[技术分析]了解12306购票流程

发表于 2013年01月23日
安全工具

1，2，3，零咯，几秒钟心仪的票票就被人抢完了，也不知道是不是人手一部传说中的抢票大杀器，针对上面的情况，所以写了下面的内容，如果分析不到位，欢迎大伙指正。

细节如下: 打开登录口

https://dynamic.12306.cn/otsweb/loginAction.do?method=init (网页版入口)
https://dynamic.12306.cn/otsweb/main.jsp (核心入口<------网页版入口)

1 2	https://dynamic.12306.cn/otsweb/loginAction.do?method=init (网页版入口) https://dynamic.12306.cn/otsweb/main.jsp (核心入口<------网页版入口)

通常,从12306页面上打开登录页面，地址是https://dynamic.12306.cn/otsweb/loginAction.do?method=init，访问该地址时，
加载很多链接.

1.登录

登录过程，需要下面条件:
—-验证码——- [GET]https://dynamic.12306.cn/otsweb/passCodeAction.do?rand=sjrand
—————验证码请求过程也可设置上面的cookie(如果上面未设定cookie)
—————构造HTTPS请求(假设只发包，会出现403提示)
—-随机数——- [GET]https://dynamic.12306.cn/otsweb/loginAction.do?method=loginAysnSuggest
—————随机数请求完成任务如下:
—————Set-Cookie: JSESSIONID=605B4539EA6825A9650AD6C383363E21; Path=/otsweb
—————Set-Cookie: BIGipServerotsweb=2480144650.62495.0000; path=/
—————随机数在登录时会用到，随意设置会引起”拒绝访问”
——本缓存服务器管理员：wssupport@chinanetcenter.com
——Via:hbts175:8361 (Cdn Cache Server V2.0)
——Generated Fri, 18 Jan 2013 07:05:07 GMT by cache.51cdn.com (Cdn Cache Server V2.0)—————正常访问，返回结果如下:
—————{“loginRand”:”754″,”randError”:”Y”}
—-登录验证——- [post] https://dynamic.12306.cn/otsweb/loginAction.do?method=login

整个登录过程如下:
A.先获取验证码
B.再获取随机号
C.POST提交-验证身份假设分开完成A,B,C请求，还能登录吗?
No.1 —— 验证码
No.2 —— 随机号
No.3 —— POST

熟悉HTTP/HTTPS协议，经常会看到Connection: keep-alive，12306在接受到数据之后，会返回数据给客户端.
如果只是单纯的提交而不接受，会提示403错误.

No.1 验证码(省略)
No.2 随机数（省略）
No.3 验证登录

https://dynamic.12306.cn/otsweb/loginAction.do?method=login
POST /otsweb/loginAction.do?method=login HTTP/1.1
Host: dynamic.12306.cn
User-Agent: Mozilla/5.0 (Windows NT 6.1; rv:18.0) Gecko/20100101 Firefox/18.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Referer: https://dynamic.12306.cn/otsweb/loginAction.do?method=init
Cookie: JSESSIONID=CF514F57D43032422C0587E1A89AD0E7; BIGipServerotsweb=2647916810.22560.0000; BIGipServerotsquery=2379809034.33825.0000
Connection: keep-alive
Content-Type: application/x-www-form-urlencoded
Content-Length: 163
loginRand=随机数&refundLogin=N&refundFlag=Y&loginUser.user_name=用户名&nameErrorFocus=&user.password=密码&passwordErrorFocus=&randCode=验证码&randErrorFocus=

https://dynamic.12306.cn/otsweb/loginAction.do?method=login

POST /otsweb/loginAction.do?method=login HTTP/1.1

Host: dynamic.12306.cn

User-Agent: Mozilla/5.0 (Windows NT 6.1; rv:18.0) Gecko/20100101 Firefox/18.0

Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8

Accept-Language: en-US,en;q=0.5

Accept-Encoding: gzip, deflate

Referer: https://dynamic.12306.cn/otsweb/loginAction.do?method=init

Cookie: JSESSIONID=CF514F57D43032422C0587E1A89AD0E7; BIGipServerotsweb=2647916810.22560.0000; BIGipServerotsquery=2379809034.33825.0000

Connection: keep-alive

Content-Type: application/x-www-form-urlencoded

Content-Length: 163

loginRand=随机数&refundLogin=N&refundFlag=Y&loginUser.user_name=用户名&nameErrorFocus=&user.password=密码&passwordErrorFocus=&randCode=验证码&randErrorFocus=

此处的cookie，在请求回去随机数/验证码时生成（服务器返回set-cookie响应）.
POST提交的参数如下:

