-
-
未解决 [求助][求助]逆向某个网站签名算法时，已经构造了一模一样的签名，但是一直验证不通过，有没有大佬帮看一下
-
发表于: 2023-7-9 22:18
-
最近在学习JS逆向。。
逆向了几个网站一直觉得自己技术水平有所提高了。。
直到我遇到下面网站
多次调试后，十分确认通过python模拟的签名算法与在chrom调试跟踪生成的签名一模一样
但一直提示'HMAC signature does not match'
和宿舍兄弟试了好几天都找不到哪里出问题了。
身边也没有大神一块交流
只能在这里求助。
网站地址
进去点击交易记录会有请求
下面是我用python模拟调用的代码，（学的是java专业。。自学的python,写的有点水，请忽略..）
有没有大佬帮看一下问题出在哪？
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 | import requestsimport timeimport datetime, dateutil.parserfrom hashlib import sha256import base64import hmac#构建hmacSha256 算法def get_sign(data, key): key = key.encode('utf-8') message = data.encode('utf-8') sign = base64.b64encode(hmac.new(key, message, digestmod=sha256).digest()) sign = str(sign, 'utf-8') print(sign) return sign#获取gmt时间def get_gmt(): gmt = datetime.datetime.utcnow().strftime('%a, %d %b %Y %H:%M:%S GMT') print(gmt) return gmt#1.获取gmtgmt=get_gmt();secret = '4wbG2s7TwwMC';def build_sign(address,gmt): #iaa1a68szs54zj2ngzntwm0k5c5rc6wyhhacx8m0je stringToSign = "x-date: " + str(gmt) + "\n" + "GET /nodejs/txs/addresses?address="+address+"&useCount=false&countMsg=false&limit=50 HTTP/2.0"; return stringToSignaddress='iaa138d9f3dwtjqx39a02cn660hmxarjxstgk2adh9'stringToSign=build_sign(address,gmt)#获取签名sign=get_sign(stringToSign, secret)token = "hmac username=\"hmac-shenzhou\", algorithm=\"hmac-sha256\", headers=\"x-date request-line\", signature=\"" + sign + "\"";print('构建',token)print('官方','hmac username="hmac-shenzhou", algorithm="hmac-sha256", headers="x-date request-line", signature="UWB0q5aDpCiP8EBAcdeOJ4FQN+W8nPD+Ey62mUAaS/k="')Header = { "Accept": "application/json, text/plain, */*", "xsrfCookieName": "XSRF-TOKEN", "xsrfHeaderName": "X-XSRF-TOKEN", "Authorization": token, "X-Date":gmt, "User-Agent" : 'Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.0.0 Safari/537.36'}print(Header)# 伪装一下url = "2e2K9s2c8@1M7s2y4Q4x3@1q4Q4x3V1k6Q4x3V1k6T1j5h3y4C8k6h3&6V1i4K6u0W2M7$3S2W2L8Y4A6Z5L8%4g2Q4x3X3g2%4k6h3&6U0K9r3q4F1k6#2)9J5k6h3u0A6j5h3&6B7K9h3g2Q4x3X3g2S2K9g2)9J5c8X3&6G2k6r3g2B7M7#2)9J5c8Y4c8^5M7#2)9J5c8X3q4V1k6s2u0W2M7%4y4W2M7#2)9K6c8X3q4V1k6s2u0W2M7%4y4Q4x3@1c8A6j5h3p5I4j5e0j5^5M7%4A6K6y4e0c8*7K9U0u0F1k6%4A6F1N6s2N6E0x3r3D9#2j5K6g2J5j5K6k6%4P5h3S2Z5j5h3y4^5z5r3@1H3K9X3g2Q4x3U0k6S2L8i4m8Q4x3@1u0#2M7$3g2o6L8%4g2F1N6q4)9K6c8r3k6S2L8s2y4W2i4K6t1$3j5h3#2H3i4K6y4n7j5$3!0#2L8Y4c8y4M7$3N6Q4x3@1c8X3j5h3I4K6k6g2)9J5y4X3q4E0M7q4)9K6b7X3I4A6L8h3W2@1i4K6y4p5y4e0l9`."requests.packages.urllib3.disable_warnings()response=requests.get(url, headers=Header,verify=False)print(response.text) |
[培训]内核驱动高级班，冲击BAT一流互联网大厂工作，每周日13:00-18:00直播授课
