg=service:miniblogservertime: 1463956665 nonce:0pe9sxpwencode:rsa2rsakv: 1330428213 SP : 38af3d36bc7c044ce0adcc20dead2ff78c62b84d74cdbf12b7c57e912dd333923f30f48c2f560743cce362655fa9f1474dc9c67c7b915bba30a163c9 C935ecab5cac6ca58aee2da6f42718bd28a80d78707a6cd6be2d0216a3701eae0a626ec1d20a590463f8f813e9663135aaf3f0810b7b27316b78bbf03 8a869bc01b52000sr:1366*768Encoding:utf-8prelt:327url:http:weibo.com/ajaxlogin.php?framelogin=1&callback=Parent.sinaSSOController.feedBackUrlCallBackreturntype:META

Where the bold word indicates that the data is fixed data, blue Word indicates that the data is variable, but more stable, the red word indicates that the data each login is not the same, that is, in addition to Su, SP, rsakv, Servertime, Nonce is generated by JS processing dynamically, the other is a fixed value, Can write in the code to die, in fact, Su,rsakv,servertime can also write dead. How do you get these values?

2. View JSON

We also need to know how JS handles the user name and password that we fill in, namely Su and SP.
First we have to http://login.sina.com.cn/signup/signin.php?entry=sso this page in the not logged in state, and get http://login.sina.com.cn/js/sso/ Ssologin.js this JS file.
Look at the MakeRequest function of Ssologin.js, which is prototyped as follows:

  varMakeRequest =function(username, password, savestate) {varRequest ={entry:me.getEntry (), Gateway:1, From:me.from, Savestate:savestate, Useticket:me.useTicket? 1:0    }; if(me.failredirect) {ME.LOGINEXTRAQUERY.FRD= 1} request=Objmerge (Request, {Pagerefer:document.referrer|| ""    }); Request=Objmerge (Request, Me.loginextraflag); Request=Objmerge (Request, me.loginextraquery); request.su = SinaSSOEncoder.base64.encode (UrlEncode (username)); if(me.service) {Request.service=Me.service}if((Me.logintype & RSA) && me.servertime && Sinassoencoder &&sinassoencoder.rsakey) {request.servertime=Me.servertime; Request.nonce=me.nonce; Request.pwencode= "RSA2"; REQUEST.RSAKV=me.rsakv; varRsakey =NewSinassoencoder.rsakey (); Rsakey.setpublic (Me.rsapubkey,"10001"); Password = Rsakey.encrypt ([Me.servertime, Me.nonce].join ("\ T") + "\ n" + password) } Else {      if((Me.logintype & Wsse) && me.servertime && Sinassoencoder &&SINASSOENCODER.HEX_SHA1) {Request.servertime=Me.servertime; Request.nonce=me.nonce; Request.pwencode= "Wsse"; Password= SINASSOENCODER.HEX_SHA1 ("" + SINASSOENCODER.HEX_SHA1 (SINASSOENCODER.HEX_SHA1 (password)) + Me.servertime +me.nonce)}} request.sp=password; Try{REQUEST.SR= Window.screen.width + "*" +Window.screen.height}Catch(e) {}returnRequest}

#1: Su, is after the HTML character escapes and then turns into base64 encoding

#2: Sp,weibo Login to password There are two ways to encrypt: RSA2 and Wsse, we from Figure 1 pwnencode=rsa2 know, JS processing is this part of the logic (as to the other part of the wsse when used, I do not know)

"Sina Weibo automatic review software design and implementation of the simulation login"