1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15

import ddddocr
import base64

ocr = ddddocr.DdddOcr()

# 方法1: 读取图片文件
with open('captcha.png', 'rb') as f:
image = f.read()
result = ocr.classification(image)
print(result) # 输出: "1234"

# 方法2: Base64 字符串
image_base64 = "data:image/png;base64,iVBORw0K..."
image_bytes = base64.b64decode(image_base64.split(',')[1])
result = ocr.classification(image_bytes)

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32

import ddddocr
import requests
from io import BytesIO
from PIL import Image

# 1. 获取验证码图片
bg_url = "https://example.com/captcha/bg.jpg"
slider_url = "https://example.com/captcha/slider.png"

bg_img = Image.open(BytesIO(requests.get(bg_url).content))
slider_img = Image.open(BytesIO(requests.get(slider_url).content))

# 2. 使用 ddddocr 进行缺口检测
det = ddddocr.DdddOcr(det=True) # 开启目标检测模式

# 将图片转为字节
bg_bytes = BytesIO()
bg_img.save(bg_bytes, format='PNG')
bg_bytes = bg_bytes.getvalue()

# 检测缺口位置
result = det.detection(bg_bytes)
print(result) # 输出: {'target': [x, y, width, height]}

# 3. 计算需要滑动的距离
gap_x = result['target'][0] # 缺口的 x 坐标

# 4. 生成滑动轨迹（见下文）
trajectory = generate_trajectory(gap_x)

# 5. 提交验证
# (具体实现见下文轨迹模拟章节)

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23

import cv2
import numpy as np

def find_gap(bg_img, slider_img):
"""使用 OpenCV 模板匹配找缺口"""

# 转灰度图
bg_gray = cv2.cvtColor(np.array(bg_img), cv2.COLOR_BGR2GRAY)
slider_gray = cv2.cvtColor(np.array(slider_img), cv2.COLOR_BGR2GRAY)

# 边缘检测
bg_edges = cv2.Canny(bg_gray, 100, 200)
slider_edges = cv2.Canny(slider_gray, 100, 200)

# 模板匹配
result = cv2.matchTemplate(bg_edges, slider_edges, cv2.TM_CCOEFF_NORMED)
min_val, max_val, min_loc, max_loc = cv2.minMaxLoc(result)

# 返回最佳匹配位置
return max_loc[0] # x 坐标

gap_x = find_gap(bg_img, slider_img)
print(f"缺口位置: {gap_x}px")

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21

import cv2

def find_rotation_angle(original_img, rotated_img):
"""计算旋转角度"""

# 使用 ORB 特征检测
orb = cv2.ORB_create()

kp1, des1 = orb.detectAndCompute(original_img, None)
kp2, des2 = orb.detectAndCompute(rotated_img, None)

# 特征匹配
bf = cv2.BFMatcher(cv2.NORM_HAMMING, crossCheck=True)
matches = bf.match(des1, des2)
matches = sorted(matches, key=lambda x: x.distance)

# 计算旋转角度（简化版）
# 实际实现需要更复杂的几何变换
angle = calculate_angle_from_matches(kp1, kp2, matches)

return angle

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24

from ultralytics import YOLO

# 加载预训练模型
model = YOLO('yolov8n.pt')

# 识别图中的对象
results = model('captcha.jpg')

# 提取红绿灯的位置
traffic_lights = []
for r in results:
boxes = r.boxes
for box in boxes:
class_id = int(box.cls[0])
if class_id == 9: # COCO 数据集中红绿灯的类别 ID
x, y, w, h = box.xywh[0].tolist()
traffic_lights.append((int(x), int(y)))

print(f"检测到的红绿灯位置: {traffic_lights}")
# 输出: [(120, 80), (300, 150), ...]

# 按要求顺序点击
for x, y in traffic_lights:
click(x, y)

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16

import speech_recognition as sr

# 下载音频文件
audio_url = "https://example.com/captcha/audio.wav"
# ...下载到本地

# 使用 Google Speech API 识别
recognizer = sr.Recognizer()
with sr.AudioFile("captcha.wav") as source:
audio = recognizer.record(source)

try:
text = recognizer.recognize_google(audio)
print(f"识别结果: {text}")
except sr.UnknownValueError:
print("无法识别")

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81

import numpy as np
import random

def ease_out_quad(x):
"""缓出函数"""
return 1 - (1 - x) ** 2

def ease_in_quad(x):
"""缓入函数"""
return x ** 2

def ease_out_back(x):
"""回弹函数"""
c1 = 1.70158
c3 = c1 + 1
return 1 + c3 * pow(x - 1, 3) + c1 * pow(x - 1, 2)

def generate_trajectory(distance, overshoot=True):
"""
生成滑动轨迹

:param distance: 总距离
:param overshoot: 是否过冲（滑过头再回来）
:return: [(x, y, t), ...] 轨迹点列表
"""
trajectory = []

# 参数设置
if overshoot:
# 过冲：滑到distance + 5~10px，再回来
overshoot_distance = distance + random.randint(5, 10)
else:
overshoot_distance = distance

