如何绕过爱企查的百度安全验证

[zp857]

1、使用 chromedp 时默认不会触发验证

2、使用 rod 无法绕过验证（尝试添加 stealth.JS 也不行）


3、直接手动打开 chromium 测试不会触发验证

想问问大家有什么绕过办法或者研究思路

[ysmood]

你可以用这个打印启动参数：

rod/lib/launcher/launcher.go

Line 347 in 0340433

func (l *Launcher) FormatArgs() []string {

对比 rod 和 chromedp 的差别就知道了。

然后搜索下 user-agent 的 issue

[zp857]

抱歉现在才回复您，前段时间比较忙没时间研究，刚刚看了下。
1、对比 rod 和 chromedp 的差别，修改 rod 启动参数并使其完全一致

[--disable-background-networking --disable-background-timer-throttling --disable-backgrounding-occluded-windows --disable-breakpad --disable-client-side-phishing-detection --disable-default-apps --disable-dev-shm-usage --disable-extensions --disable-features=site-per-process,Translate,BlinkGenPropertyTrees --disable-hang-monitor --disable-ipc-flooding-protection --disable-popup-blocking --disable-prompt-on-repost --disable-renderer-backgrounding --disable-sync --enable-automation --enable-features=NetworkService,NetworkServiceInProcess --force-color-profile=srgb --hide-scrollbars --ignore-certificate-errors --metrics-recording-only --mute-audio --no-default-browser-check --no-first-run --password-store=basic --remote-debugging-port=0 --safebrowsing-disable-auto-update --use-mock-keychain --user-data-dir=C:\Users\yuan\AppData\Local\Temp\chromedp-runner2995279764 about:blank]

其中最后的 about:blank 因为不带 -- 所以在 rod 中先手动添加

[--disable-background-networking --disable-background-timer-throttling --disable-backgrounding-occluded-windows --disable-breakpad --disable-client-side-phishing-detection --disable-default-apps --disable-dev-shm-usage --disable-extensions --disable-features=site-per-process,TranslateUI,BlinkGenPropertyTrees --disable-hang-monitor --disable-ipc-flooding-protection --disable-popup-blocking --disable-prompt-on-repost --disable-renderer-backgrounding --disable-sync --enable-automation --enable-features=NetworkService,NetworkServiceInProcess --force-color-profile=srgb --hide-scrollbars --ignore-certificate-errors --metrics-recording-only --mute-audio --no-default-browser-check --no-first-run --password-store=basic --remote-debugging-port=0 --safebrowsing-disable-auto-update --use-mock-keychain --user-data-dir=C:\Users\yuan\AppData\Local\Temp\rod\user-data\db850c11844fcd69]
2、抓包分析，一个 200，一个 302，数据包可以重放，通过设置 header 使其除 cookie 外的 header 完全一致，仍无法绕过，应该是前面存在检测然后检测结果存入了 cookie
chromedp => 200

GET /s?q=123&t=0 HTTP/1.1
Host: aiqicha.baidu.com
Cookie: BAIDUID=F3E51D716F699C8769CF08C0CCFD973E:FG=1; BAIDUID_BFESS=F3E51D716F699C8769CF08C0CCFD973E:FG=1; ab171256320=e27c0cb2bce6822f1485a842037fafba17125663924a9; Hm_lvt_ad52b306e1ae4557f5d3534cce8f8bbf=1712566393; Hm_lpvt_ad52b306e1ae4557f5d3534cce8f8bbf=1712566393; log_guid=2e74a15df66fa40a3d0ff652cf66ce56; log_first_time=1712566392789; ab_sr=1.0.1_YzE5NjEwZmVkNjBmYjU2MTg5MjdmYzk0Mjg0YmJlMDk4NTI3NGQxYmRmNzAwMDc1YWE5ZTkyNWFlOTAwZTM2ZWIxNzAyZTU1ZGM2MzhkZjQxZDA1YWNhM2MzMDVhYjhmNGQ1ZjUwNjJhMGI2ZTljMzYwNWUwM2NmOWMzZDIwZDI1YzE2YjlkN2E5MGY2NmRhOTUyNjlhNTIxN2NkODg5OQ==; _s53_d91_=00aca5045a06bf47a9f694b3615df1ed0d4c4e4cf52f09946aa256cc1b53df465cb564059e4fce91fcf1bb116fe41da23797ef890a735ae8c6678641429ad0524bcdaf586c0cfd0883a5033c795dd800570f98fa6c02d0c7ad8c7e4650f20b9d441a0e4d987134d71af46bfb3fe55781526d6b88d1d8a4dd820d984bef112a9bee3d4b42b22a56d6dd663ccf7eb67809e7b13f37783b23d4e35e61abff654e85f3d638efaa9f1df0b4f4674b31643f8fc61e13ee7def06e53e98270bd1210179d12543528a0356aec7523e1e69945d189a400baf8f57815d91707549519652af; _j47_ka8_=57; _y18_s21_=7eddc197; log_last_time=1712566398406; RT="z=1&dm=baidu.com&si=27993b59-19aa-4ad6-ad2a-30ad01869cff&ss=luqpt8tr&sl=1&tt=21m&bcn=https%3A%2F%2Ffclog.baidu.com%2Flog%2Fweirwood%3Ftype%3Dperf&ld=2u8&ul=5ay"
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
Sec-Ch-Ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Sec-Ch-Ua-Mobile: ?0
Sec-Ch-Ua-Platform: "Windows"
Accept-Language: zh-CN,zh;q=0.9
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Sec-Fetch-Site: same-origin
Sec-Fetch-Mode: navigate
Sec-Fetch-User: ?1
Sec-Fetch-Dest: document
Referer: https://aiqicha.baidu.com/
Accept-Encoding: gzip, deflate
Connection: close

