加载中…| 分类： 程序写写 |
对新东方在线[tol24.com]的一次安全性测试（四）
by hcling97.NET
2006.09.07
5.[抓包及分析]
登陆的包
------------------------------------------------------------------
50 4F 53 54 20 68 74 74 70 3A 2F 2F 6C 6F 67 69 6E 2E 74 6F 6C 32 34 2E
63 6F 6D 2F 73 73 6F 2F 6C 6F 67 69 6E 2E 64 6F 20 48 54 54 50 2F 31 2E 30
0D 0A 41 63 63 65 70 74 3A 20 69 6D 61 67 65 2F 67 69 66 2C 20 69 6D 61 67
65 2F 78 2D 78 62 69 74 6D 61 70 2C 20 69 6D 61 67 65 2F 6A 70 65 67 2C 20
69 6D 61 67 65 2F 70 6A 70 65 67 2C 20 61 70 70 6C 69 63 61 74 69 6F 6E 2F
76 6E 64 2E 6D 73 2D 70 6F 77 65 72 70 6F 69 6E 74 2C 20 61 70 70 6C 69 63
61 74 69 6F 6E 2F 76 6E 64 2E 6D 73 2D 65 78 63 65 6C 2C 20 61 70 70 6C 69
63 61 74 69 6F 6E 2F 6D 73 77 6F 72 64 2C 20 61 70 70 6C 69 63 61 74 69 6F
6E 2F 78 2D 73 68 6F 63 6B 77 61 76 65 2D 66 6C 61 73 68 2C 20 2A 2F 2A 0D
0A 52 65 66 65 72 65 72 3A 20 68 74 74 70 3A 2F 2F 6C 6F 67 69 6E 2E 74 6F
6C 32 34 2E 63 6F 6D 2F 73 73 6F 2F 6C 6F 67 69 6E 2E 64 6F 0D 0A 41 63 63
65 70 74 2D 4C 61 6E 67 75 61 67 65 3A 20 7A 68 2D 63 6E 0D 0A 43 6F 6E 74
65 6E 74 2D 54 79 70 65 3A 20 61 70 70 6C 69 63 61 74 69 6F 6E 2F 78 2D 77
77 77 2D 66 6F 72 6D 2D 75 72 6C 65 6E 63 6F 64 65 64 0D 0A 50 72 6F 78 79
2D 43 6F 6E 6E 65 63 74 69 6F 6E 3A 20 4B 65 65 70 2D 41 6C 69 76 65 0D 0A
55 73 65 72 2D 41 67 65 6E 74 3A 20 4D 6F 7A 69 6C 6C 61 2F 34 2E 30 20 28
63 6F 6D 70 61
------------------------------------------------------------------
POST http://login.tol24.com/sso/login.do HTTP/1.0
Accept: image/gif, image/x-xbitmap, image/jpeg, image/pjpeg,
application/vnd.ms-powerpoint, application/vnd.ms-excel, application/msword,
application/x-shockwave-flash, */*
Referer: http://login.tol24.com/sso/login.do
Accept-Language: zh-cn
Content-Type: application/x-www-form-urlencoded
Proxy-Connection: Keep-Alive
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0; .NET CLR
1.1.4322)
Host: login.tol24.com
Content-Length: 152
Pragma: no-cache
Cookie: JSESSIONID=7C738F541DCA9161B64944595AB264AB.sso02
next_page=http%3A%2F%2Fwww.tol24.com%2Feclass%2Findex.jsp&userName=××
×××××&password=×××××××&randNumber=3286&website=tol24&Submit. x=41&Submit.y=15
==================================================================
第一次POST到/eclass/user/flashprotocol.jsp的包：
------------------------------------------------------------------
50 4F 53 54 20 68 74 74 70 3A 2F 2F 77 77 77 2E 74 6F 6C 32 34 2E 63 6F
6D 2F 65 63 6C 61 73 73 2F 75 73 65 72 2F 66 6C 61 73 68 70 72 6F 74 6F 63
6F 6C 2E 6A 73 70 20 48 54 54 50 2F 31 2E 30 0D 0A 41 63 63 65 70 74 3A 20
2A 2F 2A 0D 0A 78 2D 66 6C 61 73 68 2D 76 65 72 73 69 6F 6E 3A 20 38 2C 30
2C 32 32 2C 30 0D 0A 43 6F 6E 74 65 6E 74 2D 54 79 70 65 3A 20 61 70 70 6C
69 63 61 74 69 6F 6E 2F 78 2D 77 77 77 2D 66 6F 72 6D 2D 75 72 6C 65 6E 63
6F 64 65 64 0D 0A 43 6F 6E 74 65 6E 74 2D 4C 65 6E 67 74 68 3A 20 38 31 0D
0A 50 72 61 67 6D 61 3A 20 6E 6F 2D 63 61 63 68 65 0D 0A 55 73 65 72 2D 41
67 65 6E 74 3A 20 4D 6F 7A 69 6C 6C 61 2F 34 2E 30 20 28 63 6F 6D 70 61 74
