Parse Baidu search results link?url=parameter analysis (full)_PHP tutorial

A few days ago, I wrote an article about how to get the URL after Baidu jump. After searching on Baidu, someone also studied Baidu link?url=.

The following results are roughly obtained:

1. The encryption method is based on: random + input residence time + snapshot address for encryption
2. There should be three elements in the entire code Parts: 1. Time of search term; 2. Search keywords; 3. Randomly generated unique identification code.
3. In any environment or browser url = there is a similar code at the end
From the above results of other people's research, we can know that "there is a similar code at the end" is more usable, so we will start with this.
I searched for "enenba" and found that the URL of my first search result had the same code, which was
http://www.baidu.com/link?url=………… ebac5573358cc3c0659257bfcf54763ec1c5ecff3b3fbd1d4c
All search results have a piece of code ebac5573358cc3c0659257bfcf54 (found after searching N times)
The 763ec1c5ecff3b3fbd1d4c at the end looks like the search result Real URL. (It has been verified that it is the ciphertext of the real URL)
I verified it like this:
1. First search www.php100.com on Baidu
The first result link:
http://www. baidu.com/link?url=…………ebac5573358cc3c0659257bfcf546427d385fef6656de2404d6843da27
See the first few 6427d385fef6656de2404d6843da27
2. Search www.hao123.com on Baidu
First result link:
http: //www.baidu.com/link?url=…………ebac5573358cc3c0659257bfcf54 6427d385e6ff7a6de0434d6843da
See the first few 6427d385e6ff7a6de0434d6843da
……
After searching N websites many times, I found that the first few domain names Yes For "www.", the ciphertext is 6427d385
and www. is four characters, and the ciphertext 6427d385 is eight characters. You can know that two characters of the ciphertext are equal to one character of the URL.
So I wrote a php form query and got the ciphertext part for easy viewing later.
Publish the php source code:

Copy the code The code is as follows:

/*
getrealurl Get the URL address after 301 and 302 redirection by enenba.com
@param str $url Query
$return str The real url of the directed url
*/
function getrealurl($url){
$header = get_headers($url,1);
if (strpos($header[0],'301') || strpos($header[0],'302')) {
if(is_array($header['Location'])) {
return $header['Location'][count($header['Location'])-1];
}else{
return $header['Location'];
}
} else {
return $url;
}
}
$input = '

';
$url = isset($_GET['url'])?$_GET['url']:'';
if(empty($url)) exit($input);
$urlreal = getrealurl($url);
echo 'The real url is:'.$urlreal;
$urlreal = ltrim($urlreal,'http://');
$search = '/ebac5573358cc3c0659257bfcf54( [0-9a-f]+)/i';
preg_match($search,$url,$r);
$url_encode = $r[1]; unset($r);
echo '
The ciphertext part is: '.$url_encode.'
';
$urlreal_arr = str_split($urlreal);
$url_encode_arr = str_split($url_encode,2 ; Research to be continued. . . .
This site declares in advance: The articles on cnbeta are not published by me. My analysis is only based on my own ideas and research. It is just a process. As for whether there are results, I have my own conclusions. Please don't rant.
Continuing from the previous article, I carefully looked at the long code of the Baidu result URL and found that the ciphertext only consists of numbers and letters a to f, which is a hexadecimal code.
Hexadecimal is from 0->1->2->3->4->5->7->8->9->a->b ->c->d->e->f
I collected a series of URLs and counted the first code.

ebac5573358cc3c0659257bfcf54XX...
The url corresponding to the XX code is as follows



Copy the code

The code is as follows:

