DoubleLi

qq: 517712484 wx: ldbgliet
  博客园 :: 首页 :: 博问 :: 闪存 :: 新随笔 :: 联系 :: 订阅 订阅 :: 管理 ::
VC显示网页验证码、模拟CSDN网页登录

这两天，本来想花点时间研究一下QQ空间、农场外挂，于是抓包分析一了下，只可惜，在QQ网页登录时进行了加密处理，可惜我对网页编程一窍不通。有些朋友曾讲过那些是通过JS代码进行加密，可惜我JS也是一片空白，真是“出师未杰身先死”，惭愧惭愧......

于是只好挑CSDN这类简易一些的尝试学习一下（仅供学习交流），下面是学习笔记：

程序运行截图：

CSDN Login

1、本机环境：Windows XP SP3、ADSL

2、开发工具：WildPackets OmniPeek V5.1.4

                    Visual C++ 6.0

                    IE6.0

                    FlexEdit V2.3.1871

3、数据包截图：

QQ Login

(QQ登录时，在密码2222加密时卡壳了，我尝试过很多加密算法，最终以失败告终......)

4、验证码显示使用IStream和IPicture来显示：

[cpp] view plaincopyprint?
  1. /************************************************************************/      
  2. /* 函数说明：获取应用程序当前目录                                        
  3. /* 参    数：无                                    
  4. /* 返 回 值：返回目录路径、CString类型字符串     
  5. /* By:Koma   2009.10.13 11:23                                
  6. /************************************************************************/      
  7. CString C***Dlg::GetExePath()    
  8. {    
  9.     char pathbuf[260];       
  10.     int  pathlen = ::GetModuleFileName(NULL,pathbuf,260);       
  11.      
  12.     // 替换掉单杠    
  13.     while(TRUE)       
  14.     {       
  15.         if(pathbuf[pathlen--]=='//')       
  16.             break;       
  17.     }       
  18.     pathbuf[++pathlen]=   0x0;       
  19.     CString  fname = pathbuf;       
  20.     return   fname;       
  21. } 

 

[cpp] view plaincopyprint?
  1. /************************************************************************/      
  2. /* 函数说明：下载验证码图片                                        
  3. /* 参    数：无                                    
  4. /* 返 回 值：无     
  5. /* By:Koma   2009.10.13 11:50                                 
  6. /************************************************************************/  
  7. void C***Dlg::DownURLImage() 
  8. { 
  9.     CInternetSession    session; 
  10.     CString     strUrl; 
  11.     CFile       *pFile,out;  
  12.     char        buff[512]; 
  13.     CString     strPath; 
  14.      
  15.     // 产生八位随机数数组成验证码 
  16.     int         nRand1 = rand()%100000+10000; 
  17.     int         nRand2 = rand()%200000+10000; 
  18.  
  19.     strUrl.Format("http://passport.csdn.net/ShowExPwd.aspx?temp=%d%d",nRand1,nRand2); 
  20.     strPath = GetExePath() + "//test.tmp"; 
  21.     pFile = session.OpenURL(strUrl);  
  22.     out.Open(strPath, CFile::modeCreate | CFile::modeWrite);  
  23.     while(pFile->Read(buff,512)){  
  24.         out.Write(buff,512);  
  25.     }  
  26.     out.Flush(); 
  27.     out.Close();  
  28. } 

 

[cpp] view plaincopyprint?
  1. /************************************************************************/      
  2. /* 函数说明：显示验证码图片                                        
  3. /* 参    数：无                                    
  4. /* 返 回 值：无     
  5. /* By:Koma   2009.10.13 13:12                                 
  6. /************************************************************************/  
  7. void C***Dlg::ShowImage() 
  8. { 
  9.     ::CoInitialize(NULL);           // 初始化COM  
  10.     HRESULT hr;  
  11.     CFile   file; 
  12.     CString strPath; 
  13.     CPaintDC dc(this); 
  14.      
  15.     strPath = GetExePath() + "//test.tmp"; 
  16.     file.Open(strPath, CFile::modeRead | CFile::shareDenyNone); 
  17.  
  18.     DWORD   dwSize = file.GetLength();  
  19.     HGLOBAL hMem = ::GlobalAlloc( GMEM_MOVEABLE, dwSize );  
  20.     LPVOID  lpBuf = ::GlobalLock( hMem );  
  21.  
  22.     file.ReadHuge( lpBuf, dwSize );  
  23.     file.Close();  
  24.     ::GlobalUnlock( hMem );  
  25.      
  26.     // 由HGLOBAL得到IStream，参数TRUE 表示释放IStream的同时，释放内存  
  27.     hr = ::CreateStreamOnHGlobal(hMem,TRUE,&pStream );  
  28.     ASSERT(SUCCEEDED(hr));  
  29.      
  30.     hr = ::OleLoadPicture(pStream, dwSize, TRUE, IID_IPicture,(LPVOID *)&pPicture);  
  31.     ASSERT(hr==S_OK);  
  32.      
  33.     long nWidth,nHeight;                // 宽高 MM_HIMETRIC模式，单位是0.01毫米  
  34.     pPicture->get_Width( &nWidth );      // 宽  
  35.     pPicture->get_Height( &nHeight );    // 高  
  36.  
  37.     CSize sz(nWidth,nHeight);           // 原大显示 
  38.     dc.HIMETRICtoDP(&sz);               // 转换MM_HIMETRIC模式单位为MM_TEXT像素单位  
  39.      
  40.     pPicture->Render(dc.m_hDC,10,100,sz.cx,sz.cy,0,nHeight,nWidth,-nHeight,NULL);  
  41.     CRect rect(10,100,sz.cx + 10,sz.cy + 100); 
  42.  
  43.     // 将图片区域保存，以便后面只刷新图片区域 
  44.     m_PicRect = rect; 
  45.     if(pPicture)                        // 释放IPicture指针 
  46.         pPicture->Release(); 
  47.     if(pStream)                         // 释放IStream指针，同时释放hMem 
  48.         pStream->Release(); 
  49.     ::CoUninitialize(); 
  50. } 

