C#
新手谷歌浏览器Network抓包查看POST提交的账号和密码问题
墨衍会员 · AI 创作全网分发 墨衍智能分发 通过墨衍一键同步至各平台 可同步平台 CSDN微信公众号微博知乎掘金百家号博客园抖音小红书 你的文章也可以这样分发 墨衍会员 ¥399起/年，写一次发全网
我也要 关注 + 加入社区
感觉是跳转登录成功。不知道如何分析用逆向一步一步来跟踪跳转。
以上用谷歌浏览器Network抓包我自己的账号和密码(16位的MD5)
响应头提示：status：success，登录成功。如何用 C#WinForm编写。以下是我下载的HTTP协议的代码修改了一下。
我搜索了余额英文单词，不知道这个是不是。
因为我的余额是0 (CNY)
httpFunction.cs代码
httpFunction.cs文件
using System;
using System.Collections.Generic;
using System.Drawing;
using System.IO; //Stream流
using System.Linq;
using System.Net; //HttpWebRequest
using System.Net.Cache;
using System.Net.Security;
using System.Runtime.InteropServices;
using System.Security.Authentication;
using System.Security.Cryptography.X509Certificates;
using System.Text;
namespace JSONTest
{
public static partial class MyFunction
{
[DllImport("wininet.dll ", CharSet = CharSet.Auto, SetLastError = true)]
public static extern bool InternetSetCookie(string lpszUrlName, string lbszCookieName, string lpszCookieData);
}
public static class SslProtocolsExtensions
{
public const SslProtocols Tls12 = (SslProtocols)0x00000C00;
public const SslProtocols Tls11 = (SslProtocols)0x00000300;
}
public static class SecurityProtocolTypeExtensions
{
public const SecurityProtocolType Tls12 = (SecurityProtocolType)SslProtocolsExtensions.Tls12;
public const SecurityProtocolType Tls11 = (SecurityProtocolType)SslProtocolsExtensions.Tls11;
public const SecurityProtocolType SystemDefault = (SecurityProtocolType)0;
}
public class CHTTP : ICloneable //Http访问,继承接口ICloneable
{
public string URLData, RefData, CookieData, PostData, Origin;
public string HtmlText, HeaderText, CookieText, ImgName, LocationUrl;
public int TimeOut, ConnectLimit;
public bool GetCookieMode, AutoRedirect, IsImg, ImgDone, KeepConnect;
public string Content_Type, Accept;
public string IfModifiedSince;
public string UserAgent;
public Encoding GetEncoding;
public bool LoockT; //是否被鎖定
public int WebID;
public WebHeaderCollection Header;
public long PBNum;
public bool Wait; //是否需要等
public bool deflate;
public bool XRequestedWith;
public SecurityProtocolType SecurityProtocol;
public string IP;
public Bitmap Img;
public string URLNew;
public CHTTP()
{
ConnectLimit = 512;
TimeOut = 30000;
KeepConnect = true;
AutoRedirect = true;
GetCookieMode = true;
IsImg = false;
URLData = "";
RefData = "";
Origin = "";
Header = new WebHeaderCollection();
HeaderText = "";
CookieData = "";
PostData = "";
ImgName = "";
LocationUrl = "";
LoockT = true;
XRequestedWith = false;
WebID = 0;
Content_Type = "application/x-www-form-urlencoded; charset=UTF-8";
Accept = "text/html, application/xhtml+xml, */*"; //可以接受哪些类型的文件
IfModifiedSince = "";
Wait = true;
deflate = false;
IP = "";
UserAgent = "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.0.0 Safari/537.36"; //标志使用的浏览器以及版本,也可以用火狐浏览器改成手机页面接口抓包修改为手机页面接口打水
URLNew = "";
GetEncoding = System.Text.Encoding.UTF8; //识别编码格式UTF-8
//if (UserInfor.UserAgent != "") UserAgent = UserInfor.UserAgent;
InitResponseText();
}
public void InitResponseText() //void无返回初始化
{
ImgDone = false;
HtmlText = "";
HeaderText = "";
CookieText = "";
}
public bool CheckValidationResult(object sender, X509Certificate certificate, X509Chain chain, SslPolicyErrors errors) //HTTP底层
{
return true; //直接确认，否则打不开
}
public void HttpGet() //void无返回初始化,HTTP-GET
{
try
{
//Model.WebRequestReturnModel model = new Model.WebRequestReturnModel();
if (URLData.Contains("https")&& ServicePointManager.ServerCertificateValidationCallback==null) //检测是否HTTPS
