打开搜索框输入abc 勾选专业筛选的'社区公务' 点击搜索就会发现此链接 c参数显然就是我们输入的 abc 搜索词 d参数就是base64编码后的神秘内容
https://www.kechuang.org/search?c=abc&d=JTdCJTIydGNJZCUyMiUzQSU1QiU1RCUyQyUyMmZpZCUyMiUzQSU1QiUyMjIxJTIyJTVEJTJDJTIyZXhjbHVkZWRGaWQlMjIlM0ElNUIlNUQlMkMlMjJ0aW1lU3RhcnQlMjIlM0ElN0IlMjJ5ZWFyJTIyJTNBMTk3MCUyQyUyMm1vbnRoJTIyJTNBMSUyQyUyMmRheSUyMiUzQTElN0QlMkMlMjJ0aW1lRW5kJTIyJTNBJTdCJTIyeWVhciUyMiUzQTIwMjQlMkMlMjJtb250aCUyMiUzQTYlMkMlMjJkYXklMjIlM0E2JTdEJTJDJTIyc29ydCUyMiUzQSUyMiUyMiUyQyUyMmF1dGhvciUyMiUzQSUyMiUyMiUyQyUyMmRpZ2VzdCUyMiUzQWZhbHNlJTJDJTIyc29ydFR5cGUlMjIlM0ElMjIlMjIlMkMlMjJyZWxhdGlvbiUyMiUzQSUyMiUyMiUyQyUyMm9ubHlUaXRsZSUyMiUzQWZhbHNlJTdE
丢去解码 获得
%7B%22tcId%22%3A%5B%5D%2C%22fid%22%3A%5B%2221%22%5D%2C%22excludedFid%22%3A%5B%5D%2C%22timeStart%22%3A%7B%22year%22%3A1970%2C%22month%22%3A1%2C%22day%22%3A1%7D%2C%22timeEnd%22%3A%7B%22year%22%3A2024%2C%22month%22%3A6%2C%22day%22%3A5%7D%2C%22sort%22%3A%22%22%2C%22author%22%3A%22%22%2C%22digest%22%3Afalse%2C%22sortType%22%3A%22%22%2C%22relation%22%3A%22%22%2C%22onlyTitle%22%3Afalse%7D
发现解码后的内容还是经过URL编码的 继续解码 获得这串字符串 豁然开朗
{"tcId":[],"fid":["21"],"excludedFid":[],"timeStart":{"year":1970,"month":1,"day":1},"timeEnd":{"year":2024,"month":6,"day":5},"sort":"","author":"","digest":false,"sortType":"","relation":"","onlyTitle":false}
https://www.kechuang.org/f/21
fid参数的21正好对应了 所以..... 把fid改成想要获取的分区fid不就行了?
打开 https://www.kechuang.org/f/2 会发现这个专业是无法访问的
"根据相关法律法规和政策，内容不予显示。"
试着把fid改成2 再给编码回去,提交成功 显示专业名称气象沉积
![image.png]()
11
![image.png]()
12
![image.png]()
26
![image.png]()
之后还随便试了几个数字就停下了,阻挡我继续探索的最主要因素就是懒惰 毕竟有几百个数字可以试,也懒得写什么脚本跑了...
返回数据藏在了这里面
![image.png]()
url解码可得json格式的数据 专业名称就在displayName里
![image.png]()