 

5、经过OmniPeek抓包分析得到：

登录时POST格式：

__EVENTTARGET=&__EVENTARGUMENT=&__VIEWSTATE=%2FwEPDwULLTEyMzU0NzEzNDkPFgIeCkZpbmlzaFN0YXlnFgJmD2QWBAIBDxYCHgRUZXh0BQznlKjmiLfnmbvlvZVkAgIPZBYCAgMPZBYCAgEPFgIeB1Zpc2libGVoZBgBBR5fX0NvbnRyb2xzUmVxdWlyZVBvc3RCYWNrS2V5X18WAgUeY3RsMDAkQ1BIX0NvbnRlbnQkY2JfU2F2ZVN0YXRlBR1jdGwwMCRDUEhfQ29udGVudCRJbWFnZV9Mb2dpbjFp31Bt8XH%2B3e%2Bh97Uk6ofQQady&ctl00%24CPH_Content%24tb_LoginNameOrLoginEmail=testkoma&ctl00%24CPH_Content%24tb_Password=ningyusky&ctl00%24CPH_Content%24tb_ExPwd=BZTS3&ClientKey=c77f51c7-cbaf-427d-9314-a04303f79847&ctl00%24CPH_Content%24cb_SaveState=on&from=http%3A%2F%2Fhi.csdn.net%2F&MailParameters=&PrePage=&MailParameters=&ctl00%24CPH_Content%24Image_Login.x=33&ctl00%24CPH_Content%24Image_Login.y=13