69 62 6C 65 3B 20 4D 53 49 45 20 36 2E 30 3B 20 57 69 6E 64 6F 77 73 20 4E
54 20 35 2E 30 3B 20 2E 4E 45 54 20 43 4C 52 20 31 2E 31 2E 34 33 32 32 29
0D 0A 48 6F 73 74 3A 20 77 77 77 2E 74 6F 6C 32 34 2E 63 6F 6D 0D 0A 50 72
6F 78 79 2D 43 6F 6E 6E 65 63 74 69 6F 6E 3A 20 4B 65 65 70 2D 41 6C 69 76
65 0D 0A 43 6F 6F 6B 69 65 3A 20 4A 53 45 53 53 49 4F 4E 49 44 3D 41 44 42
30 44 45 32 39 36 32 44 35 46 36 42 35 32 31 30 34 36 45 35 34 45 36 42 31
39 34 31 33 2E 61 70 70 31 33 36 61 3B 20 73 73 6F 2E 73 73 6F 49 64 3D 31
62 62 38 38 66 61 30 65 38 31 62 61 65 31 62 30 33 65 39 33 34 34 39 37 38
35 32 66 35 31 37 62 64 32 38 63 34 63 35 38 65 35 64 62 34 35 32 0D 0A 0D
0A 72 65 71 75 65 73 74 3D 31 25 37 43 25 37 43 25 37 43 25 37 43 38 30 25
35 46 38 39 25 35 46 38 33 25 35 46 38 35 25 35 46 38 35 25 35 46 38 31 25
35 46 39 35 25 35 46 39 33 25 35 46 39 32 25 35 46 38 35 25 35 46 39 31 25
35 46 38 34 25 35 46
------------------------------------------------------------------
POST http://www.tol24.com/eclass/user/flashprotocol.jsp HTTP/1.0
Accept: */*
x-flash-version: 8,0,22,0
Content-Type: application/x-www-form-urlencoded
Content-Length: 81
Pragma: no-cache
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0; .NET CLR
1.1.4322)
Host: [url]www.tol24.com[/url]
Proxy-Connection: Keep-Alive
Cookie: JSESSIONID=ADB0DE2962D5F6B521046E54E6B19413.app136a;
sso.ssoId=1bb88fa0e81bae1b03e934497852f517bd28c4c58e5db452
request=1%7C%7C%7C%7C80%5F89%5F83%5F85%5F85%5F81%5F95%5F93%5F92%5F85
%5F91%5F84%5F
==================================================================
第二次POST到/eclass/user/flashprotocol.jsp的包：
------------------------------------------------------------------
50 4F 53 54 20 68 74 74 70 3A 2F 2F 77 77 77 2E 74 6F 6C 32 34 2E 63 6F
6D 2F 65 63 6C 61 73 73 2F 75 73 65 72 2F 66 6C 61 73 68 70 72 6F 74 6F 63
6F 6C 2E 6A 73 70 20 48 54 54 50 2F 31 2E 30 0D 0A 41 63 63 65 70 74 3A 20
2A 2F 2A 0D 0A 78 2D 66 6C 61 73 68 2D 76 65 72 73 69 6F 6E 3A 20 38 2C 30
2C 32 32 2C 30 0D 0A 43 6F 6E 74 65 6E 74 2D 54 79 70 65 3A 20 61 70 70 6C
69 63 61 74 69 6F 6E 2F 78 2D 77 77 77 2D 66 6F 72 6D 2D 75 72 6C 65 6E 63
6F 64 65 64 0D 0A 43 6F 6E 74 65 6E 74 2D 4C 65 6E 67 74 68 3A 20 38 31 0D
0A 50 72 61 67 6D 61 3A 20 6E 6F 2D 63 61 63 68 65 0D 0A 55 73 65 72 2D 41
67 65 6E 74 3A 20 4D 6F 7A 69 6C 6C 61 2F 34 2E 30 20 28 63 6F 6D 70 61 74
69 62 6C 65 3B 20 4D 53 49 45 20 36 2E 30 3B 20 57 69 6E 64 6F 77 73 20 4E
54 20 35 2E 30 3B 20 2E 4E 45 54 20 43 4C 52 20 31 2E 31 2E 34 33 32 32 29
0D 0A 48 6F 73 74 3A 20 77 77 77 2E 74 6F 6C 32 34 2E 63 6F 6D 0D 0A 50 72
6F 78 79 2D 43 6F 6E 6E 65 63 74 69 6F 6E 3A 20 4B 65 65 70 2D 41 6C 69 76
65 0D 0A 43 6F 6F 6B 69 65 3A 20 4A 53 45 53 53 49 4F 4E 49 44 3D 41 44 42
30 44 45 32 39 36 32 44 35 46 36 42 35 32 31 30 34 36 45 35 34 45 36 42 31
39 34 31 33 2E 61 70 70 31 33 36 61 3B 20 73 73 6F 2E 73 73 6F 49 64 3D 31
62 62 38 38 66 61 30 65 38 31 62 61 65 31 62 30 33 65 39 33 34 34 39 37 38
