Akamai阿卡迈_abck逆向sensor_data（二）

一时失言乱红尘 2023-09-30 10:53 3阅读 0赞

继续跟着上一篇搞起来：  
上一篇传输门：[https://blog.csdn.net/weixin\_38927522/article/details/123691665][https_blog.csdn.net_weixin_38927522_article_details_123691665]

在我的记忆里，国外大部分航司全部是用的这一套，像韩国的，捷星航空，还有美国的一些航空。

这一篇我直接先将思路公布一下：

思路：
        1. 首先访问 https://www.flyasiana.com/5qSZcnDz_/hGWtnW/AkEc/auTFfPPk/9rYphrpkup/dDswFj8m/FVRIJ3V/tGkQ?n$eum=157910959357612400 ,取出 set_cookie (ak_bmsc, bm_sz, _abck)
        2. 再通过 _abck 动态生成 sensor_data
        3. 再次访问  https://www.flyasiana.com/5qSZcnDz_/hGWtnW/AkEc/auTFfPPk/9rYphrpkup/dDswFj8m/FVRIJ3V/tGkQ?n$eum=157910959357612400 , 携带 三个cookie 以及 sensor_data ,注意：sensor_data 是一个 request playload, 因此需要 json.dumps() 。取出 set_cookie (_abck)
        4. 携带 _abck 进行访问 https://www.flyasiana.com/I/CN/CH/SearchRevenueDomesticFareDrivenAvailFlights.do?n$eum=157910959357612400 。取到返回值
        5. 如果第四步 返回状态码为 403, 则将参与以上步骤进行置换_abck值

**sensor\_data生成重写前js：**

function pd() {
        
        var a = 0;
    
        a = bmak["get_cf_date"]();
        var t = bmak["updatet"](),
            e = 3;
        bmak["ckie"] && (e = bmak["get_cookie"]());
        var n = bmak["gd"](),
            o = "do_en",
            m = "dm_en",
            r = "t_en",
            i = o + "," + m + "," + r,
            c = bmak["forminfo"](),
            b = bmak["getdurl"](),
            d = bmak["aj_type"] + "," + bmak["aj_indx"];
        !bmak["fpcf"]["fpValCalculated"] && (0 == bmak["js_post"] || bmak["aj_indx"] > 0) && bmak["fpcf"]["fpVal"]();
        var k = bmak['ke_vel'] + bmak['me_vel'] + bmak['doe_vel'] + bmak['dme_vel'] + bmak['te_vel'] + bmak['pe_vel'],
            s = bmak["get_cf_date"]() - bmak['start_ts'],
            l = bmak['pi'](bmak['d2'] / 6),
            u = bmak['fas'](),
            _ = [bmak['ke_vel'] + 1, bmak['me_vel'] + 1, bmak['te_vel'], bmak['doe_vel'], bmak['dme_vel'], bmak['pe_vel'], k, t, bmak['init_time'], bmak['start_ts'], bmak["fpcf"]["td"], bmak['d2'], bmak['ke_cnt'], bmak['me_cnt'], l, bmak['pe_cnt'], bmak['te_cnt'], s, bmak['ta'], bmak["n_ck"], e, bmak['ab'](e), bmak["fpcf"]["rVal"], bmak["fpcf"]["rCFP"], u],
            f = _.join(","),
            p = '' + bmak['ab'](bmak["fpcf"]["fpValstr"]),
            v = bmak['sed']();
    
    
        sensor_data = bmak['ver'] + '-1,2,-94,-100,' + n + '-1,2,-94,-101,' + i + '-1,2,-94,-105,' + bmak['informinfo'] + '-1,2,-94,-102,' + c + '-1,2,-94,-108,' + bmak['kact'] + '-1,2,-94,-110,' + bmak['mact'] + '-1,2,-94,-117,' + bmak['tact'] + '-1,2,-94,-111,' + bmak['doact'] + '-1,2,-94,-109,' + bmak['dmact'] + '-1,2,-94,-114,' + bmak['pact'] + '-1,2,-94,-103,' + bmak['vcact'] + '-1,2,-94,-112,' + b + '-1,2,-94,-115,' + f + '-1,2,-94,-106,' + d,
            sensor_data = sensor_data + '-1,2,-94,-119,' + bmak['mr'] + '-1,2,-94,-122,' + v + '-1,2,-94,-123,' + bmak['mn_r'];
        var h = bmak['ab'](sensor_data);
        sensor_data = sensor_data + '-1,2,-94,-70,' + bmak["fpcf"]["fpValstr"] + '-1,2,-94,-80,' + p + '-1,2,-94,-116,' + bmak['o9'] + '-1,2,-94,-118,' + h + '-1,2,-94,-121,',
            bmak["sd_debug"](',s1:' + sensor_data['slice'](0, 10))
    
        var g = bmak['od'](bmak['cs'], bmak['api_public_key'])['slice'](0, 16),
            w = Math['floor'](bmak["get_cf_date"]() / 36e5),
            y = bmak["get_cf_date"](),
            C = g + bmak['od'](w, g) + sensor_data;
        sensor_data = C + ';' + (bmak["get_cf_date"]() - a) + ';' + bmak['tst'] + ';' + (bmak["get_cf_date"]() - y)
    }

我已经将部分值打断点调试为定制，设备指纹目前写死的情况。  
**sensor\_data重写后**：

缺啥补啥，继续搞 -》get\_sensor\_data.js：

以上改写成了可调用的方式：

def __get_sensor_data(self, old_abck_cookie: str):
            """
            根据 old_abck_cookie ,获取 sensor_data
            """
            with open(JS_FILENAME, "r", encoding="utf-8") as f:
                js_content = f.read().replace("this_is_abck_cookie", old_abck_cookie).replace("this_is_url", self.url)
            jscontext = execjs.compile(js_content)
            sensor_data = jscontext.call('get_sensor_data')
            return sensor_data

