{"action":"created","issue":{"url":"https://api.github.com/repos/Wscats/Good-text-Share/issues/62","repository_url":"https://api.github.com/repos/Wscats/Good-text-Share","labels_url":"https://api.github.com/repos/Wscats/Good-text-Share/issues/62/labels{/name}","comments_url":"https://api.github.com/repos/Wscats/Good-text-Share/issues/62/comments","events_url":"https://api.github.com/repos/Wscats/Good-text-Share/issues/62/events","html_url":"https://github.com/Wscats/Good-text-Share/issues/62","id":197439930,"number":62,"title":"我如何用前端技术得到XXOO网站的VIP","user":{"login":"Wscats","id":17243165,"avatar_url":"https://avatars.githubusercontent.com/u/17243165?v=3","gravatar_id":"","url":"https://api.github.com/users/Wscats","html_url":"https://github.com/Wscats","followers_url":"https://api.github.com/users/Wscats/followers","following_url":"https://api.github.com/users/Wscats/following{/other_user}","gists_url":"https://api.github.com/users/Wscats/gists{/gist_id}","starred_url":"https://api.github.com/users/Wscats/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/Wscats/subscriptions","organizations_url":"https://api.github.com/users/Wscats/orgs","repos_url":"https://api.github.com/users/Wscats/repos","events_url":"https://api.github.com/users/Wscats/events{/privacy}","received_events_url":"https://api.github.com/users/Wscats/received_events","type":"User","site_admin":false},"labels":[{"id":358552104,"url":"https://api.github.com/repos/Wscats/Good-text-Share/labels/notes","name":"notes","color":"d4c5f9","default":false}],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":26,"created_at":"2016-12-24T00:29:12Z","updated_at":"2016-12-26T07:20:37Z","closed_at":null,"body":"[查看作者原文](https://github.com/Wscats/Good-text-Share/issues/62)\r\n\r\n[讲解素材](http://vip.cnoubo.cn:8080/wapyy668/index.html)\r\n网页如图，这里只是说明整个网站的一些技术点，所以不该看的地方我都打上马赛克了，让我们揭开这些网站的整个前端工作原理\r\n![image](https://cloud.githubusercontent.com/assets/17243165/20460429/ea2be212-af1c-11e6-9f56-3fcdc4053827.png)\r\n首先刚进去的时候显示一堆乱七八糟的东西，点进去其中一个页面，下面各种虚假评论，然后每隔几秒钟弹出第几几几个会员充值成功，我们先把这个删掉\r\n![image](https://cloud.githubusercontent.com/assets/17243165/20459940/7d991dd0-af0e-11e6-9a5b-1d5e2f422062.png)\r\n好了，我们继续研究这个网站内部结构了\r\n正常情况每个页面的视频都是试看几十秒就会提醒你充值，当然这是这类网站的常规套路，我们在浏览器的Network观察加载的js，我们可以看到里面这段代码\r\n![image](https://cloud.githubusercontent.com/assets/17243165/20459954/0b62be8c-af0f-11e6-936a-850a8d936bc2.png)\r\n这是一份叫做lsj.mp4.js的代码的其中一部分，我们可以看到里面有个关键的判断，具体就是判断你是否是会员，如果是那就根据类型是否是2返回**play_url_arr_oumei**数组和**play_url_arr**数组拼接一个url给你，如果你不是会员的话就进入试看的判断，很清晰的看到有一个url，那就是试看的短视频的路径\r\n```\r\nvar isvip = getCookie('lsjyy');\r\nif(isvip != undefined && isvip != ''  && isvip.match(rgExp)){}else{}\r\n```\r\n上面这两句还告诉我们第二个关键点就是我们可以根据**isvip**的cookie值来伪造身份，这个cookie就是保存到我们的本地浏览器上，所以如果我们能成功改写它的话我们就能变成会员绕过这个判断，这份代码已经封装好**getCookie**，所以我们可以在控制台直接调用来改写cookie值，但是问题来了，我们应该改成什么值才能绕过判断呢，我们继续看源代码搜索答案\r\n\r\n```\r\nfunction