某无水印视频解析api分析

zhuangping

https://api.spapi.cn/
该网站的api，一直返回"status": 102，我通过审查元素捕捉原样的请求信息还是不能正常返回结果。请大神分析一下，请求时应带什么信息？

AlenChan

没问题   

协议头
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
x-requested-with: XMLHttpRequest
content-type: application/x-www-form-urlencoded

Cookies
SPAPIID=

luojineng

import requests

cookies = {
    'SPAPIID': '2717YUZL0g%2FtEFVG7vyTIejiDSxbLNJ%2FtEezbKlZH2fvoeZoy2b1FOK37Ivkp4vouBsFq9k0G9qzZmd1Gg',
    'Hm_lvt_990f76006a86053689a6b7f23409f43a': '1744380732',
    'Hm_lpvt_990f76006a86053689a6b7f23409f43a': '1744380732',
    'HMACCOUNT': '59070FD8597D1C7E',
}

headers = {
    'Host': 'api.spapi.cn',
    'sec-ch-ua': '"Chromium";v="122", "Not(A:Brand";v="24", "Google Chrome";v="122"',
    'Accept': 'application/json, text/plain, */*',
    'X-Requested-With': 'XMLHttpRequest',
    'sec-ch-ua-mobile': '?0',
    'User-Agent': 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.95 Safari/537.36',
    'sec-ch-ua-platform': '"Windows"',
    'Origin': 'https://api.spapi.cn',
    'Sec-Fetch-Site': 'same-origin',
    'Sec-Fetch-Mode': 'cors',
    'Sec-Fetch-Dest': 'empty',
    'Referer': 'https://api.spapi.cn/',
    'Accept-Language': 'zh-CN,zh;q=0.9',
    # 'Cookie': 'SPAPIID=2717YUZL0g%2FtEFVG7vyTIejiDSxbLNJ%2FtEezbKlZH2fvoeZoy2b1FOK37Ivkp4vouBsFq9k0G9qzZmd1Gg; Hm_lvt_990f76006a86053689a6b7f23409f43a=1744380732; Hm_lpvt_990f76006a86053689a6b7f23409f43a=1744380732; HMACCOUNT=59070FD8597D1C7E',
    'Content-Type': 'application/x-www-form-urlencoded',
}

params = {
    'otype': 'json',
    'timestamp': '1744380765532',
    'sign': '3564c72eb0c50a3eb4e9c30a454335ae',
}

data = {
    'url': '3.89%2006/09%20MjP:/%20Y@z.tr%20%E9%83%BD%E6%98%8C%E5%A4%A7%E6%B8%AF%E8%B1%AA%E5%8D%8E%E5%A9%9A%E7%A4%BC%EF%BC%81%E5%8D%81%E8%BE%86%E6%9C%BA%E8%BD%A6%E5%BC%95%E6%93%8E%E8%BD%B0%E9%B8%A3%E9%9C%B8%E6%B0%94%E5%BC%80%E9%81%93%20%E4%BA%8C%E5%8D%81%E4%B8%80%E8%BE%86%E5%A9%9A%E8%BD%A6%E6%B5%81%E5%85%89%E6%BA%A2%E5%BD%A9%E6%B5%A9%E6%B5%A9%E8%8D%A1%E8%8D%A1%E9%9A%8F%E8%A1%8C%EF%BC%8C%E7%92%80%E7%92%A8%E7%83%9F%E8%8A%B1%E5%A2%99%E4%B8%8B%E6%96%B0%E4%BA%BA%E8%AE%B8%E4%B8%8B%E4%B8%80%E7%94%9F%E7%9A%84%E6%B5%AA%E6%BC%AB%E8%AA%93%E8%A8%80%EF%BC%81#%20%E9%83%BD%E6%98%8C%E5%A9%9A%E7%A4%BC%E8%B7%9F%E6%8B%8D%20#%20%E9%83%BD%E6%98%8C%E5%A9%9A%E7%A4%BC%20#%20%E5%A9%9A%E7%A4%BC%E7%8E%B0%E5%9C%BA%20#%20%E5%96%9C%E7%BB%93%E8%89%AF%E7%BC%98%20#%20%E5%A9%9A%E7%A4%BC%E8%88%AA%E6%8B%8D%E6%91%84%E5%BD%B1%E8%83%A1%E5%93%A5%20%20https://v.douyin.com/kmcU-jWaD3A/%20%E5%A4%8D%E5%88%B6%E6%AD%A4%E9%93%BE%E6%8E%A5%EF%BC%8C%E6%89%93%E5%BC%80Dou%E9%9F%B3%E6%90%9C%E7%B4%A2%EF%BC%8C%E7%9B%B4%E6%8E%A5%E8%A7%82%E7%9C%8B%E8%A7%86%E9%A2%91%EF%BC%81',
}

response = requests.post('https://api.spapi.cn/api/parsing', params=params, cookies=cookies, headers=headers, data=data)

你要弄sign和Origin

测试没问题。

wooyun123

Sign值为拼接 timestamp 时间戳参数 以及你输入的url地址 最后加上  ce544ff3c4c8 拼接后 md5加密

如 timestamp 时间戳为  1744380765532  输入的url地址为  http://www.baidu.com

则 sign 值为 md5(1744380765532http://www.baidu.comce544ff3c4c8)

netxboy

AlenChan 发表于 2025-4-11 21:57
没问题   

协议头

这是个啥，postman么

zhuangping

wooyun123 发表于 2025-4-11 22:22
Sign值为拼接 timestamp 时间戳参数 以及你输入的url地址 最后加上  ce544ff3c4c8 拼接后 md5加密

如 ti ...

牛，我只找到了加密参数，没看出来是MD5，我是审查元素手动调用captcha。请问怎么看出来是md5加密的？

wooyun123

zhuangping 发表于 2025-4-12 10:41
牛，我只找到了加密参数，没看出来是MD5，我是审查元素手动调用captcha。请问怎么看出来是md5加密的？

F12 调试 逆向分析

zhuangping

wooyun123 发表于 2025-4-12 14:44
F12 调试 逆向分析

查到了var sign = captcha(timestamp + homepage + 'ce544ff3c4c8');
captcha，这个函数没有找到