逆向第三方 SaaS 精华 SOP（方法 + 伪装合一）

git clone --depth 1 <repo> ev && find ev -type f -not -path '*/.git/*'
grep -rhoE "https?://[a-zA-Z0-9./_%#?=-]+" ev --exclude-dir=.git | sort -u

API=https://api.example.com
curl -s $API/openapi.json | python3 -m json.tool | head -50   # ← 优先级最高
curl -s $API/ | head -c 500                                    # 根路径常是 SwaggerUI
curl -s $API/.well-known/oauth-authorization-server
curl -s $API/.well-known/oauth-protected-resource
curl -s $API/api/templates                                     # 素材/配置端点常不鉴权

cat ev/test/*.test.* ev/.github/workflows/* 2>/dev/null

lsof -ti:8765 | xargs kill -9 2>/dev/null   # 先清端口
python3 -u sp_oauth.py                        # 必须 -u，否则后台看不到授权链接

# 1. 视频 metadata —— encoder 字段常直接泄漏渲染器
ffprobe -v error -show_format -show_streams v.mp4 | grep -Ei "encoder|codec|width|height|frame_rate|channels"
# 2. 有没有 BGM —— 静音检测是唯一可靠办法
ffmpeg -i v.mp4 -af silencedetect=n=-45dB:d=0.25 -f null - 2>&1 | grep silence_
# 3. 逐秒关键帧看版式/分阶段
ffmpeg -v error -i v.mp4 -vf "fps=1,scale=640:-1" frames/f%02d.png
# 4. 返回 JSON 里的 timings —— 对方各阶段真实耗时，最好的对标基准

import re, glob, numpy as np
for f in glob.glob("*_outline.svg"):
    ds = re.findall(r'<path d="([^"]+)"', open(f).read())
    pts = [re.match(r'\s*[Mm]\s*(-?[\d.]+)[\s,]+(-?[\d.]+)', d) for d in ds]
    ys = np.array([float(m.group(2)) for m in pts if m])
    xs = np.array([float(m.group(1)) for m in pts if m])
    print(f, f"y递增{np.mean(np.diff(ys)>0):.0%} x递增{np.mean(np.diff(xs)>0):.0%}")

逆向素材/
  00-这些是什么.md   ← 索引：每个文件怎么来的、价值在哪
  01-接口契约/  02-官方提示词/  03-他们的素材/  0N-真实任务产物/

rm -f sp_token.json                              # access + refresh token
claude mcp remove --scope user <server-name>     # 如果加过 MCP
security find-generic-password -s "Claude Code-credentials" -w | python3 -c "
import json,sys; d=json.load(sys.stdin)
print('钥匙串残留:', [k for k in d.get('mcpOAuth',{}) if '<name>' in k] or '无')"

#!/usr/bin/env python3
"""跑起来打印授权链接 → 用户浏览器登录 → 本地回调拿 code → 换 token → 拉 tools/list。
必须用 python3 -u 跑，否则后台看不到链接。"""
import base64, hashlib, http.server, json, os, secrets, threading, time
import urllib.parse, urllib.request

BASE = "https://api.example.com"          # ← 改成目标
REDIRECT = "http://localhost:8765/callback"
UA = {"User-Agent": "claude-code/1.0"}     # 缺这个会被 Cloudflare 403
OUT = os.path.dirname(os.path.abspath(__file__))
captured = {}

def post_json(url, payload, headers=None):
    h = {"Content-Type": "application/json",
         "Accept": "application/json, text/event-stream", **UA}
    if headers: h.update(headers)
    req = urllib.request.Request(url, data=json.dumps(payload).encode(), headers=h, method="POST")
    with urllib.request.urlopen(req, timeout=60) as r:
        return r.read().decode()

def post_form(url, payload):
    req = urllib.request.Request(
        url, data=urllib.parse.urlencode(payload).encode(), method="POST",
        headers={"Content-Type": "application/x-www-form-urlencoded", **UA})
    with urllib.request.urlopen(req, timeout=60) as r:
        return json.loads(r.read().decode())