getMp4Url() {\r\n        var play_name = getParam('play_name');\r\n        var type = getParam('type');\r\n        var rgExp =/^(v|V)[i|I|p|P|0-9]{2,3}$/g;\r\n        var isvip = getCookie('lsjyy');\r\n        var pic = $('.movie-pic img').attr('src');\r\n        var html = '<img src=\"'+pic+'\" style=\"height:auto; width:100%;display: none;\">';\r\n        html = '';\r\n        var play_url = '';\r\n        //vip会员\r\n        if(isvip != undefined && isvip != ''  && isvip.match(rgExp))\r\n        {\r\n            var play_mp4 = getCookie('play_mp4');\r\n            if(type == 2)\r\n            {\r\n                play_url = play_url_arr_oumei[play_rand2];\r\n\r\n            }else{\r\n                play_url = play_url_arr[play_rand];\r\n\r\n            }\r\n        }\r\n        //试看\r\n        else if(( play_name != '')&&(play_name != 'undefined'))\r\n        {\r\n            \r\n            play_pic = 'http://oewx8de7n.qnssl.com/9e0120cv23/images/'+play_name+'.jpg';\r\n            play_url = 'http://oewx8de7n.qnssl.com/9e0120cv23/images/mp4/'+play_name+'.mp4';\r\n        }\r\n        else\r\n            play_url =  \"http://su.cywl5.com/sy/h34.mp4\";\r\n        return play_url;\r\n}\r\n```\r\n在lsj.pay.js?v=256这份代码的279行中我们又找到了一个线索，我们从代码看到，如果支付成功会在本地浏览器设置用户的cookie值，有两个关键的值出现了，分别是**lsj**和**lsjyy**\r\n_lsj_\r\n```\r\nsetCookie('lsj', pay_tee, 'd730');\r\n```\r\n_lsjyy_\r\n```\r\nsetCookie('lsjyy', 'vip', 'd730');\r\n```\r\n其实我想了很久这个名字跟vip有什么关联，估计这个网站的作者想写的是老司机和老司机YY的意思吧，不过不管它是什么意思，现在只要我们尝试用它封装好的**setCookie**方法自己改写这两个cookie值，就能在本地顺利成为会员，绕过刚才的判断条件了\r\n**lsj.pay.js**\r\n```\r\nfunction checkOrderStatus() {\r\n    $.post(\"./pay/ok.php?action=check&uid=\"+getCookie('user'), function(data) {\r\n        var pay_tee = Number(data);\r\n        if (pay_tee >= 1) \r\n        {\r\n            ispay = 1;\r\n            ispay = true;\r\n            var lsj = getCookie('lsj');\r\n            if(lsj == null) lsj = 0; \r\n            if(pay_tee > lsj)\r\n            {    \r\n                setCookie('lsj', pay_tee, 'd730');\r\n            }\r\n        }   \r\n        if ((pay_tee > 0)&&(pay_tee <= s_v1_money)) \r\n        {\r\n            setCookie('lsjyy', 'vip', 'd730');\r\n        }\r\n        else if ((pay_tee > s_v1_money)&&(pay_tee <= s_v2_money)) \r\n        {\r\n            setCookie('lsjyy', 'vip2', 'd730');         \r\n        }\r\n        if (pay_tee >= 1) \r\n        {\r\n            var dt1 =Math.round(new Date().getTime()/1000);\r\n            setCookie('lsjtime', dt1, 'd730');\r\n            setCookie(\"isPayClick\",0, 'd1');\r\n            var isPayClick = getCookie(\"isPayClick\");\r\n            if (isPayClick == 0)\r\n                window.location.reload(); \r\n        }\r\n       // el_checkpay.hide();\r\n    })\r\n} \r\n```\r\n其实往下也可以看到有一个clearVIP函数，更肯定了刚才我们的结论，VIP和非VIP其实就是这两个值在作怪，所以我们默认的值应该就是clearVIP函数设置的值\r\n```\r\nfunction