利用腾讯快捷登录协议截取 QQ ClientKey / QQKey 实战课程
https://img2024.cnblogs.com/blog/3367775/202401/3367775-20240107205928860-484725191.png本文主要通过利用腾讯网页快捷登录协议来模拟访问并截取已登录 QQ 客户端的Token、Uin、ClientKey、Skey、P_skey等。
https://img2024.cnblogs.com/blog/3367775/202401/3367775-20240107210005282-202531359.png
Step 1、
https://ssl.xui.ptlogin2.weiyun.com/cgi-bin/xlogin?appid=527020901&daid=372&low_login=0&qlogin_auto_login=1&s_url=https://www.weiyun.com/web/callback/common_qq_login_ok.html?login_succ&style=20&hide_title=1&target=self&link_target=blank&hide_close_icon=1&pt_no_auth=1初始化地址、建立会话并发送请求，从返回的数据中查找pt_local_token的值。
https://img2024.cnblogs.com/blog/3367775/202401/3367775-20240107210205963-756556957.png
浏览器中的数据（pt_local_token 的值在 Headers -> Response Headers -> Set-Cookie 中）
实现代码：
// 初始化URL URL_COMPONENTSA crackedURL = { 0 }; char URL_STRING[] = "https://ssl.xui.ptlogin2.weiyun.com/cgi-bin/xlogin?appid=527020901&daid=372&low_login=0&qlogin_auto_login=1&s_url=https://www.weiyun.com/web/callback/common_qq_login_ok.html?login_succ&style=20&hide_title=1&target=self&link_target=blank&hide_close_icon=1&pt_no_auth=1"; char szHostName = { 0 }; char szUrlPath = { 0 }; crackedURL.dwStructSize = sizeof(URL_COMPONENTSA); crackedURL.lpszHostName = szHostName; crackedURL.dwHostNameLength = ARRAYSIZE(szHostName); crackedURL.lpszUrlPath = szUrlPath; crackedURL.dwUrlPathLength = ARRAYSIZE(szUrlPath); InternetCrackUrlA(URL_STRING, (DWORD)strlen(URL_STRING), 0, &crackedURL); // 初始化会话 HINTERNET hInternet = InternetOpenA("Microsoft Internet Explorer", INTERNET_OPEN_TYPE_DIRECT, NULL, NULL, 0); if (hInternet != NULL){ HINTERNET hHttpSession = InternetConnectA(hInternet, crackedURL.lpszHostName, INTERNET_DEFAULT_HTTPS_PORT, NULL, NULL, INTERNET_SERVICE_HTTP, 0, 0); if (hHttpSession != NULL){ HINTERNET hHttpRequest = HttpOpenRequestA(hHttpSession, "GET", crackedURL.lpszUrlPath, NULL, "", NULL, INTERNET_FLAG_SECURE, 0); if (hHttpRequest != NULL){ BOOL bRet = FALSE; // 发送HTTP请求 bRet = HttpSendRequest(hHttpRequest, NULL, 0, NULL, 0); if (bRet){ // 查询HTTP请求状态 DWORD dwRetCode = 0; DWORD dwSizeOfRq = sizeof(DWORD); bRet = HttpQueryInfo(hHttpRequest, HTTP_QUERY_STATUS_CODE | HTTP_QUERY_FLAG_NUMBER, &dwRetCode, &dwSizeOfRq, NULL); if (bRet){ // 读取整个Headers char lpHeaderBuffer = { 0 }; dwSizeOfRq = 1024; HttpQueryInfo(hHttpRequest, HTTP_QUERY_RAW_HEADERS, lpHeaderBuffer, &dwSizeOfRq, NULL); // 提取 pt_local_token 的值 char* pt_local_token = lpHeaderBuffer + dwSizeOfRq; while (pt_local_token != lpHeaderBuffer){ if (strstr(pt_local_token, "pt_local_token=")){ pt_local_token += sizeof("pt_local_token"); char* pEndBuffer = strstr(pt_local_token, ";"); *pEndBuffer = 0; break; } pt_local_token--; } // 关闭句柄 InternetCloseHandle(hHttpRequest); InternetCloseHandle(hHttpSession); cout
页:
[1]