明御安全网关（IPS）批量导入黑名单IP

这个版本的系统不支持批量导入黑名单IP列表进入地址池，简单抓了个包分析一下

提交的原始报文：

POST /webui/?g=obj_address_edit&name=拉黑IP HTTP/1.1
Host: 10.10.1.2
Proxy-Connection: keep-alive
Content-Length: 667
Cache-Control: max-age=0
Upgrade-Insecure-Requests: 1
Origin: http://10.10.1.2
Content-Type: application/x-www-form-urlencoded
User-Agent: Mozilla/5.0 (Windows NT 6.3; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Referer: http://10.10.1.2/webui/?g=obj_address_edit&name=aaaaaaaaaa
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
Cookie: USGSESSID=aaaaaaaaaaaaaaaaaaaa

name=拉黑IP&new_name=拉黑IP&description=拉黑IP&addr_type=主机地址&conf_netaddr=&conf_range_sip=&conf_range_eip=&conf_host=&conf_domain=&ipaddr_items=[{"type":"host","address":"1.1.1.1"},{"type":"host","address":"2.2.2.2"}]&ipaddr_items_hidden=[{"type":"host","address":"1.1.1.1"},{"type":"host","address":"2.2.2.2"}]&conf_exclude_hidden=&exclude=&submit_post=obj_address_editsave

根据报文，按其格式，生成IP列表的数据，替换过去即可

#要批量拉黑的ip保存进同目录下的1.txt，一行一个IP
with open('1.txt',encoding='utf-8') as file:
	content=file.readlines()#按行读取

for line in content:
	line_new=line.replace('\n','')#将换行符替换为空
	info='{"type":"host","address":"'+line_new+'"}'
	print (info)
	
#输出后，使用sublime text替换\n为','  并通过burp发包批量添加

整理一下格式化的IP列表，组合一下报文，即可发包给服务器了，回显success就添加成功了
当然也可以将发包集成进脚本里，懒得弄了，批量拉黑IP的操作频率不高。