HTTP 数据包，发生了什么？

发布于 2024-08-23 06:57:24 字数 2998 浏览 7 评论 0 原文

基本上，我是在查看 Motorstorm 排行榜时在 PS3 上发送数据包。排行榜会以 XML 格式发送到我的 PS3，但只有在我获得授权后才会发送。那么有人可以告诉我这三个数据包之间发生了什么以及如何在浏览器中复制它吗？

数据包 1 从我的 PS3 到索尼服务器

POST /ranking_view/func/get_player_rank HTTP/1.1
Host: ranking-view-a01.u0.np.community.playstation.net
Connection: Keep-Alive
Content-Length: 213
Authorization: Digest username="c7y-ranking01", realm="c7y-ranking", nonce="2SpsV4WABAA=47a2b36030cd94de1190f6b9f05db1bd5584bc2a", uri="/ranking_view/func/get_player_rank", qop="auth", nc="00000001", cnonce="d4eb1eb60ab4efaea1476869d83a6e0b", response="96b55c6e79f84dd41b46eb66bed1c167"
Accept-Encoding: identity
User-Agent: PS3Community-agent/1.0.0 libhttp/1.0.0

<?xml version="1.0" encoding="utf-8"?><ranking platform="ps3" sv="3.15"><titleid>NPWR00012_00</titleid><board>7</board><jid>[email protected]</jid><option message="false" info="false"/></ranking>

数据包 2 索尼服务器对我的 PS3 的响应

Date: Fri, 26 Feb 2010 19:06:12 GMT
WWW-Authenticate: Digest realm="c7y-ranking", nonce="a3PFl4WABAA=6d375259676ec79641448a8032a795b8e12ccae4", algorithm=MD5, stale=true, qop="auth"
Content-Length: 401
Keep-Alive: timeout=15, max=100
Connection: Keep-Alive
Content-Type: text/html; charset=iso-8859-1

<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN">
<html><head>
<title>401 Authorization Required</title>
</head><body>
<h1>Authorization Required</h1>
<p>This server could not verify that you
are authorized to access the document
requested.  Either you supplied the wrong
credentials (e.g., bad password), or your
browser doesn't understand how to supply
the credentials required.</p>
</body></html>

数据包 3 PS3 对索尼服务器的响应最后一个数据包

POST /ranking_view/func/get_player_rank HTTP/1.1
Host: ranking-view-a01.u0.np.community.playstation.net
Connection: Keep-Alive
Authorization: Digest username="c7y-ranking01", realm="c7y-ranking", nonce="a3PFl4WABAA=6d375259676ec79641448a8032a795b8e12ccae4", uri="/ranking_view/func/get_player_rank", qop="auth", nc="00000001", cnonce="58869490a891002d8c56573496274a3a", response="ca3d6f252d4e398b8f751c201a3f8f08"
Accept-Encoding: identity
User-Agent: PS3Community-agent/1.0.0 libhttp/1.0.0

<?xml version="1.0" encoding="utf-8"?><ranking platform="ps3" sv="3.15"><titleid>NPWR00012_00</titleid><board>7</board><jid>[email protected]</jid><option message="false" info="false"/></ranking>

我尝试在 Firefox 和篡改标头以及 PHP cURL 中复制此内容，但一无所获。我认为这与不断变化的 nonce、cnonce 和 responce 变量有关。请帮忙=）

原文

basically, i was wiresharking packets on my PS3 while viewing Motorstorm Leaderboards. The leaderboards are sent to my ps3 in XML format but only after i have been authorised. So can someone please tell me what is happening between these three packets and how i could replicate it in a browser?