33 0 23 @ 13 P 03 ` 73 p 63
! 32 1 22 A 12 Q 02 a 72 q 62
" 31 2 21 B 11 R 01 b 71 r 61
# 30 3 20 C 10 S 00 c 70 s 60
$ 37 4 27 D 17 T 07 d 77 t 67
% 36 5 26 E 16 U 06 e 76 u 66
& 35 6 25 F 15 V 05 f 75 v 65
' 34 7 24 G 14 W 04 g 74 w 64
( 3b 8 2b H 1b X 0b h 7b x 6b
) 3a 9 2a I 1a Y 0a i 7a y 6a
* 39 : 29 J 19 Z 09 j 79 z 69
+ 38 ; 28 K 18 [ 08 k 78 { 68
, 3f - 3e = 2e M 1e ] 0e m 7e } 6e
. 3d > 2d N 1d ^ 0d n 7d ~ 6d
/ 3c ? 2c O 1c _ 0c o 7c 6c

It is found that it should be a character in an ascii code table, but the order should be confused. But it is all like this in one base:
3->2->1->0-> 7->6->5->4->b->a->9->8->f->e->d->c
four digits In descending order, it can be seen that the overall trend is decreasing.
But what I don’t understand is that the corresponding 0c and 73 are adjacent in ascii. There is no way. I can’t see the pattern. Let’s look at the second one. The code for this bit is
ebac5573358cc3c0659257bfcf54XXYY. The url corresponding to the bit code for
YY is as follows:

70 0 60 @ 50 P 40 ` 30 p 20 ! 71 1 61 A 51 Q 41 a 31 q 21 " 72 2 62 B 52 R 42 b 32 r 22

# 73 3 63 C 53 S 43 c 33 s 23

$ 74 4 64 D 54 T 44 d 34 t 24
% 75 5 65 E 55 U 45 e 35 u 25
& 76 6 66 F 56 V 46 f 36 v 26
' 77 7 67 G 57 W 47 g 37 w 27
( 78 8 68 H 58 X 48 h 38 x 28
) 79 9 69 I 59 Y 49 i 39 y 29
* 7a : 6a J 5a Z 4a j 3a z 2a
+ 7b ; 6b K 5b [ 4b k 3b { 2b
, 7c - 7d = 6d M 5d ] 4d m 3d } 2d
. 7e > 6e N 5e ^ 4e n 3e ~ 2e
/ 7f ? 6f O 5f _ 4f o 3f 2f


The secret text of the second group follows the increasing order of hexadecimal.
0->1->2->3->4->5->7->8->9->a->b->c-> ;d->e->f
The overall trend is decreasing.
Look at the third group
ebac5573358cc3c0659257bfcf54XXYYZZ. . . .

The url corresponding to the ZZ code is as follows:



Copy the code

The code is as follows:

84 0 94 @ a4 P b4 ` c4 p d4 ! 85 1 95 A a5 Q b5 a c5 q d5 " 86 2 96 B a6 R b6 b c6 r d6 # 87 3 97 C a7 S b7 c c7 s d7

$ 80 4 90 D a0 T b0 d c0 t d0

% 81 5 91 E a1 U b1 e c1 u d1
& 82 6 92 F a2 V b2 f c2 v d2
' 83 7 93 G a3 W b3 g c3 w d3
( 8c 8 9c H ac ae Z be j ce z de
+ 8f ; 9f K af [ bf k cf { df
, 88 - 89 = 99 M a9 ] b9 m c9 } d9
. 8a > 9a N aa ^ ba n ca ~ da
/ 8b ? 9b O ab _ bb o cb db


Does not explain the upper order:
4->5->6->7->0->1->2->3->4->c->b->e->f- >8->9->a->b
Overall, it is increasing
I haven’t looked at the following digits, but I can probably tell that it is a group of four digits. Hexadecimal confusion , as for whether it is increasing or decreasing, a certain amount of data is needed to determine.
To be continued.

http://www.bkjia.com/PHPjc/326056.html

www.bkjia.com

true
http: //www.bkjia.com/PHPjc/326056.html

TechArticleA few days ago I wrote an article on how to get the URL after Baidu jump. I checked it on Baidu. Some people have also studied Baidu link?url=. The following results are roughly obtained: 1. The encryption method is based on...