江苏青年大学习分析
本帖最后由 jjjzw 于 2022-11-14 19:57 编辑# 江苏QNDXX
自从团关系从学校迁回家，再也不能摆烂不做青年大学习了，因此我想到分析一下青年大学习的一般流程，提高一下完成效率
通过Charles抓包分析
### 一、关键时间点
观察整个学习流程，分为5个时间点：
+ 打开页面
+ 开始学习
+ 播放完成
+ 课后答题
+ 获得截图
其中，在作答时没有发现post请求，答题结束也没有任何验证，因此课后答题是js判断正误的，完全可以跳过，答案对错不影响完成
#### 1、学习过程由以下4个`post`请求构成：
[!(https://s1.ax1x.com/2022/11/14/zAAJWn.png)](https://imgse.com/i/zAAJWn)
[!(https://s1.ax1x.com/2022/11/14/zAe0j1.png)](https://imgse.com/i/zAe0j1)
[!(https://s1.ax1x.com/2022/11/14/zAe0j1.png)](https://imgse.com/i/zAe0j1)
[!(https://s1.ax1x.com/2022/11/14/zAe0j1.png)](https://imgse.com/i/zAe0j1)
虽然域名很奇怪，但是api/event的字眼让我感觉到了不凡
其中有一些未知参数需要分析
#### 2、截图由一个get请求完成
[!(https://s1.ax1x.com/2022/11/14/zAEi60.png)](https://imgse.com/i/zAEi60)
### 二、参数分析
#### 1、guid
在`brilliant.manual.js`文件中找到了生成`guid`的算法：
[!(https://s1.ax1x.com/2022/11/14/zAESYj.png)](https://imgse.com/i/zAESYj)
`guid`由以下函数生成：
```javascript
function e(t, n) {
var e = new Date,
e = (e.setTime(e.getTime() + 94608e6), "; expires=" + e.toUTCString());
r.cookie = t + "=" + (n || "") + e + "; samesite=strict; path=/"
}
function i(t) {
t = r.cookie.match(new RegExp("(?:^|; )" + t.replace(/([\.$?*|{}\(\)\[\]\\\/\+^])/g, "\\$1") + "=([^;]*)"));
return t ? decodeURIComponent(t) : null
}
function a() {
i("b_guid");
var t = {
guid: i("b_guid")
};
return t.guid ? {
guid: decodeURIComponent(t.guid)
} : (t = {
guid: n() + n() + "-" + n() + "-" + n() + "-" + n() + "-" + n() + n() + n()
}, e("b_guid", encodeURIComponent(t.guid)), t);
function n() {
return (65536 * (1 + Math.random()) | 0)
.toString(16)
.substring(1)
}
}
```
实际上就是通过函数`n`生成65536-131072之间随机整数的16进制并切割出4位，在函数`a`内拼接
console测试一下：
[!(https://s1.ax1x.com/2022/11/14/zAECpn.png)](https://imgse.com/i/zAECpn)
#### 2、tc
`timecreate`：创建时间
#### 3、tn
`timenow`：当前时间
#### 4、n
当前模块名
分为4类：
1. 打开页面
2. 开始学习
3. 播放完成
4. 课后答题
#### 5、u、r
学习页面地址
分析打开大学习界面后的流程
[!(https://s1.ax1x.com/2022/11/14/zAVFCd.png)](https://imgse.com/i/zAVFCd)
通过get获取页面信息，关键cookie：`laravel_session`
在该页面中，存在关键信息：`token`和`lession_id`
[!(https://s1.ax1x.com/2022/11/14/zAAzkQ.png)](https://imgse.com/i/zAAzkQ)
随后通过post方法获取真正的页面
[!(https://s1.ax1x.com/2022/11/14/zAVP4H.png)](https://imgse.com/i/zAVP4H)
将地址稍作修改后得到了`u`和`r`两个地址的值
#### 6、m
学习信息
[!(https://s1.ax1x.com/2022/11/14/zAVk8A.png)](https://imgse.com/i/zAVk8A)
得到初始的`m`值，随后通过修改得到所有`m`值
#### 7、city
在`area.js`中得到，但混淆过，难以阅读
在打开页面时有“欢迎来自\*省\*市的团员”选项框，通过观察下拉选项框可以直接得出：
| 代码 |城市名|
| :--: | :------: |
|1 |南京市|
|2 |无锡市|
|3 |徐州市|
|4 |常州市|
|5 |苏州市|
|6 |南通市|
|7 | 连云港市 |
|8 |淮安市|
|9 |盐城市|
|10|扬州市|
|11|镇江市|
|12|泰州市|
|13|宿迁市|
### 三、流程
1. 通过`laravel_lession`获取页面，得到参数`token`和`lession_id`，创建参数`tc`
2. 通过`post`方法得到真正的页面地址，得到`u`和`r`和初始的`m`
3. 随机生成`guid`
4. 依次构造`tn`和`m`，并发送请求
5. 完成4个模块，请求截图
### 四、构造脚本
(https://github.com/Icingworld/QNDXX)
### 五、运行截图
[!(https://s1.ax1x.com/2022/11/14/zA00BV.png)](https://imgse.com/i/zA00BV)
[!(https://s1.ax1x.com/2022/11/14/zA0Ucn.jpg)](https://imgse.com/i/zA0Ucn)
# 代码仅供学习交流用途
有朋友分析过，还有一个接口可以提前查到封面，
然后搞一些手机截图的demo，随机把姓名班级写进去，
把状态栏上的时间用贴图改一下，就可以替舍友跑了（不是）
jjjzw 发表于 2022-11-15 19:56
> requests.exceptions.SSLError: HTTPSConnectionPool
一般来说是因为电脑开了网络代{过滤}理（ ...
