gopher协议及ssrf

UserNick157

已于 2022-08-24 23:14:08 修改

阅读量1.1k

点赞数

文章标签： web安全

于 2022-08-24 23:11:32 首次发布

本文链接：https://blog.csdn.net/UserNick157/article/details/126514624

版权

文章目录

gopher协议

1.GET

1.最简单的get请求

GET /b.php?q=1 HTTP/1.1
Host: 192.168.47.244

2.gopher改写

gopher://192.168.47.244:80/_GET%20/b.php%3Fq%3D1%20HTTP/1.1%0D%0AHost%3A%20192.168.47.244%0D%0A%0D%0A

使用的python脚本

import urllib.parse

ip = "192.168.47.244"
port = "80"
body = \
"""GET /b.php?q=1 HTTP/1.1
Host: 192.168.47.244

"""

body = urllib.parse.quote(body)
body = body.replace("%0A", "%0D%0A")
payload = f"gopher://{ip}:{port}/_" + body
print(payload)

3.测试

apcahe/2.4.43

php/7.4.*

curl/7.68.0

测试源码php

<?php
	if(isset($_GET['q'])){
		echo "Hello ".$_GET['q']."<br/>";
	}
?>

kali-curl测试

kali -> kali

curl gopher://192.168.47.162:80/_GET%20/b.php%3Fq%3D1%20HTTP/1.1%0D%0AHost%3A%20192.168.47.162%0D%0A%0D%0A
HTTP/1.1 200 OK
Date: Tue, 23 Aug 2022 08:54:01 GMT
Server: Apache/2.4.43 (Debian)
Content-Length: 12
Content-Type: text/html; charset=UTF-8

Hello 1<br/>

kali -> windows

curl gopher://192.168.47.244:80/_GET%20/b.php%3Fq%3D1%20HTTP/1.1%0D%0AHost%3A%20192.168.47.244%0D%0A%0D%0A
HTTP/1.1 200 OK
Date: Tue, 23 Aug 2022 09:00:37 GMT
Server: Apache/2.4.43 (Win64) OpenSSL/1.1.1f mod_fcgid/2.3.9a mod_log_rotate/1.02
X-Powered-By: PHP/5.2.17
Transfer-Encoding: chunked
Content-Type: text/html

6
1<br/>
0

windows-curl测试

windows -> kali

curl gopher://192.168.47.244:80/_GET%20/b.php%3Fq%3D1%20HTTP/1.1%0D%0AHost%3A%20192.168.47.244%0D%0A%0D%0A
HTTP/1.1 200 OK
Date: Tue, 23 Aug 2022 10:02:18 GMT
Server: Apache/2.4.43 (Win64) OpenSSL/1.1.1f mod_fcgid/2.3.9a mod_log_rotate/1.02
X-Powered-By: PHP/5.2.17
Transfer-Encoding: chunked
Content-Type: text/html

c
Hello 1<br/>
0

windows -> windows

curl gopher://192.168.47.162:80/_GET%20/b.php%3Fq%3D1%20HTTP/1.1%0D%0AHost%3A%20192.168.47.162%0D%0A%0D%0A
HTTP/1.1 200 OK
Date: Tue, 23 Aug 2022 10:01:31 GMT
Server: Apache/2.4.43 (Debian)
Content-Length: 12
Content-Type: text/html; charset=UTF-8

Hello 1<br/>

2.POST

1.最简单的post请求

post请求与get请求不同，post请求有四个字段是必须发送的

需要传递Content-Type,Content-Length,host,post的参数

Content-Type

Content-Length可以用Burpsuit自动补

POST /b.php?q=1 HTTP/1.1
Host: 192.168.47.244
Content-Type: application/x-www-form-urlencoded
Content-Length: 8

q=Myname

2.gopher改写

gopher://192.168.47.244:80/_POST%20/b.php%3Fq%3D1%20HTTP/1.1%0D%0AHost%3A%20192.168.47.244%0D%0AContent-Type%3A%20application/x-www-form-urlencoded%0D%0AContent-Length%3A%208%0D%0A%0D%0Aq%3DMyname

python

import urllib.parse

ip = "192.168.47.244"
port = "80"
data = \
"""POST /b.php?q=1 HTTP/1.1
Host: 192.168.47.244
Content-Type: application/x-www-form-urlencoded
Content-Length: 8

q=Myname"""

data = urllib.parse.quote(data)
data = data.replace("%0A", "%0D%0A")
payload = f"gopher://{ip}:{port}/_" + data
print(payload)

3.测试

1.kali-curl

kali -> kali

curl gopher://192.168.47.162:80/_POST%20/b.php%3Fq%3D1%20HTTP/1.1%0D%0AHost%3A%20192.168.47.162%0D%0AContent-Type%3A%20application/x-www-form-urlencoded%0D%0AContent-Length%3A%208%0D%0A%0D%0Aq%3DMyname
HTTP/1.1 200 OK
Date: Tue, 23 Aug 2022 10:36:57 GMT
Server: Apache/2.4.43 (Debian)
Content-Length: 17
Content-Type: text/html; charset=UTF-8

Hello Myname<br/>u

kali -> windows

curl gopher://192.168.47.244:80/_POST%20/b.php%3Fq%3D1%20HTTP/1.1%0D%0AHost%3A%20192.168.47.244%0D%0AContent-Type%3A%20application/x-www-form-urlencoded%0D%0AContent-Length%3A%208%0D%0A%0D%0Aq%3DMynameHTTP/1.1 200 OK
Date: Tue, 23 Aug 2022 10:34:34 GMT
Server: Apache/2.4.43 (Win64) OpenSSL/1.1.1f mod_fcgid/2.3.9a mod_log_rotate/1.02
X-Powered-By: PHP/5.2.17
Transfer-Encoding: chunked
Content-Type: text/html

11
Hello Myname<br/>
0

2.windows-curl

windows -> kali

curl gopher://192.168.47.162:80/_POST%20/b.php%3Fq%3D1%20HTTP/1.1%0D%0AHost%3A%20192.168.47.162%0D%0AContent-Type%3A%20application/x-www-form-urlencoded%0D%0AContent-Length%3A%208%0D%0A%0D%0Aq%3DMyname
HTTP/1.1 200 OK
Date: Tue, 23 Aug 2022 10:38:35 GMT
Server: Apache/2.4.43 (Debian)
Content-Length: 17
Content-Type: text/html; charset=UTF-8

Hello Myname<br/>

windows -> windows

curl gopher://192.168.47.244:80/_POST%20/b.php%3Fq%3D1%20HTTP/1.1%0D%0AHost%3A%20192.168.47.244%0D%0AContent-Type%3A%20application/x-www-form-urlencoded%0D%0AContent-Length%3A%208%0D%0A%0D%0Aq%3DMyname
HTTP/1.1 200 OK
Date: Tue, 23 Aug 2022 10:37:44 GMT
Server: Apache/2.4.43 (Win64) OpenSSL/1.1.1f mod_fcgid/2.3.9a mod_log_rotate/1.02
X-Powered-By: PHP/5.2.17
Transfer-Encoding: chunked
Content-Type: text/html

11
Hello Myname<br/>
0