Web服务器的安全和攻击防范(8)

伪造Web请求（二）

　　注意b的值必须以URL编码格式输入。要将字符串进行URL编码，可以使用一个简单的PHP程序，例如：

kris@valiant:~/www <   cat urlencode.php

#! /home/kris/bin/php -q

<  ?php

  print urlencode($argv[1])."n";

? >

kris@valiant:~/www <   ./urlencode.php "this is a test"

this+is+a+test

　　发送HTTP POST请求只是稍微复杂一点：现在应该在这个请求中包含一个合法的Content-Type头以及正确的内容长度字节数。下面是具体过程：

kris@valiant:~/www <   telnet valiant 80

Trying 193.102.57.3...

Connected to valiant.koehntopp.de.

Escape character is '^]'.

POST /~kris/test.php HTTP/1.0

Host: valiant.koehntopp.de

Referer: http://www.attacker.com/die_sucker_die.html

Content-Type: application/x-www-form-urlencoded

Content-Length: 16



b=this+is+a+test

HTTP/1.1 200 OK

Date: Sat, 08 Apr 2000 06:55:11 GMT

Server: Apache/1.3.9 (Unix)  (SuSE/Linux) PHP/4.0RC2-dev

mod_ssl/2.4.7 OpenSSL/0.9.4

X-Powered-By: PHP/4.0RC2-dev

Connection: close

Content-Type: text/html



The value of b is this is a test

The value of HTTP_REFERER is

http://www.attacker.com/die_sucker_die.html

Connection closed by foreign host.

原文转自：http://www.ltesting.net