Packet 1 From my PS3 to Sony Servers

POST /ranking_view/func/get_player_rank HTTP/1.1
Host: ranking-view-a01.u0.np.community.playstation.net
Connection: Keep-Alive
Content-Length: 213
Authorization: Digest username="c7y-ranking01", realm="c7y-ranking", nonce="2SpsV4WABAA=47a2b36030cd94de1190f6b9f05db1bd5584bc2a", uri="/ranking_view/func/get_player_rank", qop="auth", nc="00000001", cnonce="d4eb1eb60ab4efaea1476869d83a6e0b", response="96b55c6e79f84dd41b46eb66bed1c167"
Accept-Encoding: identity
User-Agent: PS3Community-agent/1.0.0 libhttp/1.0.0

<?xml version="1.0" encoding="utf-8"?><ranking platform="ps3" sv="3.15"><titleid>NPWR00012_00</titleid><board>7</board><jid>[email protected]</jid><option message="false" info="false"/></ranking>

Packet 2 Sony Server Response to my PS3

Date: Fri, 26 Feb 2010 19:06:12 GMT
WWW-Authenticate: Digest realm="c7y-ranking", nonce="a3PFl4WABAA=6d375259676ec79641448a8032a795b8e12ccae4", algorithm=MD5, stale=true, qop="auth"
Content-Length: 401
Keep-Alive: timeout=15, max=100
Connection: Keep-Alive
Content-Type: text/html; charset=iso-8859-1

<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN">
<html><head>
<title>401 Authorization Required</title>
</head><body>
<h1>Authorization Required</h1>
<p>This server could not verify that you
are authorized to access the document
requested.  Either you supplied the wrong
credentials (e.g., bad password), or your
browser doesn't understand how to supply
the credentials required.</p>
</body></html>

Packet 3 PS3 response to Sony Servers last packet

POST /ranking_view/func/get_player_rank HTTP/1.1
Host: ranking-view-a01.u0.np.community.playstation.net
Connection: Keep-Alive
Authorization: Digest username="c7y-ranking01", realm="c7y-ranking", nonce="a3PFl4WABAA=6d375259676ec79641448a8032a795b8e12ccae4", uri="/ranking_view/func/get_player_rank", qop="auth", nc="00000001", cnonce="58869490a891002d8c56573496274a3a", response="ca3d6f252d4e398b8f751c201a3f8f08"
Accept-Encoding: identity
User-Agent: PS3Community-agent/1.0.0 libhttp/1.0.0

<?xml version="1.0" encoding="utf-8"?><ranking platform="ps3" sv="3.15"><titleid>NPWR00012_00</titleid><board>7</board><jid>[email protected]</jid><option message="false" info="false"/></ranking>

I tried to replicate this in Firefox and tamper headers as well as in PHP cURL but im getting nowhere. I assume it is to do with the nonce, cnonce and responce variables that keep changing >< please help =)

分享到QQ

分享到微博

如果你对这篇内容有疑问，欢迎到本站社区发帖提问参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。

发布评论

需要登录才能够评论，你可以免费注册一个本站的账号。

陪你到最终 2024-08-30 06:57:24

Nonce、cnonce等与HTTP Digest Authentication相关，它是一种认证机制，可以实现无需以明文形式发送密码即可进行身份验证。因此，如果您想在 PS3 游戏中作弊，我想您首先必须从 MD5 哈希值中破解该密码。

它不称为 HTTP 数据包，在第 7 层，您通常会说请求/响应或类似的。

回复收藏 0 原文

凹づ凸ル 2024-08-30 06:57:24

随机数 nonce 和 cnonce 看起来像哈希码。

针对作弊者的一种可能的防御机制可能是这样的：

def ps3client_send_score():
    score = "bazillion points"
    nonce = md5(score + "something you don't know about")
    send_to_server(score, nonce)

在服务器端：

def get_client_score(score, nonce):
    if md5(score+"something you don't know about")==nonce:
        accept_score(score)
    else:
        reject_score_and_ban_the_fool_if_he_continues_this()

因此，除非您想花数周时间尝试查找盐深入你的游戏，忘记它吧。

The nonce an nonce and cnonce look like hash codes.

One possible defense mechanism against cheaters could be this:

def ps3client_send_score():
    score = "bazillion points"
    nonce = md5(score + "something you don't know about")
    send_to_server(score, nonce)

On the server side:

def get_client_score(score, nonce):
    if md5(score+"something you don't know about")==nonce:
        accept_score(score)
    else:
        reject_score_and_ban_the_fool_if_he_continues_this()

So unless you want to spend weeks trying to find the salt deep in your game, forget it.

回复收藏 0 原文

~没有更多了~