目录
1. HttpURLConnection简介
JDK 自带的 HttpURLConnection 标准库,是一个多用途、轻量级的http客户端。它对网络请求的封装没有Httpclient彻底，api比较简单，用起来没有那么方便。但是正是由于此，使得我们能更容易的扩展和优化的HttpURLConnection。HttpURLConnection继承URLConnection，底层socket，最原始通信，使用HttpURLConnection 发起 HTTP 请求最大的优点是不需要引入额外的依赖。但无法提供额外的功能.
2.创建 HttpURLConnection请求.
urlstring = "http://xxxx"
URL url=new URL(urlstring);//传入url
HttpURLConnection connection =(HttpuRLConnection)url.openConnection();2.1 HttpURLConnection的属性
int getResponsecode();//获取服务器的响应代码。
String getResponseMessage();//获取服务器的响应消息。
string getResponseMethod();//获取发送请求的方法
void setRequestMethod(string method);//设置发送请求的方法2.2 设置相关的请求属性
//设置连接超时时间
connection.setConnectTimeout(5000); //5*1000
//设置读取超时时间
connection.setReadTime0ut(15000);
//设置请求参数，即具体的 HTTP方法
connection.setRequestMethod("GET");
connection.setRequestMethod("POST");
//添加 HTTPHEAD中的一些参数，可参考《Java 核心技术 卷II》
connection.setRequestProperty("connection",“Keep-Alive”);
//设置是否向 httpUrlconnection 输出，
//对于post请求，参数要放在 http正文内，因此需要设为true。
// 默认情况下是false;
connection.setDo0utput(true);
//设置是否从 httpUrlconnection 读入，默认情况下是true;
connection.setDoInput(true);2.3 设置请求头参数
//设置发送请求的类型
connection.setRequestProperty("content-Type","application/x-www-form-urlencoded");//设置浏览器头信息3 使用GET方法进行请求
package com.deger;
import java.io.BufferedReader;
import java.io.InputStream;
import java.io.InputStreamReader;
import java.net.HttpURLConnection;
import java.net.URL;
import java.net.URLConnection;
public class SendUtil {
public static void main(String[] args) throws Exception{
//调用方法
System.out.println(doget("https://www.xxxxx.com", "name=admin"));
}
public static String doget(String urlstr,String params) throws Exception{
// 接收返回结果
String res = null;
//创建url对象
URL url = new URL(urlstr + "?" + params);
// 通过url对象获取 HttpURLConnection对象
HttpURLConnection connection = (HttpURLConnection) url.openConnection();
//设置请求方法
connection.setRequestMethod("GET");
//设置连接超时时间毫秒
connection.setConnectTimeout(5000); //5*1000
//设置主机读取的响应时间毫秒
connection.setReadTimeout(5000);
//...设置请求头信息等等
//发起请求
connection.connect();
//获取状态码
int responseCode = connection.getResponseCode();
if (responseCode == HttpURLConnection.HTTP_OK) {
// 响应字节流 connection.getInputStream()
// 将字节流转为为字符流 InputStreamReader
// BufferedReader 缓冲输入流
BufferedReader br = new BufferedReader(new InputStreamReader(connection.getInputStream(), "UTF-8"));
StringBuffer sb = new StringBuffer();
String line=null;
while ((line=br.readLine())!=null){
sb.append(line);
}
res = sb.toString();
}
connection.disconnect();
return res;
}
}测试服务器可以用PHPStudy搭建环境,下面是test.php文件的代码
<?php
var_dump($_REQUEST);
4.POST方法进行请求
4.1 常规使用
public static void main(String[] args) throws Exception{
//调用方法
// System.out.println(doget("http://127.0.0.1/test.php?username=1234"));
System.out.println(dopost("http://127.0.0.1/test.php","username=hacker"));
}
//post方法进行请求
public static String dopost(String urlstr,String params) throws Exception{
// 接收返回结果
String res = null;
//创建url对象
// URL url = new URL(urlstr + "?" + params);
URL url = new URL(urlstr);
// 通过url对象获取 HttpURLConnection对象
HttpURLConnection connection = (HttpURLConnection) url.openConnection();
//设置请求方法
connection.setRequestMethod("POST");
//设置连接超时时间毫秒
connection.setConnectTimeout(5000); //5*1000
//设置主机读取的响应时间毫秒
connection.setReadTimeout(5000);
//设置正文的请求
connection.setDoOutput(true);
//设置请求的类型是 application/x-www-form-urlencoded application/json
connection.setRequestProperty("Content-Type", "application/x-www-form-urlencoded");
//设置请求的浏览器信息(请求头)
connection.setRequestProperty("User-Agent", "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.3");
//发起请求--最后需要关闭连接
connection.connect();
//设置正文的数据
OutputStream outputStream = connection.getOutputStream();
outputStream.write(params.getBytes("UTF-8"));
//获取状态码
int responseCode = connection.getResponseCode();