rod => 302

GET /s?q=123&t=0 HTTP/1.1
Host: aiqicha.baidu.com
Cookie: BAIDUID=434331D8A783D5CA95A6E2E277E8BF63:FG=1; BAIDUID_BFESS=434331D8A783D5CA95A6E2E277E8BF63:FG=1; ab171256680=e27c0cb2bce6822f1485a842037fafba17125673616a2; Hm_lvt_ad52b306e1ae4557f5d3534cce8f8bbf=1712567362; Hm_lpvt_ad52b306e1ae4557f5d3534cce8f8bbf=1712567362; log_guid=74c69a3c7d59387ccef9c047e5c59a15; log_first_time=1712567362204; ab_sr=1.0.1_MmE3N2I3ZGI1YWJiODVmMGFiYzFmZjhhYjdlOTY5NjZkMzhhN2MzOTgwNWEwNjUyODM2ZWEzODM1MjA4M2RmYzk1ZDY5MjI3MzRjZTZlNmFiMmFmZjdjYjU2MWEzYjYwMmJlZmI5YzA1YzBjYWU2ODZlZTU2NTlkMjJhN2U2MWVjOTZiNmY3MWYzZWJhYjdhODczYTFiZmYxZjgwOTg2Mg==; _s53_d91_=39f92fe2a7f7b984758929acec0481974e60e27e4ae1d9a1a4fe6afa8fd8fe5cc9a94f5adab5a753bd083f21a56ae67b34862cec7df08e57c78b7f7064c1d83258da692e0a05ce7dcbc20864b5ed5ac08b5b25a39e9681db52805344c81e93e4a7702103731137bb7abeadced26bb8c820dbe6701a8db2ab6b87feaf8c8eb0dc674251533d086d98bf242118799b8ab493d47fc1082431ac16f0d98683bd216c6fd1540a6657e94a946742d9cbd1fc46f06f90eb441d9b9bfaa9868d6dfa4da2b14424bd240e8aa6732ae6d7a2b3c88b535996132f6d7e707027b4f21ee8036f; _j47_ka8_=57; _y18_s21_=e10d2328; log_last_time=1712567362776; RT="z=1&dm=baidu.com&si=a4c10a21-3f91-4622-9047-f2964b7f01fa&ss=luqqe0mk&sl=0&tt=0&bcn=https%3A%2F%2Ffclog.baidu.com%2Flog%2Fweirwood%3Ftype%3Dperf&ul=1m6"
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
Sec-Ch-Ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Sec-Ch-Ua-Mobile: ?0
Sec-Ch-Ua-Platform: "Windows"
Accept-Language: zh-CN,zh;q=0.9
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Sec-Fetch-Site: same-origin
Sec-Fetch-Mode: navigate
Sec-Fetch-User: ?1
Sec-Fetch-Dest: document
Referer: https://aiqicha.baidu.com/
Accept-Encoding: gzip, deflate
Connection: close

想问问还有啥思路，抱拳了.jpg

[zp857]

已解决，#779

[zp857]

虽然通过上面的办法绕过了百度安全验证，但是没有找到根本原因，还是重新打开讨论吧