D:\Programs\Python\Python39\python.exe C:/Users/l/Desktop/课/QNDXX-main/main.py
D:\Programs\Python\Python39\lib\site-packages\bs4\__init__.py:435: MarkupResemblesLocatorWarning: The input looks more like a filename than markup. You may want to open this file and pass the filehandle into Beautiful Soup.
warnings.warn(
Traceback (most recent call last):
File "D:\Programs\Python\Python39\lib\site-packages\urllib3\connectionpool.py", line 665, in urlopen
httplib_response = self._make_request(
File "D:\Programs\Python\Python39\lib\site-packages\urllib3\connectionpool.py", line 376, in _make_request
self._validate_conn(conn)
File "D:\Programs\Python\Python39\lib\site-packages\urllib3\connectionpool.py", line 994, in _validate_conn
conn.connect()
File "D:\Programs\Python\Python39\lib\site-packages\urllib3\connection.py", line 352, in connect
self.sock = ssl_wrap_socket(
File "D:\Programs\Python\Python39\lib\site-packages\urllib3\util\ssl_.py", line 370, in ssl_wrap_socket
return context.wrap_socket(sock, server_hostname=server_hostname)
File "D:\Programs\Python\Python39\lib\ssl.py", line 500, in wrap_socket
return self.sslsocket_class._create(
File "D:\Programs\Python\Python39\lib\ssl.py", line 1040, in _create
self.do_handshake()
File "D:\Programs\Python\Python39\lib\ssl.py", line 1309, in do_handshake
self._sslobj.do_handshake()
ssl.SSLCertVerificationError: certificate verify failed: unable to get local issuer certificate (_ssl.c:1129)
During handling of the above exception, another exception occurred:
Traceback (most recent call last):
File "D:\Programs\Python\Python39\lib\site-packages\requests\adapters.py", line 439, in send
resp = conn.urlopen(
File "D:\Programs\Python\Python39\lib\site-packages\urllib3\connectionpool.py", line 719, in urlopen
retries = retries.increment(
File "D:\Programs\Python\Python39\lib\site-packages\urllib3\util\retry.py", line 436, in increment
raise MaxRetryError(_pool, url, error or ResponseError(cause))
urllib3.exceptions.MaxRetryError: HTTPSConnectionPool(host='h5.cyol.com', port=443): Max retries exceeded with url: /special/daxuexi/da1gbw1x4m/m.html (Caused by SSLError(SSLCertVerificationError(1, ' certificate verify failed: unable to get local issuer certificate (_ssl.c:1129)')))
During handling of the above exception, another exception occurred:
Traceback (most recent call last):
File "C:\Users\l\Desktop\课\QNDXX-main\main.py", line 195, in <module>
new.login()
File "C:\Users\l\Desktop\课\QNDXX-main\main.py", line 120, in login
r4 = requests.get(url=self.u, headers=self.headers3)
File "D:\Programs\Python\Python39\lib\site-packages\requests\api.py", line 76, in get
return request('get', url, params=params, **kwargs)
File "D:\Programs\Python\Python39\lib\site-packages\requests\api.py", line 61, in request
return session.request(method=method, url=url, **kwargs)
File "D:\Programs\Python\Python39\lib\site-packages\requests\sessions.py", line 530, in request
resp = self.send(prep, **send_kwargs)
File "D:\Programs\Python\Python39\lib\site-packages\requests\sessions.py", line 643, in send
r = adapter.send(request, **kwargs)
File "D:\Programs\Python\Python39\lib\site-packages\requests\adapters.py", line 514, in send
raise SSLError(e, request=request)
requests.exceptions.SSLError: HTTPSConnectionPool(host='h5.cyol.com', port=443): Max retries exceeded with url: /special/daxuexi/da1gbw1x4m/m.html (Caused by SSLError(SSLCertVerificationError(1, ' certificate verify failed: unable to get local issuer certificate (_ssl.c:1129)')))
进程已结束，退出代码为 1
可惜今天已经做过大学习了 正好今天没做{:301_978:} 大佬牛批 杭州市代码多少，怎么查呀 今天刚做完第25期。 这个好用吗 Nice2cu2 发表于 2022-11-14 18:41
这个好用吗
我已经用这个做了三期了{:301_1001:} cgfgfv258 发表于 2022-11-14 18:13
杭州市代码多少，怎么查呀
我不太清楚其他省份大学习是不是一样的过程{:1_907:}
我的省份和城市代码是在打开大学习之后在选择框里查的，按顺序数
https://s1.ax1x.com/2022/11/14/zAUOTe.jpg