boss直聘 __zp_stoken__ 分析

声明:
本文章中所有内容仅供学习交流使用，不用于其他任何目的，抓包内容、敏感网址、数据接口等均已做脱敏处理，严禁用于商业用途和非法用途，否则由此产生的一切后果均与作者无关！

逆向过程

py代码

import execjs
import json
import time
from urllib.parse import quote
import execjs

import requests


session=requests.Session()
with open('./1.js','r',encoding='utf8',errors='ignore') as fp:
    headers = {}
    cookies = {

    }
    url = "/getUserInfo.json"
    session.get(url, headers=headers, cookies=cookies)
    url = "api/json"
    session.options(url, headers=headers)
    params = {
        "scene": "1",
        "query": "td",
        "city": "101410100",
        "experience": "",
        "payType": "",
        "partTime": "",
        "degree": "",
        "industry": "",
        "scale": "",
        "stage": "",
        "position": "",
        "jobType": "",
        "salary": "",
        "multiBusinessDistrict": "",
        "multiSubway": "",
        "page": "16",
        "pageSize": "30"
    }
    response = session.get('/joblist.json', params=params, cookies=cookies,
                            headers=headers)
    print(response.text)
    data = json.loads(response.text)['zpData']
    seed = data['seed']
    ts = int(data['ts'])
    name = data['name']
    cookies['__zp_sseed__'] = seed
    cookies['__zp_sts__'] = str(ts)
    cookies['__zp_sname__'] = name
    code=fp.read()
    cp = execjs.compile(code)
    zpstoken= cp.call('getEncrypt',seed,str(ts))
    print(zpstoken)
    # print(len(zp_stoken))
    cookies['__zp_stoken__'] = quote(zpstoken)

    response = session.get('/joblist.json', params=params, cookies=cookies,
                            headers=headers)
    print(response.text)
    print(response.cookies)

补环境部分

代码有点多贴不出来了。

结果

总结

1.出于安全考虑,本章未提供完整流程,调试环节省略较多,只提供大致思路,具体细节要你自己还原,相信你也能调试出来。