{
ServicePointManager.ServerCertificateValidationCallback = new System.Net.Security.RemoteCertificateValidationCallback(CheckValidationResult);
ServicePointManager.SecurityProtocol = SecurityProtocolTypeExtensions.Tls12 | SecurityProtocolTypeExtensions.Tls11;
}
Uri uri = new Uri(URLData);
HttpWebRequest request = (HttpWebRequest)WebRequest.Create(uri);
//request.ServicePoint.BindIPEndPointDelegate
request.Method = "GET"; //请求的方法
Set(request, 0);
if (GetCookieMode) //判断获取Cooki模式是否有
{
request.CookieContainer = new CookieContainer(); //创建CookieContainer
if (CookieData != "") //CookieData不等于空
{
string[] tmpCookie = CookieData.Split(';'); //字符串数组
for (int i = 0; i < tmpCookie.Length; i++)
{
tmpCookie[i] = tmpCookie[i].Trim();
if (tmpCookie[i] != "")
{
string[] setCookie = tmpCookie[i].Split(new Char[] { '=' }, 2);
request.CookieContainer.Add(uri, new Cookie(setCookie[0], setCookie[1]));
}
}
}
}
else //否则执行下一条
{
if (CookieData != "")
request.Headers.Add("Cookie", CookieData);
}
//GlobalValues.Record("开始收数据", 0);
HttpWebResponse response = (HttpWebResponse)request.GetResponse(); //响应,强制转换
InitResponseText();
//GlobalValues.Record("接收完数据", 0);
if (IsImg)
{
try
{
Image img;
img = new System.Drawing.Bitmap(response.GetResponseStream());
Img = new Bitmap(img);
if (ImgName.Length > 0)
img.Save(ImgName);
ImgDone = true;
img.Dispose();
}
catch
{
ImgDone = false;
}
}
else
{
Stream resStream = response.GetResponseStream();
Encoding encode = GetEncoding;
//Encoding encode = Encoding.Unicode;
StreamReader readStream = new StreamReader(resStream, encode);
if (AutoRedirect)
{
try
{
URLNew = response.ResponseUri.ToString();
//CookieData = request.CookieContainer.GetCookieHeader(response.ResponseUri);
}
catch { }
}
try
{
LocationUrl = response.ResponseUri.ToString();
}
catch
{
LocationUrl = "";
}
HtmlText = readStream.ReadToEnd();
for (int i = 0; i < response.Headers.Count; i++)
HeaderText += response.Headers.GetKey(i) + ": " + response.Headers[i] + "\r\n";
resStream.Close();
readStream.Close();
resStream.Dispose();
readStream.Dispose();
}
if (GetCookieMode)
{
for (int i = 0; i < response.Cookies.Count; i++)
CookieText += response.Cookies[i].Name + "=" + response.Cookies[i].Value + ";";
}
}
catch (Exception ex)
{
HtmlText = ex.Message;// "Error";
//MessageBox.Show(ex.Message + ex.StackTrace);
}
}
public void HttpPost() //HTTP-POST
{
try
{
Uri uri = new Uri(URLData);
if (URLData.Contains("https"))
{
ServicePointManager.ServerCertificateValidationCallback = new System.Net.Security.RemoteCertificateValidationCallback(CheckValidationResult);
ServicePointManager.SecurityProtocol = SecurityProtocolTypeExtensions.Tls12 | SecurityProtocolTypeExtensions.Tls11;
}
HttpWebRequest request = (HttpWebRequest)WebRequest.Create(uri);
request.Method = "POST"; //请求的方法
//if (WebID == 2)
//{
// request.Accept = "image/gif, image/jpeg, image/pjpeg, image/pjpeg, application/x-shockwave-flash, application/msword, application/vnd.ms-excel, */*";
// if (RefData != "")
// {
// request.Referer = RefData;
// }
// request.ContentType = "application/x-www-form-urlencoded";
// request.Headers.Add("UA-CPU", "x86");
// request.Headers.Add("Accept-Language", "zh-cn");
// request.UserAgent = "Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1; Trident/4.0; .NET CLR 2.0.50727)";
// //request.Headers.Add("Expires", "0");
// request.AllowAutoRedirect = AutoRedirect;