POST https://dynamic.12306.cn/otsweb/loginAction.do?method=login
loginRand=522               // 随机数
&refundLogin=N             // 是否退票登录
&refundFlag=Y               // 标识符号
&loginUser.user_name=USERNAME     // 登录名
&nameErrorFocus=
&user.password=PASSWORD            // 登录密码
&passwordErrorFocus=
&randCode=MA3J                            // 验证码
&randErrorFocus=

POST https://dynamic.12306.cn/otsweb/loginAction.do?method=login

loginRand=522 // 随机数

&refundLogin=N // 是否退票登录

&refundFlag=Y // 标识符号

&loginUser.user_name=USERNAME // 登录名

&nameErrorFocus=

&user.password=PASSWORD // 登录密码

&passwordErrorFocus=

&randCode=MA3J // 验证码

&randErrorFocus=

#################################################################

2.订票

订票过程:
No.1 —— 查询
—— 该过程生成参数ypInfoDetail(查看余票情况)—- (对比参数leftTicketStr)
ypInfoDetail—— 1*****32091*****00003*****0000 // 请看后面ypInfoDetail详解
1*****3209
1*****0000
3*****0000
leftTicketStr —–100685306510068500003014550000
1006853065
1006850000
3014550000
No.2 —— 预订
——–参数leftTicketStr — 判断是否能够订票
No.3 —— 提交购票人信息
——–参数leftTicketStr — 再次确认是否有票可购
订票过程中，核心就是参数leftTicketStr，因为这个参数决定是否有票可买.
No.2与No.3之间的时间间隔，往往就是购票失败的原因.

No.1 查询

http://dynamic.12306.cn/otsquery/query/queryRemanentTicketAction.do?method=queryLeftTicket
&orderRequest.train_date=2013-02-06
&orderRequest.from_station_telecode=BXP
&orderRequest.to_station_telecode=XXX       //目的地对应的telcode号码,例如:上海:AOH
&orderRequest.train_no=
&trainPassType=QB
&trainClass=QB%23D%23Z%23T%23K%23QT%23
&includeStudent=00
&seatTypeAndNum=
&orderRequest.start_time_str=00%3A00--24%3A00

http://dynamic.12306.cn/otsquery/query/queryRemanentTicketAction.do?method=queryLeftTicket

&orderRequest.train_date=2013-02-06

&orderRequest.from_station_telecode=BXP

&orderRequest.to_station_telecode=XXX //目的地对应的telcode号码,例如:上海:AOH

&orderRequest.train_no=

&trainPassType=QB

&trainClass=QB%23D%23Z%23T%23K%23QT%23

&includeStudent=00

&seatTypeAndNum=

&orderRequest.start_time_str=00%3A00--24%3A00

No.2 预定预定——选择车次

POST https://dynamic.12306.cn/otsweb/order/querySingleAction.do?method=submutOrderRequest
Host: dynamic.12306.cn
User-Agent: Mozilla/5.0 (Windows NT 6.1; rv:18.0) Gecko/20100101 Firefox/18.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Referer: https://dynamic.12306.cn/otsweb/order/querySingleAction.do?method=init
Cookie: JSESSIONID=0EDD19E0BDB7270959B2BF6A9B245227; BIGipServerotsweb=2647916810.22560.0000
Connection: keep-alive
Content-Type: application/x-www-form-urlencoded
Content-Length: 710

station_train_code=L417        // 车次号
&train_date=2013-02-06        // 购票日期
&seattype_num=                  // 座位号
&from_station_telecode=BJP    // BJP --- 代表北京西
&to_station_telecode=XXX       // XXX --- 目的地telecode
&include_student=00
&from_station_telecode_name=%E5%8C%97%E4%BA%AC%E8%A5%BF   // 北京西 ---- utf-8编码
&to_station_telecode_name=目的地              // 目的地  ---- utf-8编码
&round_train_date=2013-02-06                    // 购票日期
&round_start_time_str=00:00--24:00             // 购票时间段
&single_round_type=1
&train_pass_type=QB
&train_class_arr=QB#D#Z#T#K#QT#            // 查询列车类型(高铁/动车/普通客车/...)
&start_time_str=00:00--24:00
&lishi=14:46
&train_start_time=20:50
&trainno4=240000L41710
&arrive_time=11:36
&from_station_name=%E5%8C%97%E4%BA%AC   // 北京
&to_station_name=目的地                                     // 目的地  ---- utf-8编码
&from_station_no=01
&to_station_no=14
&ypInfoDetail=1*****32091*****00003*****0000      // 余票查询
&mmStr=4709F8281ADB1C9DED5ED5D80BDAC4B884B9B235E601C9CE11B273A5    // ???
&locationCode=P3

