-
Notifications
You must be signed in to change notification settings - Fork 0
/
011-ssrf-httpclient.jsp
54 lines (51 loc) · 2.13 KB
/
011-ssrf-httpclient.jsp
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
<%@ page import="org.apache.http.HttpResponse" %>
<%@ page import="org.apache.http.client.HttpClient" %>
<%@ page import="org.apache.http.client.methods.HttpGet" %>
<%@ page import="org.apache.http.impl.client.HttpClients" %>
<%@ page import="java.io.BufferedReader" %>
<%@ page import="java.io.InputStreamReader" %>
<%@ page import="java.util.Map" %>
<%@ page contentType="text/html; charset=UTF-8" %>
<html>
<head>
<meta charset="UTF-8"/>
<title>011 - SSRF - HttpClient 方式</title>
</head>
<body>
<%
String linux_querystring = "?url=http://127.0.0.1.xip.io";
String redirect_string = "?url=http://n5d.net/mbrhm";
String urlString = request.getParameter("url");
if (urlString != null) {
try {
StringBuffer resultBuffer = null;
HttpClient client = HttpClients.createDefault();
BufferedReader br = null;
HttpGet httpGet = new HttpGet(urlString);
HttpResponse res = client.execute(httpGet);
// 读取服务器响应数据
br = new BufferedReader(new InputStreamReader(res.getEntity().getContent()));
String temp;
resultBuffer = new StringBuffer();
while ((temp = br.readLine()) != null) {
resultBuffer.append(temp);
}
String output = resultBuffer.toString();
output = output.replace("<", "<");
output = output.replace(">", ">");
out.println(output);
} catch (Exception e) {
out.print("<pre>");
e.printStackTrace(response.getWriter());
out.print("</pre>");
}
}
%>
<p>HttpClient 调用方式: </p>
<p>curl '<a href="<%=request.getRequestURL()+linux_querystring%>" target="_blank"><%=request.getRequestURL()+linux_querystring%></a>'</p>
<pre>说明: 参数 url 为请求的 url</pre>
<p>重定向:</p>
<p>curl '<a href="<%=request.getRequestURL()+redirect_string%>" target="_blank"><%=request.getRequestURL()+redirect_string%></a>'</p>
<pre>说明: 此链接源自外网, 若没有跳转，请自行获取能够使用301/302跳转到内网的外网url进行测试</pre>
</body>
</html>