// if (XRequestedWith) request.Headers.Add("x-requested-with", "XMLHttpRequest");
// request.AutomaticDecompression = DecompressionMethods.GZip;
// request.AllowWriteStreamBuffering = false;
// request.Timeout = TimeOut;
// request.CachePolicy = new RequestCachePolicy(RequestCacheLevel.NoCacheNoStore);
// request.KeepAlive = KeepConnect;
//}
//else
Set(request, 1);
byte[] byteArray = GetEncoding.GetBytes(PostData);
request.ContentLength = byteArray.Length;
if (GetCookieMode)
{
request.CookieContainer = new CookieContainer();
if (CookieData != "")
{
//request.CookieContainer.SetCookies(uri, CookieData);
string[] tmpCookie = CookieData.Split(';');
for (int i = 0; i < tmpCookie.Length; i++)
{
tmpCookie[i] = tmpCookie[i].Trim();
if (tmpCookie[i] != "")
{
string[] setCookie = tmpCookie[i].Split(new Char[] { '=' }, 2);
request.CookieContainer.Add(uri, new Cookie(setCookie[0], setCookie[1]));
}
}
}
}
else
{
if (CookieData != "")
request.Headers.Add("Cookie", CookieData); //头部信息添加语言 request.Headers.Add("Accept-Language", "zh-CN,zh;q=0.9");
}
Stream PostStream = request.GetRequestStream();
PostStream.Write(byteArray, 0, byteArray.Length);
PostStream.Close(); //关闭流
PostStream.Dispose(); //释放流
//GlobalValues.Record("开始收数据", 0);
HttpWebResponse response = (HttpWebResponse)request.GetResponse(); //响应,强制转换
InitResponseText();
//GlobalValues.Record("接收完数据", 0);
//HttpWebResponse response = (HttpWebResponse)request.GetResponse();
//InitResponseText();
if (IsImg)
{
try
{
Image img;
img = new System.Drawing.Bitmap(response.GetResponseStream());
Img = new Bitmap(img);
if (ImgName.Length > 0)
img.Save(ImgName);
ImgDone = true;
img.Dispose();
}
catch
{
ImgDone = false;
}
}
else
{
Stream resStream = response.GetResponseStream();
Encoding encode = GetEncoding;
StreamReader readStream = new StreamReader(resStream, encode);
if (AutoRedirect)
{
try
{
URLNew = response.ResponseUri.ToString();
//CookieData = request.CookieContainer.GetCookieHeader(response.ResponseUri);
}
catch { }
}
for (int i = 0; i < response.Headers.Count; i++) //头部信息添加语言
HeaderText += response.Headers.GetKey(i) + ": " + response.Headers[i] + "\r\n"; //头部信息添加语言
if (GetCookieMode)
{
for (int i = 0; i < response.Cookies.Count; i++)
CookieText += response.Cookies[i].Name + "=" + response.Cookies[i].Value + ";";
}
HtmlText = readStream.ReadToEnd();
resStream.Close(); //关闭流
readStream.Close(); //关闭流
resStream.Dispose(); //释放流
readStream.Dispose(); //释放流
}
}
catch (Exception ex)
{
HtmlText = ex.Message;// "Error";
//MessageBox.Show(ex.Message + ex.StackTrace);
}
}
public void Set(HttpWebRequest request, int Type) //void无返回初始化,Set
{
if (Type == 1)
{
if (Content_Type != "") request.ContentType = Content_Type; //识别编码格式UTF-8
else request.ContentType = "application/x-www-form-urlencoded"; //识别编码格式UTF-8
}
request.UserAgent = UserAgent;
request.Accept = Accept; //"application/json, text/javascript, */*; q=0.01"; //可以接受哪些类型的文件
request.AllowAutoRedirect = AutoRedirect;
if (Header != null && Header.Count > 0) foreach (string key in Header.AllKeys)
{
request.Headers.Add(key, Header[key]); //头部信息添加语言
}
request.Headers.Add("Accept-Language", "zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2"); //头部信息添加语言
if (XRequestedWith) request.Headers.Add("X-Requested-With", "XMLHttpRequest"); //头部信息添加语言
if (RefData != "") request.Referer = RefData;
if (Origin != "") request.Headers.Add("Origin", Origin); ;//头部信息添加语言
request.AutomaticDecompression = DecompressionMethods.GZip; //压缩方式?
