漏洞 CVENO 检索样本查询

#!/usr/bin/env bash
set -euo pipefail

APPID=""  # apikey
SECRET=""  # salt
URL="https://api.f.360.cn/files/std/internal/v2/cveno2md5"
BODY='{"query":{"keywords":[{"field":"cve_no","value":"CVE-1999-0009"},{"field":"limit","value":"10"}]}}'

NONCE=$(printf '%08d' $((RANDOM % 100000000)))
TIMESTAMP=$(date +%s)
BODY_MD5=$(printf '%s' "$BODY" | openssl dgst -md5 -hex | awk '{print $NF}')
SIGNATURE=$(printf '%s' "${BODY_MD5}${APPID}${NONCE}${TIMESTAMP}${SECRET}" | openssl dgst -md5 -hex | awk '{print $NF}')
SIGNATURE=${SIGNATURE:16}

curl --location --request POST "$URL" \
  --header "Content-Type: application/json" \
  --header "X-360-Key: ${APPID}" \
  --header "X-360-Nonce: ${NONCE}" \
  --header "X-360-Timestamp: ${TIMESTAMP}" \
  --header "X-360-Signature: ${SIGNATURE}" \
  --data "${BODY}"

# -*- coding:utf-8 -*—

import hashlib
import json
import random
import time

import requests

APPID = ""  # apikey
SECRET = ""  # salt


def make_headers(appid, secret, body):
    headers = {}
    headers["X-360-Key"] = appid
    headers["X-360-Nonce"] = str(random.randint(0, 99999999)).zfill(8)
    headers["X-360-Timestamp"] = str(int(time.time()))

    s = (
        hashlib.md5(body.encode("utf8")).hexdigest()
        + headers["X-360-Key"]
        + headers["X-360-Nonce"]
        + headers["X-360-Timestamp"]
        + secret
    )
    md5 = hashlib.md5(s.encode("utf8")).hexdigest()
    headers["X-360-Signature"] = md5[16:]
    headers["Content-Type"] = "application/json"
    return headers


def do_post(url, body):
    res = requests.post(
        url,
        data=json.dumps(params),
        headers=make_headers(APPID, SECRET, json.dumps(body)),
    )
    print("http status code: ", res.status_code)
    print(res.text)


if __name__ == "__main__":
    # 请求地址
    url = "https://api.f.360.cn/files/std/internal/v2/cveno2md5"

    params = {
        "query": {
            "keywords": [
                {"field": "cve_no", "value": "CVE-1999-0009"},
                {"field": "limit", "value": "10"},
            ]
        }
    }
    do_post(url, params)

import java.net.URI;
import java.net.http.HttpClient;
import java.net.http.HttpRequest;
import java.net.http.HttpResponse;
import java.nio.charset.StandardCharsets;
import java.security.MessageDigest;
import java.util.concurrent.ThreadLocalRandom;

public class Demo {
    static String md5(String input) throws Exception {
        byte[] digest = MessageDigest.getInstance("MD5")
                .digest(input.getBytes(StandardCharsets.UTF_8));
        StringBuilder sb = new StringBuilder();
        for (byte b : digest) {
            sb.append(String.format("%02x", b & 0xff));
        }
        return sb.toString();
    }

    public static void main(String[] args) throws Exception {
        String appid = ""; // apikey
        String secret = ""; // salt
        String url = "https://api.f.360.cn/files/std/internal/v2/cveno2md5";
        String body = "{\"query\":{\"keywords\":[{\"field\":\"cve_no\",\"value\":\"CVE-1999-0009\"},{\"field\":\"limit\",\"value\":\"10\"}]}}";

        String nonce = String.format("%08d", ThreadLocalRandom.current().nextInt(100000000));
        String timestamp = String.valueOf(System.currentTimeMillis() / 1000);
        String signature = md5(md5(body) + appid + nonce + timestamp + secret).substring(16);

        HttpRequest request = HttpRequest.newBuilder()
                .uri(URI.create(url))
                .header("Content-Type", "application/json")
                .header("X-360-Key", appid)
                .header("X-360-Nonce", nonce)
                .header("X-360-Timestamp", timestamp)
                .header("X-360-Signature", signature)
                .POST(HttpRequest.BodyPublishers.ofString(body, StandardCharsets.UTF_8))
                .build();

        HttpClient client = HttpClient.newHttpClient();
        HttpResponse<String> response = client.send(
                request, HttpResponse.BodyHandlers.ofString(StandardCharsets.UTF_8));
        System.out.println(response.body());
    }
}

<?php

// apikey
$appid = "";
// salt
$secret = "";
$url = 'https://api.f.360.cn/files/std/internal/v2/cveno2md5';
$body = json_encode([
    'query' => [
        'keywords' => [
            ['field' => 'cve_no', 'value' => 'CVE-1999-0009'],
            ['field' => 'limit', 'value' => '10'],
        ],
    ],
], JSON_UNESCAPED_UNICODE | JSON_UNESCAPED_SLASHES);

$nonce = str_pad((string) random_int(0, 99999999), 8, "0", STR_PAD_LEFT);
$timestamp = (string) time();
$signature = substr(md5(md5($body) . $appid . $nonce . $timestamp . $secret), 16);

$ch = curl_init($url);
$options = [
    CURLOPT_RETURNTRANSFER => true,
    CURLOPT_HTTPHEADER => [
        "Content-Type: application/json",
        "X-360-Key: {$appid}",
        "X-360-Nonce: {$nonce}",
        "X-360-Timestamp: {$timestamp}",
        "X-360-Signature: {$signature}",
    ],
];
$options[CURLOPT_POST] = true;
$options[CURLOPT_POSTFIELDS] = $body;
curl_setopt_array($ch, $options);

$response = curl_exec($ch);
if ($response === false) {
    echo curl_error($ch), PHP_EOL;
} else {
    echo $response, PHP_EOL;
}
curl_close($ch);

package main

import (
	"bytes"
	"crypto/md5"
	"encoding/hex"
	"fmt"
	"io"
	"math/rand"
	"net/http"
	"time"
)

func md5Hex(s string) string {
	sum := md5.Sum([]byte(s))
	return hex.EncodeToString(sum[:])
}

func main() {
	appid := ""  // apikey
	secret := "" // salt
	url := "https://api.f.360.cn/files/std/internal/v2/cveno2md5"
	body := []byte(`{"query":{"keywords":[{"field":"cve_no","value":"CVE-1999-0009"},{"field":"limit","value":"10"}]}}`)

	nonce := fmt.Sprintf("%08d", rand.Intn(100000000))
	timestamp := fmt.Sprintf("%d", time.Now().Unix())
	signature := md5Hex(md5Hex(string(body)) + appid + nonce + timestamp + secret)[16:]

	req, err := http.NewRequest(http.MethodPost, url, bytes.NewReader(body))
	if err != nil {
		panic(err)
	}
	req.Header.Set("Content-Type", "application/json")
	req.Header.Set("X-360-Key", appid)
	req.Header.Set("X-360-Nonce", nonce)
	req.Header.Set("X-360-Timestamp", timestamp)
	req.Header.Set("X-360-Signature", signature)

	resp, err := http.DefaultClient.Do(req)
	if err != nil {
		panic(err)
	}
	defer resp.Body.Close()

	respBody, err := io.ReadAll(resp.Body)
	if err != nil {
		panic(err)
	}
	fmt.Println(string(respBody))
}