vercel 安全检测逆向 x-vercel-challenge-solution

声明:

本文章中所有内容仅供学习交流使用，不用于其他任何目的，抓包内容、敏感网址、数据接口等均已做脱敏处理，严禁用于商业用途和非法用途，否则由此产生的一切后果均与作者无关！
部分python代码

def get_headers_via_subprocess(token):
    """
    通过 subprocess 调用 Node.js 脚本获取 headers
    """
    try:
        # 运行 Node.js 脚本
        result = subprocess.run(
            ['node', 'run.js', token],
            capture_output=True,
            text=True,
            timeout=30  # 设置超时
        )

        # 检查执行结果
        if result.returncode == 0:
            # 解析 JSON 输出
            output = json.loads(result.stdout.strip())
            return output['result']
        else:
            print(f"Error: {result.stderr}")
            return None

    except subprocess.TimeoutExpired:
        print("Subprocess execution timed out")
        return None
    except Exception as e:
        print(f"Failed to execute subprocess: {e}")
        return None


solution = get_headers_via_subprocess(token)

print(solution)
status_code = self._submit_solution(url, token, solution)

base_url = url.rstrip('/')
self.session.headers.update({
    'accept': '*/*',
    'connection': 'keep-alive',
    'origin': base_url,
    'referer': f'{base_url}/.well-known/vercel/security/static/challenge.v2.min.js',
    'sec-fetch-dest': 'empty',
    'sec-fetch-mode': 'cors',
    'sec-fetch-site': 'same-origin',
    'x-vercel-challenge-solution': solution,
    'x-vercel-challenge-token': token,
    'x-vercel-challenge-version': '2',
})
response = self.session.post(f'{base_url}/.well-known/vercel/security/request-challenge')
return response.status_code

结果

总结