if (deflate) request.Headers.Add("Accept-Encoding", "gzip, deflate, br"); //头部信息添加语言
request.AllowWriteStreamBuffering = false;
request.Timeout = TimeOut; //默认访问30秒是否响应
request.CachePolicy = new RequestCachePolicy(RequestCacheLevel.NoCacheNoStore);
request.KeepAlive = KeepConnect;
}
public object Clone()
{
CHTTP tmpObj = new CHTTP();
tmpObj.URLData = this.URLData;
tmpObj.RefData = this.RefData;
tmpObj.Origin = this.Origin;
tmpObj.CookieData = this.CookieData;
tmpObj.PostData = this.PostData;
tmpObj.HtmlText = this.HtmlText;
tmpObj.HeaderText = this.HeaderText;
tmpObj.CookieText = this.CookieText;
tmpObj.ImgName = this.ImgName;
tmpObj.TimeOut = this.TimeOut;
tmpObj.ConnectLimit = this.ConnectLimit;
tmpObj.GetCookieMode = this.GetCookieMode;
tmpObj.AutoRedirect = this.AutoRedirect;
tmpObj.IsImg = this.IsImg;
tmpObj.ImgDone = this.ImgDone;
tmpObj.KeepConnect = this.KeepConnect;
tmpObj.GetEncoding = this.GetEncoding;
tmpObj.deflate = this.deflate;
tmpObj.XRequestedWith = this.XRequestedWith;
return tmpObj;
}
}
}
Form2.cs代码
using System;
using System.Collections.Generic;
using System.ComponentModel;
using System.Data;
using System.Drawing;
using System.IO.Compression;
using System.IO;
using System.Linq;
using System.Text;
using System.Threading.Tasks;
using System.Windows.Forms;
using static System.Net.WebRequestMethods;
using System.Text.RegularExpressions;
namespace JSONTest
{
public partial class Form2 : Form
{
string Cookie = ""; //全局变量字符串的Cookie空值
string NewUrl = ""; //全局变量字符串的URL空值
public Form2()
{
InitializeComponent();
}
private void button2_Click(object sender, EventArgs e) //登录按钮
{
string url = "https://www.XXX.com/WebHandler/AuthService.ashx"; //
string user = "qq3632500352"; //网站账号
string password = "B47720D93A4127FB"; //网站密码(16位MD5加密,网上有MD5加密解密代码,需把账号密码textBox1,2明文加密后才POST提交)
string postdata = $"login_form%5Buser-name%5D={user}&login_form%5Bpassword%5D={password}&fingerPrint=130066628&method=login&system_data%5Bcurrent_url%5D=https%3A%2F%2Fwww.XXX.com%2FDefault.aspx"; //自定义函数CHTTP,user和password是变量里的值
CHTTP MyHttp = HttpPost(url, postdata); //HttpPost公共方法把URL网址+账号密码拼接后交给postdata
if (MyHttp.HtmlText.Contains("success")) //在浏览器里抓包显示登录响应状态"success"则判断为登录成功
{
Cookie = MyHttp.CookieText; //全局变量字符串的Cookie
textBox1.Text = "登录成功!";
}
}
private void button3_Click(object sender, EventArgs e) //跳转按钮
{
string url = "https://www.XXX.com/games/PSport.aspx";
CHTTP MyHttp = HttpGet(url); //HttpPost公共方法
if (MyHttp.HtmlText.Contains("token")) //在浏览器里抓包显示响应状态"token"判断
{
string token = MidStrEx(MyHttp.HtmlText, "LIVE&token=", "\""); //MidStrEx公共方法
NewUrl = $"https://phoile.XXX.com/member-service/v1/login-token?locale=zh-cn&sport=soccer&oddsFormat=HK&token={token}&detectedUrl=https://phoile.XXX.com"; //全局变量字符串的URL
Cookie += MyHttp.CookieText; //全局变量字符串的Cookie
textBox1.Text= "跳转成功!";
}
}
#region 公共方法
public static string MidStrEx(string sourse, string startstr, string endstr) //URL里的Cookie进行拼接
{
string result2 = string.Empty;
int startindex, endindex;
try
{
string tmpstr = sourse; //sourse参数直接赋值给字符串tmpstr
if (startstr != "")
{
startindex = sourse.IndexOf(startstr); //sourse参数的索引给startstr参数,最后赋值给整型startindex
if (startindex == -1) //等于-1?
