Python 爬虫加密实战：ROT + Base32 + 凯撒 + HMAC-MD5 组合（CH-006）

1
"""CH-006：答案 = 5 页共 50 个数字的总和"""
2
import base64
3
import hashlib
4
import hmac
5
import json
6
import time
7

8
import requests
9

10
BASE = "https://spider.jsnote.top"
11
ROUTE = "/cipher"                    # 签名里带前导斜杠
12
INIT_URL = f"{BASE}/api/challenges/CH-006/init"
13
DATA_URL = f"{BASE}/api/challenges/CH-006/data"
14
TOTAL_PAGES = 5
15
ALPHABET = "ABCDEFGHIJKLMNOPQRSTUVWXYZ234567"
16

17

18
# ---------- 三个基础变换 ----------
19
def rot_letters(text, offset):
20
    """凯撒 / ROT-N：只动字母，大小写各自成环（offset 允许为负 = 反向）。"""
21
    step = offset % 26
22
    out = []
23
    for char in str(text):
24
        if "a" <= char <= "z":
25
            out.append(chr((ord(char) - 97 + step) % 26 + 97))
26
        elif "A" <= char <= "Z":
27
            out.append(chr((ord(char) - 65 + step) % 26 + 65))
28
        else:
29
            out.append(char)
30
    return "".join(out)
31

32

33
def rot_printable(text, offset):
34
    """ROT-N over ASCII 33..126（ROT47 的推广）。"""
35
    step = offset % 94
36
    out = []
37
    for char in str(text):
38
        code = ord(char)
39
        out.append(chr((code - 33 + step) % 94 + 33) if 33 <= code <= 126 else char)
40
    return "".join(out)
41

42

43
def base32_decode(text):
44
    cleaned = "".join(char for char in str(text).upper() if char in ALPHABET)
45
    return base64.b32decode(cleaned + "=" * ((-len(cleaned)) % 8)).decode()
46

47

48
# ---------- 签名 / 参数 / 解密 ----------
49
def sign(config, page, timestamp):
50
    """HMAC-MD5(raw, salt) 的 hex，再做两次 ROT-N（N = rot13Offset）。"""
51
    raw = f"{ROUTE}|{page}|{timestamp}|{config['salt']}"
52
    digest = hmac.new(config["salt"].encode(), raw.encode(), hashlib.md5).hexdigest()
53
    offset = config["rot13Offset"]
54
    return rot_letters(rot_letters(digest, offset), offset)
55

56

57
def encode_params(config, page, timestamp):
58
    """参数是「两次 ROT-N 之后的 JSON 字符串」，直接当字段值发出去。"""
59
    raw = json.dumps({"page": page, "timestamp": timestamp}, separators=(",", ":"))
60
    offset = config["rot13Offset"]
61
    return rot_letters(rot_letters(raw, offset), offset)
62

63

64
def decrypt(config, rot_data):
65
    """ROT47 还原 → Base32 解码 → 凯撒还原 → JSON。"""
66
    unrotated = rot_printable(rot_data, -config["rot47Offset"])
67
    unbased = base32_decode(unrotated)
68
    return json.loads(rot_letters(unbased, -config["caesarShift"]))
69

70

71
def main():
72
    session = requests.Session()
73
    session.headers.update({
74
        "Content-Type": "application/json",
75
        "Referer": f"{BASE}/cipher?challenge=CH-006",
76
        "User-Agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) Chrome/147.0.0.0 Safari/537.36",
77
    })
78
    session.cookies.set("session", "<把浏览器里的 session cookie 粘到这里>",
79
                        domain="spider.jsnote.top")
80

81
    config = session.get(INIT_URL, timeout=10).json()
82
    print("拿到钥匙：", {k: config[k] for k in
83
                      ("rot13Offset", "rot47Offset", "caesarShift", "salt")})
84

85
    total = 0
86
    for page in range(1, TOTAL_PAGES + 1):
87
        timestamp = str(int(time.time() * 1000))
88
        response = session.post(DATA_URL, headers={
89
            "X-ROT-Sign": sign(config, page, timestamp),
90
        }, data=json.dumps({
91
            "rotParams": encode_params(config, page, timestamp),
92
        }), timeout=10)
93

94
        if response.status_code == 403:
95
            raise SystemExit("403：签名不对。先确认 raw 是 '/cipher|page|timestamp|salt'，再做两遍 ROT-N")
96
        response.raise_for_status()
97

98
        payload = decrypt(config, response.json()["rotData"])
99
        numbers = payload["data"]
100
        total += sum(numbers)
101
        print(f"第 {page} 页：{numbers} → 累计 {total}")
102
        time.sleep(0.5)
103

104
    print(f"\n答案：{total}")
105

106

107
if __name__ == "__main__":
108
    main()