35 32 66 35 31 37 62 64 32 38 63 34 63 35 38 65 35 64 62 34 35 32 0D 0A 0D
0A 72 65 71 75 65 73 74 3D 31 25 37 43 25 37 43 25 37 43 25 37 43 38 30 25
35 46 38 39 25 35 46 38 33 25 35 46 38 35 25 35 46 38 35 25 35 46 38 31 25
35 46 39 35 25 35 46 39 33 25 35 46 39 32 25 35 46 38 35 25 35 46 39 31 25
35 46 38 34 25 35 46
------------------------------------------------------------------
POST http://www.tol24.com/eclass/user/flashprotocol.jsp HTTP/1.0
Accept: */*
x-flash-version: 8,0,22,0
Content-Type: application/x-www-form-urlencoded
Content-Length: 401
Pragma: no-cache
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0; .NET CLR
1.1.4322)
Host: [url]www.tol24.com[/url]
Proxy-Connection: Keep-Alive
Cookie: JSESSIONID=ADB0DE2962D5F6B521046E54E6B19413.app136a;
sso.ssoId=1bb88fa0e81bae1b03e934497852f517bd28c4c58e5db452
request=100%7C%7C247%5F128%5F223%5F6%5F208%5F243%5F150%5F198%5F12%5F238%
5F242%5F147%5F211%5F12%5F222%5F227%5F150%5F206%5F6%5F224%5F252%5F131%5F194%5
F2%5F209%5F252%5F134%5F206%5F9%5F224%5F231%5F145%5F203%5F241%5F172%5F166%5F1
51%5F192%5F12%5F189%5F249%5F151%5F206%5F13%5F225%5F231%5F159%5F196%5F6%5F238
%5F225%5F145%5F196%5F12%5F%7C%7C224%5F144%5F206%5F0%5F237%5F231%5F146%5F196%
5F11%5F237%5F249%5F151%5F
==================================================================
6.[分析软件及代码环境]
6.1 系统：Windows 2000 Server
6.2 协议分析：Iris Network Traffic Analyzer
6.3 编程环境：Visual Studio .NET 2003 , .NET Framework 1.1.4322
6.4 文档编写：EditPlus 2.10
7.[软件运行情况及单次执行反馈]
7.1 如图7.1_1及7.1_2.
![对新东方在线[tol24.com]的一次安全性测试（四）](http://simg.sinajs.cn/blog7style/images/common/sg_trans.gif "鐐瑰嚮鍦ㄦ柊绐楀彛鎵撳紑鍥剧墖")
图7.1_1
图7.1_2
7.2 单次执行反馈：
[09.08 04:16:53]:尝试连接tol24.com中....
[09.08 04:17:13]:连接[http://www.tol24.com]成功!
[09.08 04:17:19]:=============Request Header=============
[09.08 04:17:19]:login.tol24.com
[09.08 04:17:19]:=============ResponseHeader=============
[09.08 04:17:19]:1.1 ISA2004-1
[09.08 04:17:19]:Keep-Alive
[09.08 04:17:19]:Keep-Alive
[09.08 04:17:19]:chunked
[09.08 04:17:19]:Thu, 01 Jan 1970 00:00:00 GMT
[09.08 04:17:19]:Fri, 08 Sep 2006 08:11:12 GMT
[09.08 04:17:19]:image/jpeg;charset=UTF-8
[09.08 04:17:19]:Apache
[09.08 04:17:19]:no-cache,no-store,must-revalidate
[09.08 04:17:19]:no-cache
[09.08 04:17:19]:JSESSIONID=DFF1F79E5D6A3C45E1FC0EDDB77EDE08.sso02;
Path=/sso
[09.08 04:17:19]:timeout=15, max=100
[09.08 04:17:19]:Download Successful!
[09.08 04:17:19]:请输入验证码,尝试登陆!
[09.08 04:17:26]:=============Request Header=============
[09.08 04:17:26]:application/x-www-form-urlencoded
[09.08 04:17:26]:142
[09.08 04:17:26]:100-continue
[09.08 04:17:26]:login.tol24.com
[09.08 04:17:26]:JSESSIONID=DFF1F79E5D6A3C45E1FC0EDDB77EDE08.sso02
[09.08 04:17:26]:=============Request Header=============
[09.08 04:17:26]:application/x-www-form-urlencoded
[09.08 04:17:26]:142
[09.08 04:17:26]:100-continue
[09.08 04:17:26]:login.tol24.com
[09.08 04:17:26]:JSESSIONID=DFF1F79E5D6A3C45E1FC0EDDB77EDE08.sso02
[09.08 04:17:26]:登陆成功.请尝试下载!
[09.08 04:17:28]:装配初始信息中...
[09.08 04:17:28]:逐个下载中...