return result2; //返回给字符串result2
tmpstr = sourse.Substring(startindex + startstr.Length);
}
if (endstr != "")
{
endindex = tmpstr.IndexOf(endstr);
if (endindex == -1)
return result2;
if (endindex > 0)
result2 = tmpstr.Remove(endindex);
}
else
result2 = tmpstr;
}
catch (Exception ex)
{
}
return result2;
}
public CHTTP HttpGet(string html, int TimeOut = 30000) //CHTTP类的HttpGet方法
{
CHTTP MyHttp = new CHTTP();
MyHttp.UserAgent = "Mozilla/5.0 (iPhone; CPU iPhone OS 14_6 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/14.0.3 Mobile/15E148 Safari/604.1";
MyHttp.URLData = html;
MyHttp.TimeOut = TimeOut;
MyHttp.CookieData = Cookie;
MyHttp.AutoRedirect = false;
MyHttp.Accept = "text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8";
MyHttp.HttpGet();
return MyHttp;
}
public CHTTP HttpPost(string html, string Postdata, int TimeOut = 3000) //CHTTP类的HttpPost方法
{
CHTTP MyHttp = new CHTTP();
MyHttp.UserAgent = "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:89.0) Gecko/20100101 Firefox/89.0";
MyHttp.URLData = html; //参数
MyHttp.TimeOut = TimeOut; //参数
MyHttp.PostData = Postdata; //登录按钮账号密码和拼接数据
MyHttp.CookieData = Cookie; //全局变量字符串的Cookie
MyHttp.XRequestedWith = true; //CHTTP波尔类型
MyHttp.AutoRedirect=false;
MyHttp.RefData = "https://www.XXX.com/";
MyHttp.Content_Type = "application/x-www-form-urlencoded; charset=UTF-8";
MyHttp.Accept = "application/json, text/javascript, */*; q=0.01";
MyHttp.Origin = "https://www.XXX.com";
MyHttp.HttpPost();
return MyHttp;
}
#endregion
private void button4_Click(object sender, EventArgs e) //获取Cookies按钮
{
string url = NewUrl; //全局变量字符串的URL空值
//Cookie = "";
CHTTP MyHttp = HttpGet(url);
if (MyHttp.CookieText.Contains("JSESSIONID"))
{
Cookie = MyHttp.CookieText; //全局变量字符串的Cookie空值
textBox1.Text = "获取Cookie成功!";
}
}
private void button1_Click(object sender, EventArgs e) //获取我的余额，按钮
{ //抓包这个不知道对不对https://phoile.XXX.com/member-service/v2/account-balance?locale=zh_CN&_=1792544276151&withCredentials=true