至于其他动作的话，自己抓包分析吧！

之前看到博客园深蓝居一篇文章关于C#写的CSDN提交表单

http://www.cnblogs.com/studyzy/archive/2008/05/08/1187626.html

所以在前辈的基础上，我增加了VC获取Cookie ClientKey值，下面是POST代码：

[cpp] view plaincopyprint?
  1. void C***Dlg::OnBtnLogin()  
  2. { 
  3.     // TODO: Add your control notification handler code here 
  4.     UpdateData(TRUE); 
  5.     if(m_strUser.IsEmpty()) 
  6.     { 
  7.         MessageBox("用户名不能为空！","提示",MB_ICONERROR | MB_OK); 
  8.         (CEdit*)GetDlgItem(IDC_EDIT_USER)->SetFocus();  
  9.         return; 
  10.     } 
  11.     if( m_strPassword.IsEmpty()) 
  12.     { 
  13.         MessageBox("密码不能为空！","提示",MB_ICONERROR | MB_OK); 
  14.         (CEdit*)GetDlgItem(IDC_EDIT_PASSWORD)->SetFocus();  
  15.         return; 
  16.     } 
  17.     CString str; 
  18.     try 
  19.     { 
  20.         CInternetSession Session ;  
  21.         CHttpConnection *pHttpConnect = Session.GetHttpConnection("passport.csdn.net") ; 
  22.         if( pHttpConnect ) 
  23.         { 
  24.             CHttpFile* pFile = pHttpConnect->OpenRequest( CHttpConnection::HTTP_VERB_GET,  
  25.                 _T("/UserLogin.aspx"), 
  26.                 NULL, 
  27.                 1, 
  28.                 NULL, 
  29.                 NULL, 
  30.                 INTERNET_FLAG_NO_COOKIES ); 
  31.             // 获取COOKIE ClientKey值 
  32.             CInternetSession    Session; 
  33.             Session.OpenURL("http://passport.csdn.net/UserLogin.aspx"); 
  34.             if(!Session.GetCookie("http://passport.csdn.net/UserLogin.aspx", 
  35.                 _T("ClientKey"),m_strCookies)) 
  36.             { 
  37.                 MessageBox("获取Cookies时出错！"); 
  38.                 return; 
  39.             } 
  40.             CString strKey  = m_strCookies; 
  41.             int     result  = strKey.Find("ClientKey=",0); 
  42.             m_strClientKey  = strKey.Mid(result+10); 
  43.  
  44.             UpdateData(TRUE); 
  45.             CString szFormData = "__EVENTTARGET=&__EVENTARGUMENT=&__VIEWSTATE=%2FwEPDwULLTE4NDgzMDI2NjcPFgIeCkZpbmlzaFN0YXloFgJmD2QWBAIBDxYCHgRUZXh0BQznlKjmiLfnmbvlvZVkAgIPZBYCAgMPZBYCAgEPFgIeB1Zpc2libGVoZBgBBR5fX0NvbnRyb2xzUmVxdWlyZVBvc3RCYWNrS2V5X18WAgUeY3RsMDAkQ1BIX0NvbnRlbnQkY2JfU2F2ZVN0YXRlBR1jdGwwMCRDUEhfQ29udGVudCRJbWFnZV9Mb2dpbr5SL%2FGtMqVCJ%2FCh4jH%2FXp4DhlVU&ctl00%24CPH_Content%24tb_LoginNameOrLoginEmail="+ m_strUser +"&ctl00%24CPH_Content%24tb_Password="+ m_strPassword +"&ctl00%24CPH_Content%24tb_ExPwd="+ m_strCode +"&ClientKey="+ m_strClientKey +"&ctl00%24CPH_Content%24cb_SaveState=on&from=http%3A%2F%2Fhi.csdn.net%2Fmy.html&MailParameters=&MailParameters=&ctl00%24CPH_Content%24Image_Login.x=26&ctl00%24CPH_Content%24Image_Login.y=11"; 
  46.             if (pFile) 
  47.             {    
  48.                 pFile->AddRequestHeaders("POST /UserLogin.aspx HTTP/1.1/r/n"); 
  49.                 pFile->AddRequestHeaders("Accept:   image/gif, image/x-xbitmap, image/jpeg, image/pjpeg, application/x-shockwave-flash, application/vnd.ms-excel, application/vnd.ms-powerpoint, application/msword, application/QVOD, application/QVOD, */*/r/n"); 
  50.                 pFile->AddRequestHeaders("Referer:   http://passport.csdn.net/UserLogin.aspx/r/n"); 
  51.                 pFile->AddRequestHeaders("Accept-Language:   zh-cn/r/n"); 
  52.                 pFile->AddRequestHeaders("Content-Type:   application/x-www-form-urlencoded/r/n"); 
  53.                 pFile->AddRequestHeaders("Accept-Encoding:   gzip, deflate/r/n"); 
  54.                 pFile->AddRequestHeaders("User-Agent:   Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; POTU(RR:28031409:0:5513822); Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1) ; .NET CLR 2.0.50727; CIBA)/r/n"); 
  55.                 pFile->AddRequestHeaders("Connection:   Keep-Alive/r/n"); 
  56.                 pFile->AddRequestHeaders("Cache-Control:   no-cache/r/n"); 
  57.                 pFile->AddRequestHeaders(szFormData); 
  58.                 pFile->SendRequest(); 
  59.                  
  60.                 // 返回的HTML 
  61.                 CString s ; 
  62.                 while (pFile->ReadString(s)) 
  63.                     str += s ; 
  64.                 //MessageBox(str); 
  65.                  
  66.                 pFile->Close(); 
  67.                 delete pFile ; 
  68.             } 
  69.             CFile file; 
  70.             file.Open("Test.aspx",CFile::modeCreate | CFile::modeWrite,NULL); 
  71.             file.Write(str,str.GetLength()); 
  72.             file.Flush(); 
  73.             file.Close(); 
  74.  
  75.             pHttpConnect->Close() ; 
  76.             delete pHttpConnect ; 
  77.         } 
  78.         wchar_t*    pWChar = NULL; 
  79.         DWORD       nLen1; 
  80.          
  81.         // 将新浪网页UTF-8格式编码转换成Unicode 
  82.         nLen1   = MultiByteToWideChar(CP_UTF8,0,str,str.GetLength(),pWChar,0); 
  83.         pWChar  = new wchar_t[nLen1 + 1]; 
  84.         memset(pWChar,0,(nLen1 + 1 ) * sizeof(wchar_t)); 
  85.         MultiByteToWideChar(CP_UTF8,0,str,str.GetLength(),pWChar,nLen1); 
  86.          
  87.         char*   pChar = NULL; 
  88.         DWORD   nLen2; 
  89.          
  90.         nLen2 = WideCharToMultiByte(CP_ACP,0,pWChar,nLen1,pChar,0,NULL,NULL);  
  91.         pChar = new char[nLen2 + 1]; 
  92.         memset(pChar,0, nLen2 + 1); 
  93.         WideCharToMultiByte(CP_ACP,0,pWChar,nLen1,pChar,nLen2,NULL,NULL); 
  94.          
  95.         // 查找登录时服务器时返回的信息 
  96.         str.Format("%s",pChar); 
  97.         MessageBox(str); 
  98.     } 
  99.     catch( CInternetException *e ) 
  100.     { 
  101.         e->Delete();     
  102.     } 
  103. } 

 

（编程水平有限，其中代码并没有经过严格测试，难免有所不足，敬请谅解！）

6、源代码下载：

http://download.csdn.net/source/1740481

 

 

from:

http://blog.csdn.net/wangningyu/article/details/4667954
posted on 2013-01-07 10:28  DoubleLi  阅读(2349)  评论(0)  编辑  收藏  举报