[09.08 04:17:28]:StartInfo:24121167;1;1
[09.08 04:17:28]:FirstEncrypt:80_89_83_85_85_81_95_93_92_85_91_84_
[09.08 04:17:28]:FirstRequest=1||||80_89_83_85_85_81_95_93_92_85_
91_84_
[09.08 04:17:28]:=============Request Header=============
[09.08 04:17:28]:application/x-www-form-urlencoded
[09.08 04:17:28]:49
[09.08 04:17:28]:100-continue
[09.08 04:17:28]:[url]www.tol24.com[/url]
[09.08 04:17:28]:JSESSIONID=07682B9DCB9CE4738CEBDBB31F81DB53.app136a
;sso.ssoId=1bb88fa0e81bae1b03e934497852f517bd28c4c58e5db452
[09.08 04:17:28]:=============Request Header=============
[09.08 04:17:28]:application/x-www-form-urlencoded
[09.08 04:17:28]:49
[09.08 04:17:28]:100-continue
[09.08 04:17:28]:[url]www.tol24.com[/url]
[09.08 04:17:28]:JSESSIONID=07682B9DCB9CE4738CEBDBB31F81DB53.app136a
;sso.ssoId=1bb88fa0e81bae1b03e934497852f517bd28c4c58e5db452
[09.08 04:17:28]:FirstResponse:response=1||81_66_144_147_170_157_74_
144_147_168_159_191_89_87_95_92_93_80_69_93_66_74_ 64_94_75_77_89_93_84_92_67_72_64_75_74_64_90_83_
73_92_81_73_64_90_91_84_164_146_151_85_83_95_163_
92_85_81_88_93_88_84_83_85_93_95_95_86_94_||
[09.08 04:17:28]:DecryptTo=1;rlbuCrldwV;
07682B9DCB9CE4738CEBDBB31F81DB53.app136a;1157703078707
[09.0804:17:28]:SecondRequest=100||206_236_11_192_255_216_238_245_
203_239_199_208_250_196_248_201_239_244_213_239_218_
209_247_251_254_212_239_6_212_239_203_224_3_169_177_
142_230_4_198_142_193_230_6_197_248_197_231_4_248_248_ 198_236_1_199_||200_227_6_250_254_207_237_8_195_254_
193_230_
[09.08 04:17:29]:=============Request Header=============
[09.08 04:17:29]:application/x-www-form-urlencoded
[09.08 04:17:29]:262
[09.08 04:17:29]:100-continue
[09.08 04:17:29]:[url]www.tol24.com[/url]
[09.08 04:17:29]:JSESSIONID=07682B9DCB9CE4738CEBDBB31F81DB53.app136a
;sso.ssoId=1bb88fa0e81bae1b03e934497852f517bd28c4c58e5db452
[09.08 04:17:29]:=============Request Header=============
[09.08 04:17:29]:application/x-www-form-urlencoded
[09.08 04:17:29]:262
[09.08 04:17:29]:100-continue
[09.08 04:17:29]:[url]www.tol24.com[/url]
[09.08 04:17:29]:JSESSIONID=07682B9DCB9CE4738CEBDBB31F81DB53.app136a
;sso.ssoId=1bb88fa0e81bae1b03e934497852f517bd28c4c58e5db452
[09.08 04:17:29]:SecondResponse:response=100||207_232_1_199_251_198_
225_247_193_237_217_209_14_203_234_202_236_4_192_236_219_209 _245_202_239_201_230_251_192_254_218_209_10_251_243_191_167_ 193_249_252_196_182_12_249_254_203_236_8_248_252_206_236_14_ 251_251_201_||205_178_212_188_142_137_160_0_133_188_187_161_ 0_186_138_191_179_219_188_142_137_191_219_177_181_187_229_22 3_187_177_221_189_222_188_138_140_182_194_181_226_251_225_25 1_180_142_138_182_6_245_255_212_160_200_182_202_200_221_196_ 135_139_251_225_251_190_140_187_242_7_214_179_185_178_208_19 0_176_200_180_201_133_166_191_165_26_250_235_140_176_218_175 _179_141_225_208_128_186_135_182_195_175_254_189_230_3_187_1 84_180_232_12_
[09.08 04:17:29]:RightUrl=/eclass/user/readflashfile.jsp?filename=
%2Fdata1%2Fswf%2Fswf%2Fnce%2Fnce_no2_xuyan%2Fnce_
no2_xuyan_1_1.swf
[09.08 04:17:29]:=============Request Header=============
[09.08 04:17:29]:[url]www.tol24.com[/url]
[09.08 04:17:29]:JSESSIONID=07682B9DCB9CE4738CEBDBB31F81DB53.app136a
;sso.ssoId=1bb88fa0e81bae1b03e934497852f517bd28c4c58e5db452
[09.08 04:17:31]:=============ResponseHeader=============
[09.08 04:17:31]:1.1 ISA2004-2, 1.1 ISA2004-1
[09.08 04:17:31]:Keep-Alive
[09.08 04:17:31]:Keep-Alive
[09.08 04:17:31]:1392244
[09.08 04:17:31]:Thu, 01 Jan 1970 00:00:00 GMT
[09.08 04:17:31]:Fri, 08 Sep 2006 08:11:19 GMT
[09.08 04:17:31]:application/x-shockwave-flash;charset=UTF-8
[09.08 04:17:31]:Apache
[09.08 04:17:31]:no-cache,no-store,must-revalidate
[09.08 04:17:31]:no-cache
[09.08 04:17:31]:no-cache
[09.08 04:17:31]:timeout=15, max=97
[09.08 04:17:31]:Download Successful!