string url = "https://phoile.XXX.com/member-service/v1/account-balance?locale=zh_CN";
string postdata = $"json"; //显示余额？
CHTTP MyHttp = HttpPost(url, postdata);
if (MyHttp.HtmlText.Contains("success"))
{
Cookie = MyHttp.CookieText;
textBox1.Text = "获取Cookie成功!";
}
}
我想将这几个步骤都改成一个按钮，不用分4步按钮跳转。
我在哔哩哔哩看了谷歌浏览器Network抓包视频教程，查看POST提交的账号和密码，于是自己找了某个网站测试后发现会跳转，抓包后如何分析报文里的数据登录账号和密码是如何跳转登录的？需要跳转后才能显示我的余额，在网上下载了分WinFormC#HTTP协议桌面应用程序提交POST账号密码+拼接的cookies值源码(抢票软件源码，仅供研究以及用于参考！)，然后如何用Get+cookies一直保持在线不掉线。感觉开发浏览器好难！新手还不太懂。望大神指教，可以加QQ123292295一起研究这个项目，集思广益！
...全文
相关推荐
02调戏骗子盗号网站（post请求）
网站没了3.19（笑） 现在可以访问这个 和原来的网站同样的机制，大家可以练练手。 贴网站 明显的骗子网站 分析网站盗号机制 点进去之前一堆警告,无视它们 记得所有过程中，别输入我们的qq和密码就行 做的还挺像,其实这时观察到域名不含qq.com,基本确定为盗号网站,但是假设我们不知道 此时在浏览器(谷歌或360)界面按F12调出调试器，选到network界面,捕捉信息流。 在登录页面（骗子网站）输入假的qq和密码，点击登录 qq：04380438 pw:nmsldsb 这是network界面出现一堆东西，我们点第一个 大概就是这个post请求将我们输入的qq和密码发送到对方的服
学习通自动化脚本技术解析：从浏览器模拟到网络请求的完整实现
网络爬虫与自动化测试是当前Web开发与数据采集领域的核心技术，其原理在于通过程序模拟用户行为，实现对网页的自动访问与交互。从技术实现角度看，主要分为浏览器自动化（如Selenium）和直接网络请求模拟两种路径，前者适合处理复杂交互，后者则效率更高。这些技术的价值在于能够将人力从重复性操作中解放出来，广泛应用于数据采集、自动化测试、监控报警等场景。本文以学习通平台为例，深入探讨了模拟登录、任务导航、进度上报等关键环节的实现细节，并重点分析了反检测策略与本地题库匹配等实操难点，为理解自动化脚本开发提供了完整的技
BurpSuite核心功能详解：从代理抓包到自动化漏洞挖掘
Web安全测试是保障应用程序安全的关键环节，其核心在于理解HTTP/HTTPS协议交互过程。通过中间人代理技术，安全人员能够拦截、分析和修改客户端与服务器之间的网络请求，从而识别潜在漏洞。BurpSuite作为一款集成化测试平台，将这一原理工程化，提供了从手动测试到自动化扫描的完整工具链。其代理模块实现了流量捕获与实时修改，重放器支持对单次请求进行精细化调试，而入侵者模块则能通过多种攻击模式（如狙击手、草叉模式）进行批量模糊测试与暴力破解。这些功能协同工作，极大提升了在渗透测试、漏洞挖掘（如SQL注入、XS
VoidProxy钓鱼攻击：如何绕过MFA实现实时会话劫持
中间人攻击是一种经典的网络安全威胁，攻击者通过拦截并可能篡改通信双方的流量来窃取信息或实施欺诈。其核心原理在于攻击者能够秘密地插入到客户端与服务器之间的通信链路中，扮演一个透明的“中继”角色。这种技术的危害在于它能够绕过传统的基于密码和一次性验证码的认证机制，直接窃取更高价值的会话令牌。在Web安全领域，会话劫持就是利用窃取的会话凭证来非法获取用户访问权限的攻击方式。随着在线服务对多因素认证的依赖日益加深，攻击手段也在不断进化。VoidProxy这类高级钓鱼平台正是通过将反向代理技术与恶意脚本注入相结合，构
AI验证码识别实战：Capsolver集成指南与自动化流程优化
验证码作为区分人机交互的核心安全机制，其技术原理从简单的图像识别发展到基于深度学习的复杂行为分析。在自动化测试、数据采集和RPA流程中，验证码成为阻碍效率的关键瓶颈。通过集成专业的第三方AI验证码识别服务，开发者可以将这一技术难题外包，专注于业务逻辑的实现。Capsolver作为领先的验证码解决平台，支持reCAPTCHA、hCaptcha等多种类型，提供高识别率的云端API。在实际应用中，结合Selenium、Playwright等自动化工具，能够有效处理UI自动化、接口请求等场景，显著提升流程的稳定性和
