mimetype类型

MIME type的缩写为(Multipurpose Internet Mail Extensions)代表互联网媒体类型(Internet media type)MIME使用一个简单的字符串组成,最初是为了标识邮件Email附件的类型,在html文件中可以使用content-type属性表示,描述了文件类型的互联网标准。

MIME类型能包含视频、图像、文本、音频、应用程序等数据。

引用网址:http://www.dreamdu.com/xhtml/mime_type/

MIME_type类型语法

media-type=type "/" subtype *( ";"parameter )

媒体类型(type)与子类型(subtype)组成了MIME,它们之间使用反斜杠/分割,其中type可取值为:application audio example image messagemodel multipart text videosubtype是某种类型的唯一标识符,比如:css gif xml等。

MIME示例

text/css

标明此文件的typetext(文本),且subtypecss(层叠样式表)

image/gif

标明此文件的typeimage(图像),且subtypegif(Graphics Interchange Format)

常见MIME类型

按照功能排列的MIME_type类型

类型/子类型 扩展名
application/envoy evy
application/fractals fif
application/futuresplash spl
application/hta hta
application/internet-property-stream acx
application/mac-binhex40 hqx
application/msword doc
application/msword dot
application/octet-stream *
application/octet-stream bin
application/octet-stream class
application/octet-stream dms
application/octet-stream exe
application/octet-stream lha
application/octet-stream lzh
application/oda oda
application/olescript axs

application/pdf pdf
application/pics-rules prf


application/pkcs10 p10
application/pkix-crl crl
application/postscript ai
application/postscript eps
application/postscript ps
application/rtf rtf
application/set-payment-initiation setpay
application/set-registration-initiation setreg
application/vnd.ms-excel xla
application/vnd.ms-excel xlc
application/vnd.ms-excel xlm
application/vnd.ms-excel xls
application/vnd.ms-excel xlt
application/vnd.ms-excel xlw
application/vnd.ms-outlook msg
application/vnd.ms-pkicertstore sst
application/vnd.ms-pkiseccat cat
application/vnd.ms-pkistl stl
application/vnd.ms-powerpoint pot
application/vnd.ms-powerpoint pps
application/vnd.ms-powerpoint ppt
application/vnd.ms-project mpp
application/vnd.ms-works wcm
application/vnd.ms-works wdb
application/vnd.ms-works wks
application/vnd.ms-works wps
application/winhlp hlp
application/x-bcpio bcpio
application/x-cdf cdf
application/x-compress z
application/x-compressed tgz
application/x-cpio cpio
application/x-csh csh
application/x-director dcr
application/x-director dir
application/x-director dxr
application/x-dvi dvi
application/x-gtar gtar
application/x-gzip gz
application/x-hdf hdf
application/x-internet-signup ins
application/x-internet-signup isp
application/x-iphone iii
application/x-javascript js
application/x-latex latex
application/x-msaccess mdb
application/x-mscardfile crd
application/x-msclip clp
application/x-msdownload dll
application/x-msmediaview m13
application/x-msmediaview m14
application/x-msmediaview mvb
application/x-msmetafile wmf
application/x-msmoney mny
application/x-mspublisher pub
application/x-msschedule scd
application/x-msterminal trm
application/x-mswrite wri
application/x-netcdf cdf
application/x-netcdf nc
application/x-perfmon pma
application/x-perfmon pmc
application/x-perfmon pml
application/x-perfmon pmr
application/x-perfmon pmw
application/x-pkcs12 p12
application/x-pkcs12 pfx
application/x-pkcs7-certificates p7b
application/x-pkcs7-certificates spc
application/x-pkcs7-certreqresp p7r
application/x-pkcs7-mime p7c
application/x-pkcs7-mime p7m
application/x-pkcs7-signature p7s
application/x-sh sh
application/x-shar shar
application/x-shockwave-flash swf
application/x-stuffit sit
application/x-sv4cpio sv4cpio
application/x-sv4crc sv4crc
application/x-tar tar
application/x-tcl tcl
application/x-tex tex
application/x-texinfo texi
application/x-texinfo texinfo
application/x-troff roff
application/x-troff t
application/x-troff tr
application/x-troff-man man
application/x-troff-me me
application/x-troff-ms ms
application/x-ustar ustar
application/x-wais-source src
application/x-x509-ca-cert cer
application/x-x509-ca-cert crt
application/x-x509-ca-cert der
application/ynd.ms-pkipko pko
application/zip zip
audio/basic au
audio/basic snd
audio/mid mid
audio/mid rmi
audio/mpeg mp3
audio/x-aiff aif
audio/x-aiff aifc
audio/x-aiff aiff
audio/x-mpegurl m3u
audio/x-pn-realaudio ra
audio/x-pn-realaudio ram
audio/x-wav wav
image/bmp bmp
image/cis-cod cod
image/gif gif
image/ief ief
image/jpeg jpe
image/jpeg jpeg
image/jpeg jpg
image/pipeg jfif
image/svg+xml svg
image/tiff tif
image/tiff tiff
image/x-cmu-raster ras
image/x-cmx cmx
image/x-icon ico
image/x-portable-anymap pnm
image/x-portable-bitmap pbm
image/x-portable-graymap pgm
image/x-portable-pixmap ppm
image/x-rgb rgb
image/x-xbitmap xbm
image/x-xpixmap xpm
image/x-xwindowdump xwd
message/rfc822 mht
message/rfc822 mhtml
message/rfc822 nws
text/css css
text/h323 323
text/html htm
text/html html
text/html stm
text/iuls uls
text/plain bas
text/plain c
text/plain h
text/plain txt
text/richtext rtx
text/scriptlet sct
text/tab-separated-values tsv
text/webviewhtml htt
text/x-component htc
text/x-setext etx
text/x-vcard vcf
video/mpeg mp2
video/mpeg mpa
video/mpeg mpe
video/mpeg mpeg
video/mpeg mpg
video/mpeg mpv2
video/quicktime mov
video/quicktime qt
video/x-la-asf lsf
video/x-la-asf lsx
video/x-ms-asf asf
video/x-ms-asf asr
video/x-ms-asf asx
video/x-msvideo avi
video/x-sgi-movie movie
x-world/x-vrml flr
x-world/x-vrml vrml
x-world/x-vrml wrl
x-world/x-vrml wrz
x-world/x-vrml xaf
x-world/x-vrml xof