[09.08 04:17:31]:SwfFile Download Successfully!
by hcling97.NET
2006.09.07
5.[抓包及分析]
登陆的包
------------------------------------------------------------------
50 4F 53 54 20 68 74 74 70 3A 2F 2F 6C 6F 67 69 6E 2E 74 6F 6C 32 34 2E
63 6F 6D 2F 73 73 6F 2F 6C 6F 67 69 6E 2E 64 6F 20 48 54 54 50 2F 31 2E 30
0D 0A 41 63 63 65 70 74 3A 20 69 6D 61 67 65 2F 67 69 66 2C 20 69 6D 61 67
65 2F 78 2D 78 62 69 74 6D 61 70 2C 20 69 6D 61 67 65 2F 6A 70 65 67 2C 20
69 6D 61 67 65 2F 70 6A 70 65 67 2C 20 61 70 70 6C 69 63 61 74 69 6F 6E 2F
76 6E 64 2E 6D 73 2D 70 6F 77 65 72 70 6F 69 6E 74 2C 20 61 70 70 6C 69 63
61 74 69 6F 6E 2F 76 6E 64 2E 6D 73 2D 65 78 63 65 6C 2C 20 61 70 70 6C 69
63 61 74 69 6F 6E 2F 6D 73 77 6F 72 64 2C 20 61 70 70 6C 69 63 61 74 69 6F
6E 2F 78 2D 73 68 6F 63 6B 77 61 76 65 2D 66 6C 61 73 68 2C 20 2A 2F 2A 0D
0A 52 65 66 65 72 65 72 3A 20 68 74 74 70 3A 2F 2F 6C 6F 67 69 6E 2E 74 6F
6C 32 34 2E 63 6F 6D 2F 73 73 6F 2F 6C 6F 67 69 6E 2E 64 6F 0D 0A 41 63 63
65 70 74 2D 4C 61 6E 67 75 61 67 65 3A 20 7A 68 2D 63 6E 0D 0A 43 6F 6E 74
65 6E 74 2D 54 79 70 65 3A 20 61 70 70 6C 69 63 61 74 69 6F 6E 2F 78 2D 77
77 77 2D 66 6F 72 6D 2D 75 72 6C 65 6E 63 6F 64 65 64 0D 0A 50 72 6F 78 79
2D 43 6F 6E 6E 65 63 74 69 6F 6E 3A 20 4B 65 65 70 2D 41 6C 69 76 65 0D 0A
55 73 65 72 2D 41 67 65 6E 74 3A 20 4D 6F 7A 69 6C 6C 61 2F 34 2E 30 20 28
63 6F 6D 70 61
------------------------------------------------------------------
POST http://login.tol24.com/sso/login.do HTTP/1.0
Accept: image/gif, image/x-xbitmap, image/jpeg, image/pjpeg,
application/vnd.ms-powerpoint, application/vnd.ms-excel, application/msword,
application/x-shockwave-flash, */*
Referer: http://login.tol24.com/sso/login.do
Accept-Language: zh-cn
Content-Type: application/x-www-form-urlencoded
Proxy-Connection: Keep-Alive
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0; .NET CLR
1.1.4322)
Host: login.tol24.com
Content-Length: 152
Pragma: no-cache
Cookie: JSESSIONID=7C738F541DCA9161B6494459
next_page=http%3A%2F%2Fwww.tol24.com%2Feclass%2Findex.jsp&userName=××
×××××&password=×××××××&randNumber=3286&website=tol24&Submit. x=41&Submit.y=15
==================================================================
第一次POST到/eclass/user/flashprotocol.jsp的包：
------------------------------------------------------------------
50 4F 53 54 20 68 74 74 70 3A 2F 2F 77 77 77 2E 74 6F 6C 32 34 2E 63 6F
6D 2F 65 63 6C 61 73 73 2F 75 73 65 72 2F 66 6C 61 73 68 70 72 6F 74 6F 63
6F 6C 2E 6A 73 70 20 48 54 54 50 2F 31 2E 30 0D 0A 41 63 63 65 70 74 3A 20
2A 2F 2A 0D 0A 78 2D 66 6C 61 73 68 2D 76 65 72 73 69 6F 6E 3A 20 38 2C 30
2C 32 32 2C 30 0D 0A 43 6F 6E 74 65 6E 74 2D 54 79 70 65 3A 20 61 70 70 6C
69 63 61 74 69 6F 6E 2F 78 2D 77 77 77 2D 66 6F 72 6D 2D 75 72 6C 65 6E 63
6F 64 65 64 0D 0A 43 6F 6E 74 65 6E 74 2D 4C 65 6E 67 74 68 3A 20 38 31 0D
0A 50 72 61 67 6D 61 3A 20 6E 6F 2D 63 61 63 68 65 0D 0A 55 73 65 72 2D 41