POST https://dynamic.12306.cn/otsweb/order/querySingleAction.do?method=submutOrderRequest

Host: dynamic.12306.cn

User-Agent: Mozilla/5.0 (Windows NT 6.1; rv:18.0) Gecko/20100101 Firefox/18.0

Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8

Accept-Language: en-US,en;q=0.5

Accept-Encoding: gzip, deflate

Referer: https://dynamic.12306.cn/otsweb/order/querySingleAction.do?method=init

Cookie: JSESSIONID=0EDD19E0BDB7270959B2BF6A9B245227; BIGipServerotsweb=2647916810.22560.0000

Connection: keep-alive

Content-Type: application/x-www-form-urlencoded

Content-Length: 710

station_train_code=L417 // 车次号

&train_date=2013-02-06 // 购票日期

&seattype_num= // 座位号

&from_station_telecode=BJP // BJP --- 代表北京西

&to_station_telecode=XXX // XXX --- 目的地telecode

&include_student=00

&from_station_telecode_name=%E5%8C%97%E4%BA%AC%E8%A5%BF // 北京西 ---- utf-8编码

&to_station_telecode_name=目的地 // 目的地 ---- utf-8编码

&round_train_date=2013-02-06 // 购票日期

&round_start_time_str=00:00--24:00 // 购票时间段

&single_round_type=1

&train_pass_type=QB

&train_class_arr=QB#D#Z#T#K#QT# // 查询列车类型(高铁/动车/普通客车/...)

&start_time_str=00:00--24:00

&lishi=14:46

&train_start_time=20:50

&trainno4=240000L41710

&arrive_time=11:36

&from_station_name=%E5%8C%97%E4%BA%AC // 北京

&to_station_name=目的地 // 目的地 ---- utf-8编码

&from_station_no=01

&to_station_no=14

&ypInfoDetail=1*****32091*****00003*****0000 // 余票查询

&mmStr=4709F8281ADB1C9DED5ED5D80BDAC4B884B9B235E601C9CE11B273A5 // ???

&locationCode=P3

^^^^^^^^^^^ypInfoDetail详解^^^^^^^^^^^
参考:http://www.v2ex.com/t/57909

ypInfoDetail=1*****32091*****00003*****0000
1*****3209  // 大于3000表示无座票，减去3000表示剩余票数
1*****0000  // (1-硬座;3-硬卧;4-软卧)
3*****0000  //

ypInfoDetail=1*****32091*****00003*****0000

1*****3209 // 大于3000表示无座票，减去3000表示剩余票数

1*****0000 // (1-硬座;3-硬卧;4-软卧)

3*****0000 //

提交信息，获取车票—-<点击预定按钮后，填写购票人信息>

https://dynamic.12306.cn/otsweb/order/confirmPassengerAction.do?method=checkOrderInfo&rand=验证码
org.apache.struts.taglib.html.TOKEN=d75216f6ac1412e41e7dc39b091dbbd3
&leftTicketStr=100685306510068500003014550000      // ypInfoDetail参数的详细版本.
&textfield=%E4%B8%AD%E6%96%87%E6%88%96%E6%8B%BC%E9%9F%B3%E9%A6%96%E5%AD%97%E6%AF%8D  // 中文或拼音首字母
&orderRequest.train_date=2013-02-06
&orderRequest.train_no=240000L41710
&orderRequest.station_train_code=L417         // 列车号
&orderRequest.from_station_telecode=BJP
&orderRequest.to_station_telecode=XXX        // 目的地telecode
&orderRequest.seat_type_code=
&orderRequest.ticket_type_order_num=
&orderRequest.bed_level_order_num=000000000000000000000000000000
&orderRequest.start_time=20%3A50
&orderRequest.end_time=11%3A36
&orderRequest.from_station_name=%E5%8C%97%E4%BA%AC
&orderRequest.to_station_name=目的地     // utf-8编码
&orderRequest.cancel_flag=1
&orderRequest.id_mode=Y
&passengerTickets=1%2Cundefined%2C1%2C姓名1%2C身份证号1%2C手机号%2CY  // 1,undefined,1,姓名(采用UTF-8编码),1,身份证号,手机号,Y
&oldPassengers=
&passenger_1_seat=1
&passenger_1_ticket=1
&passenger_1_name=姓名   // UTF8编码
&passenger_1_cardtype=1  // 认证卡类型:-一般为身份证
&passenger_1_cardno=身份证号
&passenger_1_mobileno=手机号
&checkbox9=Y
&oldPassengers=
&checkbox9=Y
&oldPassengers=
&checkbox9=Y
&oldPassengers=
&checkbox9=Y&oldPassengers=
&checkbox9=Y&
randCode=8UAR
&orderRequest.reserve_flag=A
&tFlag=dc

https://dynamic.12306.cn/otsweb/order/confirmPassengerAction.do?method=checkOrderInfo&rand=验证码

org.apache.struts.taglib.html.TOKEN=d75216f6ac1412e41e7dc39b091dbbd3

&leftTicketStr=100685306510068500003014550000 // ypInfoDetail参数的详细版本.

