Python 爬虫接口签名实战：参数签名 + 会话绑定（CH-005）

1
"""CH-005：答案 = 5 页共 50 个数字的总和（提交时带 uuid）
2

3
两个关键点：
4
  1. 签名 raw 是 f"/numbers|{page}|{timestamp}|{salt}"，**带前导斜杠**，结果是 sha256 的 hex
5
  2. 取数只认 uuid —— 这个 uuid 要先由页面（或你）调 /session 绑定到账号
6
     （绑定那次请求需要登录 Cookie，之后取数就不需要了）
7
"""
8
import hashlib
9
import time
10
import uuid as uuid_lib
11

12
import requests
13

14
BASE = "https://spider.jsnote.top"
15
BIND_URL = f"{BASE}/api/challenges/CH-005/session"
16
DATA_URL = f"{BASE}/api/challenges/CH-005/data"
17
ROUTE = "/numbers"                  # 签名里的路径，带前导斜杠
18
SALT = "XJ2026"
19
TOTAL_PAGES = 5
20

21
session = requests.Session()
22
session.headers.update({
23
    "Accept": "application/json, text/plain, */*",
24
    "Referer": f"{BASE}/numbers?challenge=CH-005",
25
    "User-Agent": (
26
        "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 "
27
        "(KHTML, like Gecko) Chrome/147.0.0.0 Safari/537.36"
28
    ),
29
})
30
# 只有「绑定 uuid」这一步需要登录态
31
session.cookies.set("session", "<把浏览器里的 session cookie 粘到这里>",
32
                    domain="spider.jsnote.top")
33

34

35
def sign(page: int, timestamp: str, salt: str = SALT) -> str:
36
    raw = f"{ROUTE}|{page}|{timestamp}|{salt}"
37

38
    # 如果你怎么算都是 403，先打出来对一下服务端那行的哈希：
39
    #   sha256("/numbers|1|1790936209983|XJ2026")
40
    #        = 3a03b48eda815c1a0fac05d817831fa9d2787e836b47d0cfdbf7431e5f8a2a21
41
    return hashlib.sha256(raw.encode()).hexdigest()
42

43

44
def bind_account():
45
    """生成 uuid 并绑定到当前账号；页面就是这么干的。"""
46
    uuid_value = str(uuid_lib.uuid4())
47
    response = session.post(BIND_URL, json={"uuid": uuid_value}, timeout=10)
48
    if response.status_code == 401:
49
        raise SystemExit("绑定失败：这一步需要登录 Cookie")
50
    response.raise_for_status()
51
    print("已绑定 uuid：", uuid_value, response.json())
52
    return uuid_value
53

54

55
def main():
56
    uuid_value = bind_account()
57

58
    total = 0
59
    for page in range(1, TOTAL_PAGES + 1):
60
        timestamp = str(int(time.time() * 1000))
61
        response = session.get(DATA_URL, params={
62
            "page": page,
63
            "uuid": uuid_value,
64
            "hash": sign(page, timestamp),
65
            "t": timestamp,
66
            "s": SALT,
67
        }, timeout=10)
68

69
        if response.status_code == 403:
70
            raise SystemExit(
71
                "403：签名不对。自查 ——\n"
72
                '  · raw 是 "/numbers|<page>|<timestamp>|<salt>"（带前导斜杠）\n'
73
                "  · 摘要是 sha256 的 hex（不是 Base64）\n"
74
                "  · uuid 得是绑定过的那个"
75
            )
76
        response.raise_for_status()
77

78
        numbers = response.json()["numbers"]
79
        total += sum(numbers)
80
        print(f"第 {page} 页：{numbers} → 累计 {total}")
81
        time.sleep(0.5)
82

83
    print(f"\n答案：{total}")
84
    print("提交时记得带上同一个 uuid："
85
          f'POST /api/challenges/CH-005/submit {{"answer": {total}, "uuid": "{uuid_value}"}}')
86

87

88
if __name__ == "__main__":
89
    main()