67 65 6E 74 3A 20 4D 6F 7A 69 6C 6C 61 2F 34 2E 30 20 28 63 6F 6D 70 61 74
69 62 6C 65 3B 20 4D 53 49 45 20 36 2E 30 3B 20 57 69 6E 64 6F 77 73 20 4E
54 20 35 2E 30 3B 20 2E 4E 45 54 20 43 4C 52 20 31 2E 31 2E 34 33 32 32 29
0D 0A 48 6F 73 74 3A 20 77 77 77 2E 74 6F 6C 32 34 2E 63 6F 6D 0D 0A 50 72
6F 78 79 2D 43 6F 6E 6E 65 63 74 69 6F 6E 3A 20 4B 65 65 70 2D 41 6C 69 76
65 0D 0A 43 6F 6F 6B 69 65 3A 20 4A 53 45 53 53 49 4F 4E 49 44 3D 41 44 42
30 44 45 32 39 36 32 44 35 46 36 42 35 32 31 30 34 36 45 35 34 45 36 42 31
39 34 31 33 2E 61 70 70 31 33 36 61 3B 20 73 73 6F 2E 73 73 6F 49 64 3D 31
62 62 38 38 66 61 30 65 38 31 62 61 65 31 62 30 33 65 39 33 34 34 39 37 38
35 32 66 35 31 37 62 64 32 38 63 34 63 35 38 65 35 64 62 34 35 32 0D 0A 0D
0A 72 65 71 75 65 73 74 3D 31 25 37 43 25 37 43 25 37 43 25 37 43 38 30 25
35 46 38 39 25 35 46 38 33 25 35 46 38 35 25 35 46 38 35 25 35 46 38 31 25
35 46 39 35 25 35 46 39 33 25 35 46 39 32 25 35 46 38 35 25 35 46 39 31 25
35 46 38 34 25 35 46
------------------------------------------------------------------
POST http://www.tol24.com/eclass/user/flashprotocol.jsp HTTP/1.0
Accept: */*
x-flash-version: 8,0,22,0
Content-Type: application/x-www-form-urlencoded
Content-Length: 81
Pragma: no-cache
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0; .NET CLR
1.1.4322)
Host: [url]www.tol24.com[/url]
Proxy-Connection: Keep-Alive
Cookie: JSESSIONID=ADB0DE2962D5F6B521046E54
sso.ssoId=1bb88fa0e81bae1b03e93449
request=1%7C%7C%7C%7C80%5F89%5F83%5F85%5F85%5F81%5F95%5F93%5F92%5F85
%5F91%5F84%5F
==================================================================
第二次POST到/eclass/user/flashprotocol.jsp的包：
------------------------------------------------------------------
50 4F 53 54 20 68 74 74 70 3A 2F 2F 77 77 77 2E 74 6F 6C 32 34 2E 63 6F
6D 2F 65 63 6C 61 73 73 2F 75 73 65 72 2F 66 6C 61 73 68 70 72 6F 74 6F 63
6F 6C 2E 6A 73 70 20 48 54 54 50 2F 31 2E 30 0D 0A 41 63 63 65 70 74 3A 20
2A 2F 2A 0D 0A 78 2D 66 6C 61 73 68 2D 76 65 72 73 69 6F 6E 3A 20 38 2C 30
2C 32 32 2C 30 0D 0A 43 6F 6E 74 65 6E 74 2D 54 79 70 65 3A 20 61 70 70 6C
69 63 61 74 69 6F 6E 2F 78 2D 77 77 77 2D 66 6F 72 6D 2D 75 72 6C 65 6E 63
6F 64 65 64 0D 0A 43 6F 6E 74 65 6E 74 2D 4C 65 6E 67 74 68 3A 20 38 31 0D
0A 50 72 61 67 6D 61 3A 20 6E 6F 2D 63 61 63 68 65 0D 0A 55 73 65 72 2D 41
67 65 6E 74 3A 20 4D 6F 7A 69 6C 6C 61 2F 34 2E 30 20 28 63 6F 6D 70 61 74
69 62 6C 65 3B 20 4D 53 49 45 20 36 2E 30 3B 20 57 69 6E 64 6F 77 73 20 4E
54 20 35 2E 30 3B 20 2E 4E 45 54 20 43 4C 52 20 31 2E 31 2E 34 33 32 32 29
0D 0A 48 6F 73 74 3A 20 77 77 77 2E 74 6F 6C 32 34 2E 63 6F 6D 0D 0A 50 72
6F 78 79 2D 43 6F 6E 6E 65 63 74 69 6F 6E 3A 20 4B 65 65 70 2D 41 6C 69 76
65 0D 0A 43 6F 6F 6B 69 65 3A 20 4A 53 45 53 53 49 4F 4E 49 44 3D 41 44 42
30 44 45 32 39 36 32 44 35 46 36 42 35 32 31 30 34 36 45 35 34 45 36 42 31
39 34 31 33 2E 61 70 70 31 33 36 61 3B 20 73 73 6F 2E 73 73 6F 49 64 3D 31
