看那个文件,重点在get(url)的函数中,百度查了一下,发现了有趣的知识,curl导致SSRF漏洞。然后复现一下这个漏洞。 漏洞代码如下: function curl($url){ $ch = curl_init(); curl_setopt($ch, CURLOPT_URL, $url); curl_setopt($ch, CURLOPT_HEADER, 0); $re = curl_exec($ch); curl_close($ch);...
phpclassUserInfo{public$name="";public$age=0;public$blog="";publicfunction__construct($name,$age,$blog){$this->name =$name;$this->age = (int)$age;$this->blog =$blog; }functionget($url){$ch=curl_init();curl_setopt($ch, CURLOPT_URL,$url);curl_setopt($ch, CURLOPT_RETURNTRANSFER...
$ch = curl_init(); curl_setopt($ch, CURLOPT_URL, $_GET['url']); curl_setopt($ch, CURLOPT_HEADER, 0); curl_exec($ch); curl_close($ch); ?> 测试漏洞: 在输入INFO后,获得输出,证明dict协议的可用性。 在这个环境中我还是无法直接写入?,我们可以利用编码,在这里我利用的是\x十六进制编码...
curl_setopt($ch, CURLOPT_URL, $_REQUEST['url']); curl_setopt($ch, CURLOPT_HEADER, 0); curl_setopt($ch, CURLOPT_FOLLOWLOCATION, 1); curl_exec($ch); curl_close($ch); 发送POST请求肯定不能就发生一个POST请求,使用key就是成功的钥匙。 接下来 1 //用flag.php的文本框输入820c0335aaf4854...
preg_match('/localhost|1|0|。/i', $url)) { $ch = curl_init($url); curl_setopt($ch, CURLOPT_HEADER, 0); curl_setopt($ch, CURLOPT_RETURNTRANSFER, 1); $result = curl_exec($ch); curl_close($ch); echo ($result); } else { die('hacker'); } } else { die('hacker'); }...
java ssrf靶场 如何搭建ssrf漏洞的ctf靶场,202004241.SSRF测试方法1.1漏洞环境:PHP脚本、Windows1.2利用工具:nc、bash1.3测试过程首先采用如下脚本创建一个PHP的服务端:<?PHP$ch=curl_init();curl_setopt($ch,CURLOPT_URL,$_GET['url']);#curl_setopt($ch,CURLOPT_FO
function curl($url) { $ch = curl_init(); curl_setopt($ch, CURLOPT_URL, $url); curl_setopt($ch, CURLOPT_HEADER, 0); echo curl_exec($ch); curl_close($ch); } if (isset($_GET['url'])) { $url = $_GET['url']; if (preg_match('/file\:\/\/|dict\:\/\/|\.\.\/|...
curl_setopt($ch, CURLOPT_HTTPHEADER, array( 'Content-Type: application/json', 'Content-Length: ' . strlen($post_data)) ); $result = curl_exec($ch); $arr = json_decode($result,true); if(!array_key_exists('attack',$arr)$arr['attack']>0) ...
<?phphighlight_file(__FILE__);$x=$_GET['x'];$pos=strpos($x,"php");if($pos){exit("denied");}$ch=curl_init();curl_setopt($ch,CURLOPT_URL,"$x");curl_setopt($ch,CURLOPT_RETURNTRANSFER,true);$result=curl_exec($ch);echo $result; ...
curl_setopt($ch, CURLOPT_RETURNTRANSFER, 1); $output = curl_exec($ch); $httpCode = curl_getinfo($ch, CURLINFO_HTTP_CODE); if($httpCode == 404) { return 404; } curl_close($ch); return $output; } public function getBlogContents () ...