一、问题
在编写跨站脚本漏洞辅助验证脚本时遇到一个问题,当使用 Requests 模块发起请求,默认会对 URL 进行一次编码,比如下面的代码:
proxy = {"http": "http://127.0.0.1:8080"}
response = requests.get(res, proxies=proxy).text
使用 Burp Suite 抓包可以看到请求 URL 被 URL 编码了一次:
二、原因
request.get 是通过构造 session 模块中的Session类,并调用其request方法完成请求。Session类的request方法先根据传入的参数(如URL等)构造一个Request类,并调用self.prepare_request方法预准备,最后调用self.send发送最终的请求。
URL的编码过程便在self.prepare_request方法中:
# session.py
def prepare_request(self, request):
# 此部分代码已忽略
p = PreparedRequest()
p.prepare(method=request.method.upper(), url=request.url, files=request.files,
data=request.data, json=request.json,
headers=merge_setting(request.headers, self.headers, dict_class=CaseInsensitiveDict),
params=merge_setting(request.params, self.params), auth=merge_setting(auth, self.auth),
cookies=merged_cookies,hooks=merge_hooks(request.hooks, self.hooks),
)
return p
# model.py
class PreparedRequest(RequestEncodingMixin, RequestHooksMixin):
def prepare(self, method=None, url=None, headers=None, files=None,
data=None, params=None, auth=None, cookies=None, hooks=None, json=None):
"""Prepares the entire request with the given parameters."""
self.prepare_method(method)
self.prepare_url(url, params)
self.prepare_headers(headers)
self.prepare_cookies(cookies)
self.prepare_body(data, files, json)
self.prepare_auth(auth, url)
self.prepare_hooks(hooks)
def prepare_url(self, url, params):
# 这里requests库做了很多努力
url = requote_uri(urlunparse([scheme, netloc, path, None, query, fragment]))
self.url = url
最终我们传进去的URL就被prepare_url函数进行了字符串编码替换,回到Session类,调用resp = self.send(prep, **send_kwargs)发送请求,prep即是上述PreparedRequest对象。
三、解决方法
由于URL在PreparedRequest类中转码后传到Session类的send方法中发送最终的请求,只要写一个类继承Session并重写send方法,在里面进行反编码,将PreparedRequest对象的url属性值改了。代码如下:
#python2
import urllib
import requests
class NoQuoteSession(requests.Session):
def send(self, prep, **send_kwargs):
table = {
urllib.quote('{'): '{',
urllib.quote('}'): '}',
urllib.quote(':'): ':',
urllib.quote(','): ',',
urllib.quote('<'): '<',
urllib.quote('>'): '>',
}
for old, new in table.items():
prep.url = prep.url.replace(old, new)
return super(NoQuoteSeesion, self).send(prep, **send_kwargs)
s = NoQuoteSeesion()
res = s.get(url)
python3 中urllib.quote()变为 urllib.parse.quote():
#python3
class NoQuoteSession(requests.Session):
def send(self, prep, **send_kwargs):
table = {
urllib.parse.quote('{'): '{',
urllib.parse.quote('}'): '}',
urllib.parse.quote(':'): ':',
urllib.parse.quote(','): ',',
urllib.parse.quote('<'): '<',
urllib.parse.quote('>'): '>',
}
for old, new in table.items():
prep.url = prep.url.replace(old, new)
return super().send(prep, **send_kwargs)
Jewel591
网友评论