62 62 38 38 66 61 30 65 38 31 62 61 65 31 62 30 33 65 39 33 34 34 39 37 38
35 32 66 35 31 37 62 64 32 38 63 34 63 35 38 65 35 64 62 34 35 32 0D 0A 0D
0A 72 65 71 75 65 73 74 3D 31 25 37 43 25 37 43 25 37 43 25 37 43 38 30 25
35 46 38 39 25 35 46 38 33 25 35 46 38 35 25 35 46 38 35 25 35 46 38 31 25
35 46 39 35 25 35 46 39 33 25 35 46 39 32 25 35 46 38 35 25 35 46 39 31 25
35 46 38 34 25 35 46
------------------------------------------------------------------
POST http://www.tol24.com/eclass/user/flashprotocol.jsp HTTP/1.0
Accept: */*
x-flash-version: 8,0,22,0
Content-Type: application/x-www-form-urlencoded
Content-Length: 401
Pragma: no-cache
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0; .NET CLR
1.1.4322)
Host: [url]www.tol24.com[/url]
Proxy-Connection: Keep-Alive
Cookie: JSESSIONID=ADB0DE2962D5F6B521046E54
sso.ssoId=1bb88fa0e81bae1b03e93449
request=100%7C%7C247%5F128%5F223%5F6%5F208%5F243%5F150%5F198%5F12%5F238%
5F242%5F147%5F211%5F12%5F222%5F227%5F150%5F206%5F6%5F224%5F252%5F131%5F194%5
F2%5F209%5F252%5F134%5F206%5F9%5F224%5F231%5F145%5F203%5F241%5F172%5F166%5F1
51%5F192%5F12%5F189%5F249%5F151%5F206%5F13%5F225%5F231%5F159%5F196%5F6%5F238
%5F225%5F145%5F196%5F12%5F%7C%7C224%5F144%5F206%5F0%5F237%5F231%5F146%5F196%
5F11%5F237%5F249%5F151%5F
==================================================================
6.[分析软件及代码环境]
6.1 系统：Windows 2000 Server
6.2 协议分析：Iris Network Traffic Analyzer
6.3 编程环境：Visual Studio .NET 2003 , .NET Framework 1.1.4322
6.4 文档编写：EditPlus 2.10
7.[软件运行情况及单次执行反馈]
7.1 如图7.1_1及7.1_2.
图7.1_1
图7.1_2
7.2 单次执行反馈：
[09.08 04:16:53]:尝试连接tol24.com中....
[09.08 04:17:13]:连接[http://www.tol24.com]成功!
[09.08 04:17:19]:=============Request Header=============
[09.08 04:17:19]:login.tol24.com
[09.08 04:17:19]:=============ResponseHeader=============
[09.08 04:17:19]:1.1 ISA2004-1
[09.08 04:17:19]:Keep-Alive
[09.08 04:17:19]:Keep-Alive
[09.08 04:17:19]:chunked
[09.08 04:17:19]:Thu, 01 Jan 1970 00:00:00 GMT
[09.08 04:17:19]:Fri, 08 Sep 2006 08:11:12 GMT
[09.08 04:17:19]:image/jpeg;charset=UTF-8
[09.08 04:17:19]:Apache
[09.08 04:17:19]:no-cache,no-store,must-revalidate
[09.08 04:17:19]:no-cache
[09.08 04:17:19]:JSESSIONID=DFF1F79E5D6A3C45E1FC0EDD
Path=/sso
[09.08 04:17:19]:timeout=15, max=100
[09.08 04:17:19]:Download Successful!
[09.08 04:17:19]:请输入验证码,尝试登陆!
[09.08 04:17:26]:=============Request Header=============
[09.08 04:17:26]:application/x-www-form-urlencoded
[09.08 04:17:26]:142
[09.08 04:17:26]:100-continue
[09.08 04:17:26]:login.tol24.com
[09.08 04:17:26]:JSESSIONID=DFF1F79E5D6A3C45E1FC0EDD
[09.08 04:17:26]:=============Request Header=============
[09.08 04:17:26]:application/x-www-form-urlencoded
[09.08 04:17:26]:142
[09.08 04:17:26]:100-continue
[09.08 04:17:26]:login.tol24.com
[09.08 04:17:26]:JSESSIONID=DFF1F79E5D6A3C45E1FC0EDD
[09.08 04:17:26]:登陆成功.请尝试下载!
[09.08 04:17:28]:装配初始信息中...
[09.08 04:17:28]:逐个下载中...