# 第一阶段：加速阶段 (30%)
current = 0
t = 0
while current < overshoot_distance * 0.3:
t += random.randint(10, 20) # 时间间隔 10-20ms
ratio = current / (overshoot_distance * 0.3)
move = ease_in_quad(ratio) * 5 + random.uniform(0, 2)
current += move

# 添加y轴抖动
y = random.randint(-2, 2)
trajectory.append((int(current), y, t))

# 第二阶段：匀速阶段 (40%)
while current < overshoot_distance * 0.7:
t += random.randint(10, 15)
move = random.uniform(3, 5)
current += move
y = random.randint(-3, 3)
trajectory.append((int(current), y, t))

# 第三阶段：减速阶段 (30%)
start_decel = current
while current < overshoot_distance:
t += random.randint(15, 25)
ratio = (current - start_decel) / (overshoot_distance - start_decel)
move = (1 - ease_out_quad(ratio)) * 3 + random.uniform(0, 1)
current += move
y = random.randint(-2, 2)
trajectory.append((int(current), y, t))

# 如果有过冲，添加回退阶段
if overshoot:
back_to = distance
while current > back_to:
t += random.randint(10, 15)
move = random.uniform(1, 3)
current -= move
y = random.randint(-1, 1)
trajectory.append((int(current), y, t))

return trajectory

# 使用示例
trajectory = generate_trajectory(200, overshoot=True)
print(f"生成了 {len(trajectory)} 个轨迹点")
# 输出: [(3, 1, 15), (7, -1, 28), (12, 0, 43), ...]

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30

let trajectory = [];
let startTime = null;

document.addEventListener("mousedown", function (e) {
if (e.target.className.includes("slider")) {
startTime = Date.now();
trajectory = [];

document.addEventListener("mousemove", recordMove);
document.addEventListener("mouseup", endRecording);
}
});

function recordMove(e) {
if (startTime) {
trajectory.push({
x: e.clientX,
y: e.clientY,
t: Date.now() - startTime,
});
}
}

function endRecording() {
console.log(JSON.stringify(trajectory));
copy(JSON.stringify(trajectory)); // 自动复制到剪贴板

document.removeEventListener("mousemove", recordMove);
document.removeEventListener("mouseup", endRecording);
}

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40

import json

def scale_trajectory(original_trajectory, target_distance):
"""
缩放轨迹以适应新的距离

:param original_trajectory: 原始轨迹 [{'x': 100, 'y': 0, 't': 150}, ...]
:param target_distance: 目标距离
:return: 缩放后的轨迹
"""
# 计算原始距离
original_distance = original_trajectory[-1]['x'] - original_trajectory[0]['x']

# 计算缩放比例
scale = target_distance / original_distance

# 缩放轨迹
scaled_trajectory = []
base_x = original_trajectory[0]['x']

for point in original_trajectory:
scaled_x = (point['x'] - base_x) * scale
scaled_trajectory.append({
'x': int(scaled_x),
'y': point['y'],
't': point['t']
})

return scaled_trajectory

# 加载轨迹库
with open('trajectories.json', 'r') as f:
trajectory_library = json.load(f)

# 随机选择一条轨迹
import random
trajectory = random.choice(trajectory_library)

# 缩放到目标距离
scaled_trajectory = scale_trajectory(trajectory, gap_x)

1

npm install ghost-cursor

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32

const puppeteer = require("puppeteer");
const { createCursor } = require("ghost-cursor");

(async () => {
const browser = await puppeteer.launch({ headless: false });
const page = await browser.newPage();
const cursor = createCursor(page);

await page.goto("https://example.com/captcha");

// 找到滑块元素
const slider = await page.$(".slider-button");
const sliderBox = await slider.boundingBox();

// 计算目标位置（假设缺口在 200px 处）
const targetX = sliderBox.x + 200;
const targetY = sliderBox.y + sliderBox.height / 2;

// 使用 ghost-cursor 移动鼠标（自动生成逼真轨迹）
await cursor.move(sliderBox.x, sliderBox.y);
await cursor.click(); // 按下鼠标

// 移动到目标位置（包含随机抖动和曲线）
await cursor.move(targetX, targetY, {
waitForSelector: false,
paddingPercentage: 10, // 10% 的随机偏移
});

await page.mouse.up(); // 释放鼠标

await browser.close();
})();

1
2
3
4
5

{
"challenge": "abc123...", // 挑战码
"validate": "def456...", // 加密后的轨迹
"seccode": "validate|jordan" // validate + "|jordan"
}

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23

// 极验加密算法（已公开部分）
function get_validate(trajectory, challenge) {
// 1. 编码轨迹
let encoded_trajectory = encode_trajectory(trajectory);

// 2. 与 challenge 进行运算
let combined = encoded_trajectory + challenge;

// 3. MD5 + Base64
let validate = md5(combined).substring(0, 32);

return validate;
}

function encode_trajectory(trajectory) {
// 轨迹编码（实际更复杂，包含加密和压缩）
let encoded = "";
for (let point of trajectory) {
encoded +=
int_to_char(point.x) + int_to_char(point.y) + int_to_char(point.t);
}
return encoded;
}