clearVIP()\r\n{\r\n    setCookie(\"lsjyy\",0, 's1');\r\n    setCookie(\"lsj\",0, 's1');\r\n}\r\n```\r\n如下图，我们在浏览器执行这两个函数，执行成功后我们就能看到cookie被成功改写\r\n![image](https://cloud.githubusercontent.com/assets/17243165/20460091/3c9ce578-af13-11e6-8818-1081c36ac443.png)\r\n![image](https://cloud.githubusercontent.com/assets/17243165/20460095/581ce442-af13-11e6-8427-1073ff1e4687.png)\r\n在这里我设置lsjyy为vip2，当然我在后面测试的时候发现这两个值貌似没什么区别\r\n![image](https://cloud.githubusercontent.com/assets/17243165/20460108/c02a4110-af13-11e6-9ed2-95332a7e93c9.png)\r\n\r\n然后我们可以用lsj.pay.js第179行的**showpay**函数来检测是否已经是成功变成VIP\r\n```\r\nfunction showpay() {\r\n    var rgExp =/^(v|V)[i|I|p|P|0-9]{2,3}$/g;\r\n    var isvip = getCookie('lsjyy');\r\n    if(isvip != undefined && isvip != ''  && isvip.match(rgExp))\r\n    {\r\n        alert('您已经是vip了哦.');\r\n        return false;\r\n    }\r\n   //省略后面的代码\r\n}\r\n```\r\n如果成功完成上面的步骤，我们在控制台输入showpay()就会看到下图这个弹窗，那证明我们已经成功升级为VIP...\r\n![image](https://cloud.githubusercontent.com/assets/17243165/20460121/9d2a14b4-af14-11e6-8a2b-0f9a3327e281.png)\r\n我们再次进入其中一个带有视频的网页看看变成VIP会会真的有VIP的\"待遇\"，我们发现页面内容块变成了空白，控制台报了下面这个错，那是提示有一个值叫**play_rand**没有定义，其实来到这里我们已经发现我们已经绕过了刚才会员判断，进入我们是会员的判断分支，只是因为一个未定义的值停止了代码的运行\r\n![image](https://cloud.githubusercontent.com/assets/17243165/20460128/01d86834-af15-11e6-8f52-7c8120b664e2.png)\r\n![image](https://cloud.githubusercontent.com/assets/17243165/20460307/c9f98786-af19-11e6-89a4-707135f8dd47.png)\r\n由于这个值我们可以看到是一个数组的索引值，所以我们在控制台全局定义\r\n```\r\nvar play_rand = 1\r\n```\r\n![image](https://cloud.githubusercontent.com/assets/17243165/20460320/0f88d0e0-af1a-11e6-82fe-b623f78c6bf1.png)\r\n我们把id为play-html节点的元素样式设置diplay为显示，我们就可以看到正常的播放器出来了\r\n![image](https://cloud.githubusercontent.com/assets/17243165/20460330/5190e19e-af1a-11e6-92bf-f44f560df1ab.png)\r\n分析源码得知，它大概的工作原理就是根据url的参数，比如**play_name**和**play_type**，根据你是否VIP然后加载播放器播放拼接完的URL，play_name还含有**undefined**很不科学，说明有些视频根本只有图没有源\r\n打开play.html查看里面的源代码，可以看到视频的链接源\r\n**play.html**第21行\r\n```\r\n<script type=\"text/javascript\">\r\n    var cdn_url = 'http://oewx8de7n.qnssl.com/9e0120cv23';\r\n</script>\r\n```\r\n往下面看我们可以看到刚才**play_rand**选取的对应的那个视频，事实上**play_url_arr_oumei**和**play_url_arr**数组已经定义好了VIP可以观看的这十几个视频，所以不管怎么样付钱后都是看这十几个里面的其中一个，在这里其实已经可以自己拼接对应的链接进入相应的视频\r\n**play.html**第324行\r\n```\r\nvar play_url_arr_oumei=new Array();\r\n    play_url_arr_oumei[1]=cdn_url+\"/vip/2/om_1.mp4\";\r\n    play_url_arr_oumei[2]=cdn_url+\"/vip/2/om_2.mp4\";\r\n    play_url_arr_oumei[3]=cdn_url+\"/vip/2/om_3.mp4\";\r\n    play_url_arr_oumei[4]=cdn_url+\"/vip/2/om_4.mp4\";\r\n    play_url_arr_oumei[5]=cdn_url+\"/vip/2/om_5.mp4\";\r\n    play_url_arr_oumei[6]=cdn_url+\"/vip/2/om_6.mp4\";\r\n    play_url_arr_oumei[7]=cdn_url+\"/vip/try7.mp4\";\r\n    play_url_arr_oumei[8]=cdn_url+\"/vip/try8.mp4\";\r\n    