viernes, 9 de octubre de 2026

Wewende








import asyncio
from playwright.async_api import async_playwright

async def intercept_shopify_api():
    async with async_playwright() as p:
        browser = await p.chromium.launch(
            headless=True,
            args=[
                "--disable-blink-features=AutomationControlled",
                "--no-sandbox",
                "--disable-setuid-sandbox"
            ]
        )
        
        context = await browser.new_context(
            user_agent="Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36",
            viewport={"width": 1920, "height": 1080}
        )
        page = await context.new_page()
        
        # Diccionario para almacenar las peticiones de la API que nos interesan
        api_logs = []

        # Event listener para capturar todas las respuestas de red en tiempo real
        async def handle_response(response):
            url = response.url
            # Filtramos por peticiones POST o llamadas a la API de autenticación/lookup
            if "lookup" in url or "auth" in url or "identity" in url:
                try:
                    status = response.status
                    content_type = response.headers.get("content-type", "")
                    
                    # Intentamos capturar el cuerpo si es JSON o texto legible
                    body = ""
                    if "application/json" in content_type or "text" in content_type:
                        body = await response.text()
                        
                    api_logs.append({
                        "url": url,
                        "status": status,
                        "method": response.request.method,
                        "body": body[:500] # Primeros 500 caracteres para no saturar la consola
                    })
                except Exception:
                    pass

        page.on("response", handle_response)
        
        print("[*] [Playwright] Navegando a accounts.shopify.com/lookup...")
        await page.goto("https://accounts.shopify.com/lookup", wait_until="networkidle")
        await page.wait_for_timeout(2000)
        
        print("[*] [Playwright] Enviando correo de prueba para interceptar la API...")
        email_input = await page.query_selector('input[name="account[email]"], input[name="email"], input[type="email"]')
        
        if email_input:
            await email_input.fill("test_playwright_audit@gmail.com")
            await page.wait_for_timeout(500)
            
            submit_button = await page.query_selector('button[type="submit"], input[type="submit"]')
            if submit_button:
                await submit_button.click()
            else:
                await email_input.press("Enter")
                
            # Damos tiempo a que se resuelvan las peticiones XHR/Fetch de la SPA
            await page.wait_for_timeout(5000)
            
            print(f"\n[+] Interceptadas {len(api_logs)} respuestas de red relevantes:")
            for log in api_logs:
                print(f"--------------------------------------------------")
                print(f"    -> [{log['method']}] {log['url']}")
                print(f"    -> Status Code: {log['status']}")
                if log['body']:
                    print(f"    -> Payload/Respuesta: {log['body']}")
        else:
            print("[!] No se encontró el campo de input del formulario.")

        await browser.close()

if __name__ == "__main__":
    asyncio.run(intercept_shopify_api())
























No hay comentarios:

Publicar un comentario

Wewende

import asyncio from playwright.async_api import async_playwright async def intercept_shopify_api(): async wi...