参考




### 修改 MIME 类型以成功执行上传文件请求 在执行文件上传操作时,服务器通常会对上传文件的 MIME 类型进行检查,以确保只接受特定类型的文件。如果上传的文件 MIME 类型不符合要求,请求可能会被忽略或拒绝。为绕过此类限制,可以通过修改 HTTP 请求中的 `Content-Type` 字段来更改 MIME 类型[^1]。 #### 1. 使用工具修改 MIME 类型 使用诸如 Burp Suite 或 Postman 等工具可以手动修改 HTTP 请求头中的 `Content-Type` 值。例如,若目标服务器仅允许上传图片类型(如 `image/jpeg`、`image/png`),可将原本为脚本文件(如 `.php`)的 MIME 类型更改为 `image/png`,从而通过服务器端的 MIME 类型检查机制[^2]。 以下是一个使用 Python 的 `requests` 库发送 POST 请求并修改 MIME 类型的示例: ```python import requests url = "http://example.com/upload" file_path = "shell.php" # 自定义文件元数据,包括MIME类型 files = { 'file': ( 'shell.php', open(file_path, 'rb'), 'image/png' # 将MIME类型伪装为PNG图像 ) } response = requests.post(url, files=files) print(response.text) ``` 此代码将文件 `shell.php` 上传至目标服务器,并将其 MIME 类型设置为 `image/png`,以此绕过对非图片类型文件的限制[^3]。 #### 2. 文件内容伪装以绕过深度检测 某些服务器不仅会检查 `Content-Type` 头部字段,还会读取文件的前几个字节(即“魔数”)来判断真实文件类型。此时,仅修改 MIME 类型可能不足以绕过检测。一种常见方法是将恶意代码嵌入到一个合法文件中,例如在 PNG 图像文件中插入 PHP 代码。这种文件的 MIME 类型为 `image/png`,但其内容包含可执行代码,从而实现绕过 MIME 检查的同时仍能被执行[^4]。 例如,制作一个 GIF 格式的 WebShell 文件 `phpinfo.gif`,其中包含如下内容: ``` GIF89a <?php phpinfo(); ?> ``` 该文件的前 6 个字节符合 GIF 图像格式的魔数标识(`GIF89a`),而后续内容则为 PHP 脚本代码。上传此类文件时,服务器会将其识别为 GIF 图像,从而通过 MIME 类型和文件头检测。 #### 3. 利用服务器扩展名映射漏洞 部分服务器依据文件扩展名来推断 MIME 类型,而非严格依赖 HTTP 请求头中的 `Content-Type`。例如,`.php5` 或 `.phtml` 扩展名可能未被列入黑名单,但实际仍会被服务器解析为 PHP 脚本。因此,尝试更改文件扩展名也是一种有效的绕过方式[^1]。 ---
评论
成就一亿技术人!
拼手气红包6.0元
还能输入1000个字符
 
红包 添加红包
表情包 插入表情
 条评论被折叠 查看
添加红包

请填写红包祝福语或标题

红包个数最小为10个

红包金额最低5元

当前余额3.43前往充值 >
需支付:10.00
成就一亿技术人!
领取后你会自动成为博主和红包主的粉丝 规则
hope_wisdom
发出的红包
实付
使用余额支付
点击重新获取
扫码支付
钱包余额 0

抵扣说明:

1.余额是钱包充值的虚拟货币,按照1:1的比例进行支付金额的抵扣。
2.余额无法直接购买下载,可以购买VIP、付费专栏及课程。

余额充值