play_url_arr_oumei[9]=cdn_url+\"/vip/try9.mp4\";\r\n    play_url_arr_oumei[10]=cdn_url+\"/vip/try10.mp5\";\r\n    var play_url_arr=new Array();\r\n    play_url_arr[1]=cdn_url+\"/vip/try1.mp4\";\r\n    play_url_arr[2]=cdn_url+\"/vip/try2.mp4\";\r\n    play_url_arr[3]=cdn_url+\"/vip/try3.mp4\";\r\n    play_url_arr[4]=cdn_url+\"/vip/try4.mp4\";\r\n    play_url_arr[5]=cdn_url+\"/vip/try5.mp4\";\r\n    play_url_arr[6]=cdn_url+\"/vip/try6.mp4\";\r\n    play_url_arr[7]=cdn_url+\"/vip/try7.mp4\";\r\n    play_url_arr[8]=cdn_url+\"/vip/try8.mp4\";\r\n    play_url_arr[9]=cdn_url+\"/vip/try9.mp4\";\r\n    play_url_arr[10]=cdn_url+\"/vip/try10.mp4\";\r\n\r\n```\r\n当然我们为了证明我们刚才上面的推测，我们可以在控制台把**lsj.mp4.js**的**getMp4Url函数**执行一次\r\n\r\n![image](https://cloud.githubusercontent.com/assets/17243165/20460416/8992c290-af1c-11e6-9010-fc1f1aab91c4.png)\r\n\r\n我们可以看到一个可用的链接就这样出现了\r\n当然你可以再执行如下代码，让它在网页端执行，关键就是用**playHtml3函数**加载播放器，并打开拼接好的视频链接，有时候加载的是一张图片，更有时候加载的视频链接也根本无法播放，其实不管是否会员，最后也只是播放在页面最后定义好的那十几个视频，支付变成会员只是它们把数据入库，然后帮你设置个cookie的过程而已\r\n当然这些网站的前端人员的代码和注释还是挺可笑的\r\n![image](https://cloud.githubusercontent.com/assets/17243165/20460494/57cf8358-af1f-11e6-884d-0628540a5bd9.png)\r\n\r\n![image](https://cloud.githubusercontent.com/assets/17243165/20460460/096b0972-af1e-11e6-92e8-784fe079c772.png)\r\n至此，就可以看懂这种网站的工作原理了，所以遇到小心上当了\r\n\r\n\r\n----------------------update 2016.12.26--------------------------\r\n_技术本身不可耻，可耻的是滥用技术的人！_\r\n后续更多内容可关注作者本人[@Wscats](https://github.com/Wscats)或者star本文"},"comment":{"url":"https://api.github.com/repos/Wscats/Good-text-Share/issues/comments/269175575","html_url":"https://github.com/Wscats/Good-text-Share/issues/62#issuecomment-269175575","issue_url":"https://api.github.com/repos/Wscats/Good-text-Share/issues/62","id":269175575,"user":{"login":"hellojiangjialin","id":22066916,"avatar_url":"https://avatars.githubusercontent.com/u/22066916?v=3","gravatar_id":"","url":"https://api.github.com/users/hellojiangjialin","html_url":"https://github.com/hellojiangjialin","followers_url":"https://api.github.com/users/hellojiangjialin/followers","following_url":"https://api.github.com/users/hellojiangjialin/following{/other_user}","gists_url":"https://api.github.com/users/hellojiangjialin/gists{/gist_id}","starred_url":"https://api.github.com/users/hellojiangjialin/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/hellojiangjialin/subscriptions","organizations_url":"https://api.github.com/users/hellojiangjialin/orgs","repos_url":"https://api.github.com/users/hellojiangjialin/repos","events_url":"https://api.github.com/users/hellojiangjialin/events{/privacy}","received_events_url":"https://api.github.com/users/hellojiangjialin/received_events","type":"User","site_admin":false},"created_at":"2016-12-26T07:20:37Z","updated_at":"2016-12-26T07:20:37Z","body":"吓得我赶紧收藏了，毕竟这种好技术要多看，多学"}}
{"actor":{"display_login":"hellojiangjialin"}}