整个流程用python模拟下：

# -*- coding: utf-8 -*-
    # @Author  : Codeooo
    # @Time    : 2022/03/25
    
    
    import json
    import execjs
    import requests
    from fake_useragent import UserAgent
    
    JS_FILENAME = "get_sensor_data.js"
    
    
    class Abck_Cookie:
    
        def __init__(self, headers, url, data=None):
            self.headers = headers
            self.url = url
            self.data = data
            self.proxies = None
    
        def __get_sensor_data(self, old_abck_cookie: str):
            """
            根据 old_abck_cookie ,获取 sensor_data
            """
            with open(JS_FILENAME, "r", encoding="utf-8") as f:
                js_content = f.read().replace("this_is_abck_cookie", old_abck_cookie).replace("this_is_url", self.url)
            jscontext = execjs.compile(js_content)
            sensor_data = jscontext.call('get_sensor_data')
            print("生成sensor_data：",sensor_data)
            return sensor_data
    
        def __get_old_abck(self):
            """
            获取 set_cookie 中的 _abck_cookie_value,以及所有的 cookie
            """
            headers = {
        
                "User-Agent": UserAgent().random,
                'content-type': 'text/plain;charset=UTF-8',
            }
            # 更新添加自己所写 headers
            headers.update(self.headers)
            try:
                old_abck_response = requests.post(url=self.url, headers=headers, proxies=self.proxies, data=self.data,
                                                  timeout=5)
                print("old_abck_response:",old_abck_response.text)
            except Exception as e:
                return False
            for cookie in old_abck_response.cookies:
                if cookie.name == "_abck":
                    return (cookie.value, old_abck_response.cookies)
            return False
    
        def __get_new_abck(self, sensor_data=None, cookies=None):
            """
            获取 set_cookie 中的 _abck_cookie
            """
            cookies_dict = {
        cookie.name: cookie.value for cookie in cookies}
            headers = {
        
                'User-Agent': 'Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv',
                'Content-Type': 'text/plain;charset=UTF-8',
                'Connection': 'keep-alive',
                'Cookie': 'ak_bmsc={}; bm_sz={}; _abck={}'.format(cookies_dict.get("ak_bmsc"), cookies_dict.get("bm_sz"),
                                                                  cookies_dict.get("_abck")),
                'TE': 'Trailers'
            }
            headers.update(self.headers)
            data = {
        
                "sensor_data": sensor_data
            }
            try:
                res = requests.post(url=self.url, headers=headers, data=json.dumps(data), proxies=self.proxies, timeout=5)
                print("get_new_abck：", res.text)
            except:
                return False
    
            self.cookies = res.cookies.get_dict()
            print("=======当前可用cookies====",self.cookies)
    
        def execute_get_abck_cookie(self):
            """
            统一规划，执行获得新的 abck_cookie
            :return:abck_cookie
            """
            # 获取 未可以使用的 abck_cookie
            old_abck_cookie, cookies = self.__get_old_abck()
            # 获取 sensor_data
            sensor_data = self.__get_sensor_data(old_abck_cookie)
            # 获取 可以使用的 abck_cookie
            self.__get_new_abck(sensor_data, cookies)
    
    
    if __name__ == '__main__':
        url = "https://www.flyasiana.com/5qSZcnDz_/hGWtnW/AkEc/auTFfPPk/9rYphrpkup/dDswFj8m/FVRIJ3V/tGkQ?n$eum=157910959357612400"
    
        headers = {
        
            'authority': 'www.flyasiana.com',
            'user-agent': 'Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.131 Safari/537.36',
            'referer': 'https://www.flyasiana.com/I/CN/CH/RevenueRegistTravel.do',
        }
    
        abck = Abck_Cookie(url=url, headers=headers)
    
        abck.execute_get_abck_cookie()

运行结果======：  
![在这里插入图片描述][watermark_type_d3F5LXplbmhlaQ_shadow_50_text_Q1NETiBAQ29kZW9vbw_size_20_color_FFFFFF_t_70_g_se_x_16]

get_sensor_data.js 文件中
            部分值为固定的直接做了替换；
            值不固定的，则按照首次请求后得到的结果 做替换。
        以下是可能会对 cookie 产生约束的字段
            bmak['mact']   也和时间戳有关系。
            bmak['vcact']  感觉有在控制次数。每次重新请求一下都会新添加 两个数
            bmak['me_cnt']  请求之间的累计间隔时间。 初始化为 1
            bmak['pe_cnt']  请求次数 * 2  ，初始化为 0
            bmak['ta']  当前请求时间与初始化时间的累和  ，初始化为 0
            bmak['me_vel']   也同样是一个累计运算。 再加上当前请求时间与初始化时间的差
            bmak['dme_vel']  感觉像似响应时长。
            bmak['pe_vel']   看js 的加密，应该是 在原来的基础上 加上 请求次数 * 2 ，以及时间。但是直接打印 一直为

[https_blog.csdn.net_weixin_38927522_article_details_123691665]: https://blog.csdn.net/weixin_38927522/article/details/123691665
[watermark_type_d3F5LXplbmhlaQ_shadow_50_text_Q1NETiBAQ29kZW9vbw_size_20_color_FFFFFF_t_70_g_se_x_16]: https://img-blog.csdnimg.cn/ac5e76ea5c5b4ebea0a2c162a9650ae2.png?x-oss-process=image/watermark,type_d3F5LXplbmhlaQ,shadow_50,text_Q1NETiBAQ29kZW9vbw==,size_20,color_FFFFFF,t_70,g_se,x_16