如何解决Burpsuite转发器和python请求的不同返回
出于我公司的安全原因,我删除了 URL。但我认为它们对于理解问题并不重要。
当我使用 Burpsuite 发布帖子时,帖子被正确执行,like this print. 请求如下所示:
POST /upload/1 HTTP/1.1
Host: URL REMOVED
Connection: close
Content-Length: 0
sec-ch-ua: "Google Chrome";v="87"," Not;A Brand";v="99","Chromium";v="87"
Accept: application/json,text/plain,*/*
sec-ch-ua-mobile: ?0
x-access-token: TOKEN REMOVED
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML,like Gecko) Chrome/87.0.4280.141 Safari/537.36
Content-Type: application/x-www-form-urlencoded
Origin: URL REMOVED
Sec-Fetch-Site: same-site
Sec-Fetch-Mode: cors
Sec-Fetch-Dest: empty
Referer: URL REMOVED
Accept-Encoding: gzip,deflate
Accept-Language: pt-BR,pt;q=0.9,en-US;q=0.8,en;q=0.7
BurpSuite 中的答案如下所示:
HTTP/1.1 200 OK
Date: Mon,25 Jan 2021 15:28:46 GMT
Server: Apache
X-DNS-Prefetch-Control: off
X-Frame-Options: SAMEORIGIN
Strict-Transport-Security: max-age=15552000; includeSubDomains
X-Download-Options: noopen
X-Content-Type-Options: nosniff
X-XSS-Protection: 1; mode=block
Access-Control-Allow-Origin: *
Content-Type: application/json; charset=utf-8
Content-Length: 86
ETag: W/"56-bL6Iw6mpmbZmkXyESXWzn8xcLXc"
Connection: close
{"status":{"type":"success","message":"success","code":200,"error":false},"data":"Ok"}
但是当我尝试使用 python 请求做同样的帖子时,我收到了 401 错误。代码如下:
import requests
import json
#DESAFIO 2
url_post = 'URL REMOVED'
parametros_post = {
"Host": "URL REMOVED","Connection": "close","Content-Length": 0,"sec-ch-ua": '"Google Chrome";v="87","Chromium";v="87"',"Accept": "application/json,*/*","sec-ch-ua-mobile": "?0","x-access-token": "TOKEN REMOVED","User-Agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML,like Gecko) Chrome/87.0.4280.141 Safari/537.36","Content-Type": "application/x-www-form-urlencoded","Origin": "URL","Sec-Fetch-Site": "same-site","Sec-Fetch-Mode": "cors","Sec-Fetch-Dest": "empty","Referer": "URL REMOVED","Accept-Encoding": "gzip,deflate","Accept-Language": "pt-BR,en;q=0.7"
}
headers_post = {}
r = requests.post(url_post,data = json.dumps(parametros_post),headers = headers_post)
print(r.json())
返回的python代码如下:
{'status': {'type': 'AppError','message': 'Please log in.','error': True,'code': 401}}
我对两种请求方式都使用相同的用户代理和相同的标头。 我该怎么做才能让它在 python 上运行?
解决方法
您发送的请求如下所示:
您的脚本在请求正文中以 json 格式发送这些标头,但这些是请求标头。 您应该将它们作为标题发送。
你可以使用 Burp Comparer 比较你的请求,你只需要通过 Burp 代理发送你的请求,就像 8040 是 Burp 代理的例子一样。在“比较器”窗口中,您将看到您的请求是什么样的,并且更容易注意到问题所在。
版权声明:本文内容由互联网用户自发贡献,该文观点与技术仅代表作者本人。本站仅提供信息存储空间服务,不拥有所有权,不承担相关法律责任。如发现本站有涉嫌侵权/违法违规的内容, 请发送邮件至 dio@foxmail.com 举报,一经查实,本站将立刻删除。