[09.08 04:17:28]:StartInfo:24121167;1;1
[09.08 04:17:28]:FirstEncrypt:80_89_83_85_85_81_95_93_92_85_91_84_
[09.08 04:17:28]:FirstRequest=1||||80_89_83_85_85_81_95_93_92_85_
91_84_
[09.08 04:17:28]:=============Request Header=============
[09.08 04:17:28]:application/x-www-form-urlencoded
[09.08 04:17:28]:49
[09.08 04:17:28]:100-continue
[09.08 04:17:28]:[url]www.tol24.com[/url]
[09.08 04:17:28]:JSESSIONID=07682B9DCB9CE4738CEBDBB3
;sso.ssoId=1bb88fa0e81bae1b03e93449
[09.08 04:17:28]:=============Request Header=============
[09.08 04:17:28]:application/x-www-form-urlencoded
[09.08 04:17:28]:49
[09.08 04:17:28]:100-continue
[09.08 04:17:28]:[url]www.tol24.com[/url]
[09.08 04:17:28]:JSESSIONID=07682B9DCB9CE4738CEBDBB3
;sso.ssoId=1bb88fa0e81bae1b03e93449
[09.08 04:17:28]:FirstResponse:response=1||81_66_144_147_170_157_74_
144_147_168_159_191_89_87_95_92_93_80_69_93_66_74_ 64_94_75_77_89_93_84_92_67_72_64_75_74_64_90_83_
73_92_81_73_64_90_91_84_164_146_151_85_83_95_163_
92_85_81_88_93_88_84_83_85_93_95_95_86_94_||
[09.08 04:17:28]:DecryptTo=1;rlbuCrldwV;
07682B9DCB9CE4738CEBDBB3
[09.0804:17:28]:SecondRequest=100||206_236_11_192_255_216_238_245_
203_239_199_208_250_196_248_201_239_244_213_239_218_
209_247_251_254_212_239_6_212_239_203_224_3_169_177_
142_230_4_198_142_193_230_6_197_248_197_231_4_248_248_ 198_236_1_199_||200_227_6_250_254_207_237_8_195_254_
193_230_
[09.08 04:17:29]:=============Request Header=============
[09.08 04:17:29]:application/x-www-form-urlencoded
[09.08 04:17:29]:262
[09.08 04:17:29]:100-continue
[09.08 04:17:29]:[url]www.tol24.com[/url]
[09.08 04:17:29]:JSESSIONID=07682B9DCB9CE4738CEBDBB3
;sso.ssoId=1bb88fa0e81bae1b03e93449
[09.08 04:17:29]:=============Request Header=============
[09.08 04:17:29]:application/x-www-form-urlencoded
[09.08 04:17:29]:262
[09.08 04:17:29]:100-continue
[09.08 04:17:29]:[url]www.tol24.com[/url]
[09.08 04:17:29]:JSESSIONID=07682B9DCB9CE4738CEBDBB3
;sso.ssoId=1bb88fa0e81bae1b03e93449
[09.08 04:17:29]:SecondResponse:response=100||207_232_1_199_251_198_
225_247_193_237_217_209_14_203_234_202_236_4_192_236_219_209 _245_202_239_201_230_251_192_254_218_209_10_251_243_191_167_ 193_249_252_196_182_12_249_254_203_236_8_248_252_206_236_14_ 251_251_201_||205_178_212_188_142_137_160_0_133_188_187_161_ 0_186_138_191_179_219_188_142_137_191_219_177_181_187_229_22 3_187_177_221_189_222_188_138_140_182_194_181_226_251_225_25 1_180_142_138_182_6_245_255_212_160_200_182_202_200_221_196_ 135_139_251_225_251_190_140_187_242_7_214_179_185_178_208_19 0_176_200_180_201_133_166_191_165_26_250_235_140_176_218_175 _179_141_225_208_128_186_135_182_195_175_254_189_230_3_187_1 84_180_232_12_
[09.08 04:17:29]:RightUrl=/eclass/user/readflashfile.jsp?filename=
%2Fdata1%2Fswf%2Fswf%2Fnce%2Fnce_no2_xuyan%2Fnce_
no2_xuyan_1_1.swf
[09.08 04:17:29]:=============Request Header=============
[09.08 04:17:29]:[url]www.tol24.com[/url]
[09.08 04:17:29]:JSESSIONID=07682B9DCB9CE4738CEBDBB3
;sso.ssoId=1bb88fa0e81bae1b03e93449
[09.08 04:17:31]:=============ResponseHeader=============
[09.08 04:17:31]:1.1 ISA2004-2, 1.1 ISA2004-1
[09.08 04:17:31]:Keep-Alive
[09.08 04:17:31]:Keep-Alive
[09.08 04:17:31]:1392244
[09.08 04:17:31]:Thu, 01 Jan 1970 00:00:00 GMT
[09.08 04:17:31]:Fri, 08 Sep 2006 08:11:19 GMT
[09.08 04:17:31]:application/x-shockwave-flash;charset=UTF-8
[09.08 04:17:31]:Apache
[09.08 04:17:31]:no-cache,no-store,must-revalidate
[09.08 04:17:31]:no-cache
[09.08 04:17:31]:no-cache
[09.08 04:17:31]:timeout=15, max=97
[09.08 04:17:31]:Download Successful!
[09.08 04:17:31]:SwfFile Download Successfully!
顶
后一篇 >我的心里面，留下了一滴眼泪。