&textfield=%E4%B8%AD%E6%96%87%E6%88%96%E6%8B%BC%E9%9F%B3%E9%A6%96%E5%AD%97%E6%AF%8D // 中文或拼音首字母

&orderRequest.train_date=2013-02-06

&orderRequest.train_no=240000L41710

&orderRequest.station_train_code=L417 // 列车号

&orderRequest.from_station_telecode=BJP

&orderRequest.to_station_telecode=XXX // 目的地telecode

&orderRequest.seat_type_code=

&orderRequest.ticket_type_order_num=

&orderRequest.bed_level_order_num=000000000000000000000000000000

&orderRequest.start_time=20%3A50

&orderRequest.end_time=11%3A36

&orderRequest.from_station_name=%E5%8C%97%E4%BA%AC

&orderRequest.to_station_name=目的地 // utf-8编码

&orderRequest.cancel_flag=1

&orderRequest.id_mode=Y

&passengerTickets=1%2Cundefined%2C1%2C姓名1%2C身份证号1%2C手机号%2CY // 1,undefined,1,姓名(采用UTF-8编码),1,身份证号,手机号,Y

&oldPassengers=

&passenger_1_seat=1

&passenger_1_ticket=1

&passenger_1_name=姓名 // UTF8编码

&passenger_1_cardtype=1 // 认证卡类型:-一般为身份证

&passenger_1_cardno=身份证号

&passenger_1_mobileno=手机号

&checkbox9=Y

&oldPassengers=

&checkbox9=Y

&oldPassengers=

&checkbox9=Y

&oldPassengers=

&checkbox9=Y&oldPassengers=

&checkbox9=Y&

randCode=8UAR

&orderRequest.reserve_flag=A

&tFlag=dc

填写完购票人信息，系统会借测是否有票可购

https://dynamic.12306.cn/otsweb/order/confirmPassengerAction.do?method=getQueueCount
&train_date=2013-02-06
&train_no=240000L41710
&station=L417
&seat=1
&from=BJP&to=XXX    // 目的地telecode
&ticket=100685306510068500003014550000   // 对比ypInfoDetail 最后一步，确认购票
https://dynamic.12306.cn/otsweb/order/confirmPassengerAction.do?method=confirmSingleForQueueOrder
org.apache.struts.taglib.html.TOKEN=d75216f6ac1412e41e7dc39b091dbbd3
&leftTicketStr=100685306510068500003014550000        // 多次出现.
&textfield=%E4%B8%AD%E6%96%87%E6%88%96%E6%8B%BC%E9%9F%B3%E9%A6%96%E5%AD%97%E6%AF%8D
&orderRequest.train_date=2013-02-06
&orderRequest.train_no=240000L41710
&orderRequest.station_train_code=L417
&orderRequest.from_station_telecode=BJP
&orderRequest.to_station_telecode=XXX
&orderRequest.seat_type_code=
&orderRequest.ticket_type_order_num=
&orderRequest.bed_level_order_num=000000000000000000000000000000
&orderRequest.start_time=20%3A50
&orderRequest.end_time=11%3A36
&orderRequest.from_station_name=%E5%8C%97%E4%BA%AC
&orderRequest.to_station_name=目的地名UTF8编码
&orderRequest.cancel_flag=1
&orderRequest.id_mode=Y
&passengerTickets=1%2Cundefined%2C1%2C姓名1%2C身份证号1%2C手机号%2CY  // 1,undefined,1,姓名(采用UTF-8编码),1,身份证号,手机号,Y
&oldPassengers=
&passenger_1_seat=1
&passenger_1_ticket=1
&passenger_1_name=订票人姓名(可为他人订票)
&passenger_1_cardtype=1
&passenger_1_cardno=订票人身份证号(对应)
&passenger_1_mobileno=订票人手机号(对应)
&checkbox9=Y
&oldPassengers=
&checkbox9=Y
&oldPassengers=
&checkbox9=Y
&oldPassengers=
&checkbox9=Y
&oldPassengers=
&checkbox9=Y
&randCode=8UAR
&orderRequest.reserve_flag=A