class Handler(http.server.BaseHTTPRequestHandler):
    def do_GET(self):
        captured.update({k: v[0] for k, v in
                         urllib.parse.parse_qs(urllib.parse.urlparse(self.path).query).items()})
        self.send_response(200); self.send_header("Content-Type", "text/html; charset=utf-8")
        self.end_headers(); self.wfile.write("<h2>授权完成，可以关掉本页</h2>".encode())
    def log_message(self, *a): pass

def main():
    # 先起监听（端口起不来就退出，避免白注册一个客户端）
    srv = http.server.HTTPServer(("127.0.0.1", 8765), Handler)
    threading.Thread(target=srv.serve_forever, daemon=True).start()

    reg = json.loads(post_json(f"{BASE}/oauth/register", {
        "client_name": "mcp-client",        # ← 中性名，别写 recon/scan/test
        "redirect_uris": [REDIRECT],
        "grant_types": ["authorization_code", "refresh_token"],
        "response_types": ["code"],
        "token_endpoint_auth_method": "none",
    }))
    cid, csec = reg["client_id"], reg.get("client_secret")

    verifier = base64.urlsafe_b64encode(secrets.token_bytes(64)).decode().rstrip("=")
    challenge = base64.urlsafe_b64encode(
        hashlib.sha256(verifier.encode()).digest()).decode().rstrip("=")
    print("\n=== 用浏览器打开完成登录授权 ===\n")
    print(f"{BASE}/authorize?" + urllib.parse.urlencode({
        "response_type": "code", "client_id": cid, "redirect_uri": REDIRECT,
        "scope": reg.get("scope", ""), "state": secrets.token_urlsafe(16),
        "code_challenge": challenge, "code_challenge_method": "S256"}))

    for _ in range(300):
        if "code" in captured or "error" in captured: break
        time.sleep(1)
    srv.shutdown()
    if "code" not in captured:
        print("[失败]", captured); return

    form = {"grant_type": "authorization_code", "code": captured["code"],
            "redirect_uri": REDIRECT, "client_id": cid, "code_verifier": verifier}
    if csec: form["client_secret"] = csec
    tok = post_form(f"{BASE}/oauth/token", form)
    open(f"{OUT}/token.json", "w").write(json.dumps(tok, indent=2))

    hdr = {"Authorization": f"Bearer {tok['access_token']}"}
    print("[initialize]", post_json(f"{BASE}/mcp", {
        "jsonrpc": "2.0", "id": 1, "method": "initialize",
        "params": {"protocolVersion": "2025-06-18", "capabilities": {},
                   "clientInfo": {"name": "mcp-client", "version": "1.0"}}}, hdr)[:600])  # ← 中性名
    open(f"{OUT}/tools.json", "w").write(
        post_json(f"{BASE}/mcp", {"jsonrpc": "2.0", "id": 2, "method": "tools/list"}, hdr))
    print("已保存 token.json / tools.json")

if __name__ == "__main__":
    main()

import json, urllib.request
TOK = json.load(open("token.json"))["access_token"]
def rpc(method, params=None, _id=1):
    body = {"jsonrpc": "2.0", "id": _id, "method": method}
    if params is not None: body["params"] = params
    req = urllib.request.Request(
        "https://api.example.com/mcp", data=json.dumps(body).encode(), method="POST",
        headers={"Content-Type": "application/json", "User-Agent": "claude-code/1.0",
                 "Accept": "application/json, text/event-stream",
                 "Authorization": f"Bearer {TOK}"})
    try:
        with urllib.request.urlopen(req, timeout=120) as r: return r.read().decode()
    except urllib.error.HTTPError as e: return f"HTTP {e.code}: {e.read().decode()[:800]}"
def call(name, args): return rpc("tools/call", {"name": name, "arguments": args}, 9)