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31

import requests
import hashlib

def crack_geetest(gap_x):
"""破解极验滑块验证"""

# 1. 初始化获取 challenge
init_url = "https://api.geetest.com/get.php"
response = requests.get(init_url, params={
'gt': 'your_gt_key',
't': int(time.time() * 1000)
})
data = response.json()
challenge = data['challenge']

# 2. 生成轨迹
trajectory = generate_trajectory(gap_x)

# 3. 计算 validate (简化版，实际需要逆向完整算法)
validate = calculate_validate(trajectory, challenge)

# 4. 提交验证
verify_url = "https://api.geetest.com/ajax.php"
result = requests.post(verify_url, data={
'gt': 'your_gt_key',
'challenge': challenge,
'validate': validate,
'seccode': validate + '|jordan'
})

return result.json()

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21

from selenium import webdriver
import time

driver = webdriver.Chrome()
driver.get('https://www.google.com/recaptcha/api2/demo')

# 找到 reCAPTCHA iframe
iframe = driver.find_element_by_css_selector('iframe[src*="recaptcha"]')
driver.switch_to.frame(iframe)

# 点击复选框
checkbox = driver.find_element_by_id('recaptcha-anchor')
checkbox.click()

# 等待验证完成
time.sleep(3)

# 切回主页面获取 token
driver.switch_to.default_content()
token = driver.find_element_by_id('g-recaptcha-response').get_attribute('value')
print(f"reCAPTCHA Token: {token}")

1

pip install 2captcha-python

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29

from twocaptcha import TwoCaptcha

# 初始化
solver = TwoCaptcha('YOUR_API_KEY')

# 1. 文字验证码
result = solver.normal('captcha.png')
print(result['code']) # 输出: "AB3CD"

# 2. reCAPTCHA v2
result = solver.recaptcha(
sitekey='6Le-wvkSAAAAAPBMRTvw0Q4Muexq9bi0DJwx_mJ-',
url='https://example.com/login'
)
print(result['code']) # reCAPTCHA token

# 3. hCaptcha
result = solver.hcaptcha(
sitekey='10000000-ffff-ffff-ffff-000000000001',
url='https://example.com'
)

# 4. GeeTest
result = solver.geetest(
gt='geetest_gt',
challenge='geetest_challenge',
url='https://example.com'
)
print(result) # {'challenge': '...', 'validate': '...', 'seccode': '...'}

1

爬虫服务器 → 任务队列 (Redis) → 打码工作台 (Web) → 打码员

1
2
3
4
5
6

1) POST /api/login → 返回需要验证
2) GET /captcha/init → 获取背景图和滑块
3) 识别缺口位置
4) 生成轨迹
5) POST /captcha/verify → 提交轨迹
6) 验证通过后重新登录

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56

import ddddocr
import requests
from trajectory import generate_trajectory

class LoginCracker:
def __init__(self):
self.session = requests.Session()
self.det = ddddocr.DdddOcr(det=True)

def login(self, username, password):
# 1. 尝试登录
resp = self.session.post('https://example.com/api/login', data={
'username': username,
'password': password
})

if resp.json()['need_captcha']:
# 2. 需要验证码
captcha_token = self.solve_captcha()

# 3. 带验证码重新登录
resp = self.session.post('https://example.com/api/login', data={
'username': username,
'password': password,
'captcha_token': captcha_token
})

return resp.json()

def solve_captcha(self):
# 获取验证码图片
init_resp = self.session.get('https://example.com/captcha/init').json()
bg_url = init_resp['bg_url']

# 下载背景图
bg_img = requests.get(bg_url).content

# 识别缺口
result = self.det.detection(bg_img)
gap_x = result['target'][0]

# 生成轨迹
trajectory = generate_trajectory(gap_x)

# 提交验证
verify_resp = self.session.post('https://example.com/captcha/verify', json={
'token': init_resp['token'],
'trajectory': trajectory
})

return verify_resp.json()['captcha_token']

# 使用
cracker = LoginCracker()
result = cracker.login('username', 'password')
print(result)

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33

const puppeteer = require("puppeteer");
const solver = require("2captcha");

(async () => {
const browser = await puppeteer.launch({ headless: false });
const page = await browser.newPage();

await page.goto("https://example.com/login");

// 获取 reCAPTCHA sitekey
const sitekey = await page.evaluate(() => {
return document
.querySelector("[data-sitekey]")
.getAttribute("data-sitekey");
});

// 调用 2Captcha 解决
const captchaSolver = new solver.Solver("YOUR_API_KEY");
const result = await captchaSolver.recaptcha(sitekey, page.url());

// 注入 token
await page.evaluate((token) => {
document.getElementById("g-recaptcha-response").innerHTML = token;
}, result.data);

// 提交表单
await page.click("#submit-button");

await page.waitForNavigation();
console.log("登录成功!");

await browser.close();
})();