破解Trello登录协议

前言

大部分公司都会给码农们安排一项每天必做的任务，那就是日报。有发邮件的、用trello的、用worktile（国内山寨版trello）等其他项目工具的。

随着微信红包的普及笔者所在的项目组不及时写日报也要发红包了。规则很简单每天23点之前没有在trello上填写当日的日报就要在项目组微信群内发20块钱的红包。

山

是山的影子

狗

懒得进化

夏天

人的酶很固执

灵魂的酶像荷花

——《路边野餐》

一日午觉后，一个想法出现在了心中，可以做一个工具定时每天22:30的时候扫一遍trello看看哪些小伙们的日报还没有写，然后发短信通知他们。那么首当其冲就是要搞清楚trello的登录校验逻辑，遂有了此文。

进入正题~

打开Trello登录页面 https://trello.com/login

开启Chrome开发者工具

勾上Preserve log(不勾上，当页面跳转后之前页面的网络请求日志会被清掉)

如下图

成功登录后到Welcome Board

以Welcome Board为例

抓到请求获取数据的接口地址

https://trello.com/1/Boards/5KY1I4QJ?lists=open&cards=visible&card_attachments=cover&card_stickers=true&card_fields=badges%2Cclosed%2CdateLastActivity%2Cdesc%2CdescData%2Cdue%2CidAttachmentCover%2CidList%2CidBoard%2CidMembers%2CidShort%2CidLabels%2Cname%2Cpos%2CshortUrl%2CshortLink%2Csubscribed%2Curl%2Clabels&card_checklists=none&members=all&member_fields=fullName%2Cinitials%2CmemberType%2Cusername%2CavatarHash%2Cbio%2CbioData%2Cconfirmed%2Cproducts%2Curl%2Cstatus&membersInvited=all&membersInvited_fields=fullName%2Cinitials%2CmemberType%2Cusername%2CavatarHash%2Cbio%2CbioData%2Cconfirmed%2Cproducts%2Curl&memberships_orgMemberType=true&checklists=none&organization=true&organization_fields=name%2CdisplayName%2Cdesc%2CdescData%2Curl%2Cwebsite%2Cprefs%2Cmemberships%2ClogoHash%2Cproducts&myPrefs=true&fields=name%2Cclosed%2CdateLastActivity%2CdateLastView%2CidOrganization%2Cprefs%2CshortLink%2CshortUrl%2Curl%2Cdesc%2CdescData%2Cinvitations%2Cinvited%2ClabelNames%2Cmemberships%2Cpinned%2CpowerUps%2Csubscribed

接下来用Paw来尝试请求

意料之中返回401，header中没加授权信息是肯定不行滴

授权信息一般都是存在cookies里面，那么到chrome中找到请求这个接口的cookie

cookie:
__qca=P0-1593696850-1468204008719;
mab=56c3d4635bb906467b8d3b7c; 
hsfirstvisit=https%3A%2F%2Ftrello.com%2Flogged-out|https%3A%2F%2Ftrello.com%2F|1470972765622; 
lang=zh-CN; 
dsc=ec5a4132373a500487514ee1e6fd6ef40b5456283e512841026d16a8639951cb; 
__leadinmigrated=1; 
__leadinutk=ee14b39f2824ae1221e4582c81e468d9; 
__hstc=183819321.ee14b39f2824ae1221e4582c81e468d9.1470972765624.1471414624578.1471424173893.4; 
__hssrc=1; 
hubspotutk=ee14b39f2824ae1221e4582c81e468d9; 
token=56c3d4635bb906467b8d3b7c%2FunNor91IDg3STWzPAq7ETuozz6kOPIBOHx6HOdN1m62CvUshibAq3ZCAFClwdrHQ; 
hasAccount=password; 
_sp_id.dc4d=e2c0b466013c63ff.1468204012.39.1471426756.1471414838.715caf7e-ee7c-4f66-aa95-d4262ce0eba0; 
_sp_ses.dc4d=*; 
_ga=GA1.2.1122412242.1468204008

将cookie信息加到header中再用Paw尝试

成功请求到数据啦~

多次尝试发现cookies里面真正有用的参数只有token

token=56c3d4635bb906467b8d3b7c%2FunNor91IDg3STWzPAq7ETuozz6kOPIBOHx6HOdN1m62CvUshibAq3ZCAFClwdrHQ; 

那么接下来目标就清晰了，只要从登录接口获取到token之后就可以任意调接口拿数据了

获取Token

再回到登录页面，点击登录

看请求的接口，主要是两个authentication和session

分析这两个接口可以发现获取token的流程：

1. 用账号、密码请求接口获取code

2. 用code和一个随机数获取token

这里要注意cookie中的dsc和请求参数中的dsc要一致

最后从response headers中取出token就大功告成啦！😄

代码实现(NodeJS)

var superagent = require('superagent');
var uuid = require('node-uuid');

function authentication(username, password, cb) {
    superagent.post('https://trello.com/1/authentication')
        .send('method=' + 'password')
        .send('factors[user]=' + username)
        .send('factors[password]=' + password)
        .end(function (err, res) {
            console.log("response status:" + res.status);
            if (!err) {
                var code = JSON.parse(res.text).code;
                cb(code);
            }
        });
}

function session(code, dsc, cb) {
    superagent.post('https://trello.com/1/authorization/session')
        .set('Cookie', 'dsc=' + dsc)
        .send('authentication=' + code)
        .send('dsc=' + dsc)
        .end(function (err, res) {
            if (!err) {
                var cookie = res.headers['set-cookie'][0];
                cb(cookie);
            }
        })
}

function requestData(cookie, cb){
    superagent.get('https://trello.com/1/Boards/EAncSndA?lists=open&cards=visible&card_stickers=true&card_fields=desc,idList,name&card_checklists=none&members=all&member_fields=fullName,initials,memberType,username,avatarHash,bio,bioData,confirmed,products,url,status&membersInvited=all&membersInvited_fields=fullName,initials,memberType,username,avatarHash,bio,bioData,confirmed,products,url&memberships_orgMemberType=true&checklists=none&organization=true&organization_fields=name,displayName,desc,url,website,logoHash&myPrefs=true&fields=name,closed,dateLastActivity,dateLastView,idOrganization,prefs,shortLink,shortUrl,url,desc,descData,invitations,invited,labelNames,memberships,pinned,powerUps,subscribed')
        .set('Cookie', cookie)
        .end(function (err, res) {
            if(!err){
                cb(res.text)
            }
        })
}

module.exports = {
    requestData: function (username, password, cb) {
        var dsc = uuid.v4();
        authentication(username, password, function (code) {
            session(code, dsc, function (cookie) {
                requestData(cookie, function (data) {
                    cb(data);
                });
            })
        })
    }
}