#!/usr/bin/env python3
"""00-lab-target.py — 本地靶站：JS 动态渲染 + 验证码登录（真机实验台）
为什么不用真实网站做实验：
1. 真实站点会限流、封 IP，实验不可复现；
2. 无法控制"渲染延迟 / 验证码难度 / 失败率"，测出来的数字无法解释；
3. 抓别人的验证码有法律风险。
靶站是自建的，所以每个数字都可信、可复现、可回归。
页面里刻意埋了 4 个"静态抓不到"的点：
· 商品列表由 fetch 在 700ms 后注入（静态 HTML 里只有一个空 ）
· #status 由 MutationObserver 之外的 JS 定时器改写
· 指纹字段（canvas / WebGL / 时区 / 字体）全部在客户端计算
· 登录必须带验证码，验证码一次性、绑定 sid
用法：
python3 00-lab-target.py --port 8931 # 起服务
python3 00-lab-target.py --self-test # 离线自检，不需要浏览器
"""
from __future__ import annotations
import argparse
import json
import os
import random
import signal
import sys
import threading
import time
import uuid
from http.server import BaseHTTPRequestHandler, ThreadingHTTPServer
from pathlib import Path
from urllib.parse import parse_qs, urlparse
sys.path.insert(0, str(Path(__file__).resolve().parent))
from captcha_lib import random_text, render_captcha # noqa: E402
ITEMS = [
{"id": i, "title": f"SKU-{1000 + i} 动态渲染商品", "price": round(19.9 + i * 3.7, 2)}
for i in range(1, 13)
]
SESSIONS: dict[str, str] = {} # sid -> 验证码答案（一次性）
STATS = {"captcha_served": 0, "login_ok": 0, "login_fail": 0, "items_served": 0}
LOCK = threading.Lock()
INDEX_HTML = """
Day193 靶站
Day 193 动态靶站
booting…
客户端指纹
computing…
验证码
"""
class Handler(BaseHTTPRequestHandler):
server_version = "Day193Lab/1.0"
def log_message(self, fmt, *args): # 静默，实验输出才看得清
pass
def _send(self, code: int, body: bytes | str, ctype: str = "text/html; charset=utf-8", cookies: list[str] | None = None):
if isinstance(body, str):
body = body.encode()
self.send_response(code)
self.send_header("Content-Type", ctype)
self.send_header("Content-Length", str(len(body)))
for c in cookies or []:
self.send_header("Set-Cookie", c)
self.end_headers()
self.wfile.write(body)
def do_GET(self):
u = urlparse(self.path)
q = parse_qs(u.query)
if u.path in ("/", "/index.html"):
self._send(200, INDEX_HTML.encode())
elif u.path == "/health":
self._send(200, json.dumps({"ok": True, **STATS}).encode(), "application/json")
elif u.path == "/api/items":
ds = min(int(q.get("ds", ["0"])[0]), 5000) / 1000
if ds:
time.sleep(ds) # 人为延迟，用来测"等待策略"
page = int(q.get("page", ["1"])[0])
with LOCK:
STATS["items_served"] += 1
self._send(200, json.dumps({"page": page, "items": ITEMS, "server_time": time.time()}).encode(),
"application/json")
elif u.path == "/captcha":
sid = uuid.uuid4().hex[:16]
text = random_text(4)
with LOCK:
SESSIONS[sid] = text
STATS["captcha_served"] += 1
if len(SESSIONS) > 5000: # 防止内存无限涨
for k in list(SESSIONS)[:1000]:
SESSIONS.pop(k, None)
png = Path("/tmp/day193-captcha.png")
render_captcha(text, noise="medium", seed=random.randrange(10**6)).save(png, "PNG")
cookie = f"sid={sid}; Path=/; HttpOnly"
self._send(200, png.read_bytes(), "image/png", [cookie])
else:
self._send(404, b"not found")
def do_POST(self):
if urlparse(self.path).path != "/login":
self._send(404, b"not found")
return
n = int(self.headers.get("Content-Length", 0))
raw = self.rfile.read(n)
try:
data = json.loads(raw or b"{}")
except json.JSONDecodeError:
data = {}
sid = ""
for part in (self.headers.get("Cookie") or "").split(";"):
if part.strip().startswith("sid="):
sid = part.strip()[4:]
expected = SESSIONS.pop(sid, None) # 一次性：无论对错都作废
ok = bool(expected) and str(data.get("answer", "")).upper() == expected
with LOCK:
STATS["login_ok" if ok else "login_fail"] += 1
self._send(200 if ok else 403,
json.dumps({"ok": ok, "reason": "ok" if ok else ("no_sid" if expected is None else "wrong")}),
"application/json")
def serve(port: int):
srv = ThreadingHTTPServer(("127.0.0.1", port), Handler)
print(f"靶站已启动 http://127.0.0.1:{port}/ (Ctrl-C 停止)")
try:
srv.serve_forever()
except KeyboardInterrupt:
pass
finally:
srv.shutdown()
print("已停止")
def self_test() -> int:
"""离线自检：起临时端口 → 打 4 个接口 → 断言 → 关闭。不需要浏览器。"""
import urllib.request
srv = ThreadingHTTPServer(("127.0.0.1", 0), Handler)
port = srv.server_address[1]
threading.Thread(target=srv.serve_forever, daemon=True).start()
base = f"http://127.0.0.1:{port}"
fails = 0
def check(name, cond, extra=""):
nonlocal fails
print((" ✅ " if cond else " ❌ ") + name + (f" {extra}" if extra else ""))
fails += 0 if cond else 1
try:
t0 = time.time()
html = urllib.request.urlopen(base + "/", timeout=5).read().decode()
check("首页返回 HTML 且含空列表骨架", "