维客特之协yi头sign算法分析

Lunction

POST https://api3953.dhcc.wang/api/user/login HTTP/1.1
device: oppo r9 plusm a
sign: 33b9d309b814e033e44ac787ad018fe2
time: 1563958943
token:
Charset: UTF-8
cloudid: A6007905666144
encrypt: 2
User-Agent: Mozilla/5.0 (Linux; Android 5.1.1; oppo r9 plusm a Build/LMY48Z; wv) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/52.0.2743.100 Mobile Safari/537.36 huajuanyun_app:v9.6.1.2019071201
Connection: Keep-Alive
Accept-Encoding: gzip
Cookie: PHPSESSID=nhqfa1loshm7pl931h1hd44ehi; SERVERID=877c774a6b7e9e84c239297b93c8ec92|1563958922|1563958918
version: v9.6.1.2019071201
custom: f0oy1iku07i7tey93kutyb9
Accept: */*
Content-Type: application/x-www-form-urlencoded
Host: api3953.dhcc.wang
Content-Length: 35

mobile=1380038000&password=a123456

sign = md5(cloudid + signKey + Http.API_URL.login.toLowerCase() + time + device + version + custom)

cloudid = "A6007905666144"
signKey = "bUOcpwF9uG"
Http.API_URL.login.toLowerCase() ="/api/user/login"
time = Date.parse(new Date()) / 1000

device = "oppo r9 plusm a"
version = "v9.6.1.2019071201"
custom = "f0oy1iku07i7tey93kutyb9"  //23位长度随机字符


所以，本次md5的明文是:
A6007905666144bUOcpwF9uG/api/user/login1563958943oppo r9 plusm av9.6.1.2019071201f0oy1iku07i7tey93kutyb9

md5后:
33b9d309b814e033e44ac787ad018fe2


技术交流群:270587

foye123

新手一脸懵逼得进来

qianhuo

感谢发布原创作品，精易因你更精彩！全球

1771379501

感谢发布原创作品，精易因你更精彩！

hackhuis

新手学习，感谢分享

小黑猫吉吉

公司答复就是打开了就是大方

shanggao

感谢分享，看看教程

各在天一涯

这样子的分析有个鸡毛的蛋用

kevin0830

最后一句的意思是,看懂了前面的再加.

Ossian

感觉本文的重点是最后一句