if (responseCode == HttpURLConnection.HTTP_OK) {
// 响应字节流 connection.getInputStream()
// 将字节流转为为字符流 InputStreamReader
// BufferedReader 缓冲输入流
BufferedReader br = new BufferedReader(new InputStreamReader(connection.getInputStream(), "UTF-8"));
StringBuffer sb = new StringBuffer();
String line=null;
while ((line=br.readLine())!=null){
sb.append(line);
}
res = sb.toString();
}
//关闭连接
connection.disconnect();
return res;
}
4.2 单独调用
单独创建一个主函数,然后来调用也是可以的
package com.deger;
public class Main {
public static void main(String[] args) throws Exception{
//写逻辑,然后调用工具类的方法就可以了
String doget = SendUtil.doget("http://127.0.0.1/test.php?username=admin");
System.out.println(doget);
String dopost = SendUtil.dopost("http://127.0.0.1/test.php", "username=hacker");
System.out.println(dopost);
}
}
5. 设置代理
5.1 直接设置代理
System.setProperty("http.proxyHost","127.0.0.1");
System.setProperty("http.proxyPort","8888");
L url = new URL(urlstr);
HttpURLConnection connection = (HttpURLConnection) url.openConnection();5.2 配置Proxy代理类
//配置代理类
Proxy proxy = new Proxy(Proxy.Type.HTTP, new InetsocketAddress("127.0.8.1",8888));
URL url = new URL(path);
//通过代理类建立连接
HttpURLConnection conn =(HttpURLconnection)url.openonnection(proxy);burp多添加一个代理端口
注意抓到的包的UA头,为了防止服务器监测,可以在创建HttpURLConnection后,在发送请求前时设置UA头
抓到的包可以发送到burp的重放器模块,然后或者其他模块,然后就可以进行测试了
6.https请求协议引起的证书信任问题解决
现在多数的网站都是https协议 网站是https请求的是http会出现错,可以使用 URL中的 httpsURLconnection 这个协议是请求https请求但是还要设置证书
6.1 解决方法:信任所有证书忽略检测
信任管理器
final static HostnameVerifier DO_NOT_VERIFY = new HostnameVerifier() {
@Override
public boolean verify(String hostname, SSLSession session) {
return true; // 将所有验证的结果都设为true，不进行主机名验证
}
};
private static void trustAllHosts() {
final String TAG = "trustAllHosts";
// 创建信任所有证书的信任管理器
TrustManager[] trustAllCerts = new TrustManager[]{
new X509TrustManager() {
@Override
public X509Certificate[] getAcceptedIssuers() {
return new X509Certificate[]{};
}
@Override
public void checkClientTrusted(X509Certificate[] chain, String authType) {
// 不做任何检查，信任所有客户端证书
}
@Override
public void checkServerTrusted(X509Certificate[] chain, String authType) {
// 不做任何检查，信任所有服务器证书
}
}
};
// 安装信任管理器
try {
SSLContext sc = SSLContext.getInstance("TLS");
sc.init(null, trustAllCerts, new SecureRandom());
HttpsURLConnection.setDefaultSSLSocketFactory(sc.getSocketFactory());
} catch (Exception e) {
e.printStackTrace();
}
}6.2 具体实现
//get方法进行请求
public static String doget(String urlstr) throws Exception{
HttpURLConnection connection;
HttpsURLConnection httpsURLConnection;
//设置一代理类
Proxy proxy = new Proxy(Proxy.Type.HTTP, new InetSocketAddress("127.0.0.1", 8888));
// 需要删掉这个参数String params
// 接收返回结果
String res = null;
//创建url对象
// URL url = new URL(urlstr + "?" + params);
URL url = new URL(urlstr);
// 处理http与https
trustAllHosts();
httpsURLConnection = (HttpsURLConnection)url.openConnection(proxy);
//判断是https请求还是http请求
if (url.getProtocol().toLowerCase().equals("https")) {
httpsURLConnection.setHostnameVerifier(DO_NOT_VERIFY);
connection = httpsURLConnection;
} else {
connection = (HttpURLConnection) url.openConnection();
}
//设置请求方法
connection.setRequestMethod("GET");
//设置连接超时时间毫秒
connection.setConnectTimeout(5000); //5*1000
//设置主机读取的响应时间毫秒
connection.setReadTimeout(5000);
//...设置请求头信息等等
//发起请求--最后需要关闭连接
connection.connect();
//获取状态码
int responseCode = connection.getResponseCode();
if (responseCode == HttpURLConnection.HTTP_OK) {
// 响应字节流 connection.getInputStream()
// 将字节流转为为字符流 InputStreamReader
// BufferedReader 缓冲输入流
BufferedReader br = new BufferedReader(new InputStreamReader(connection.getInputStream(), "UTF-8"));
StringBuffer sb = new StringBuffer();
String line = null;
while ((line = br.readLine()) != null){
sb.append(line);
}
res = sb.toString();
}
//关闭连接
connection.disconnect();
return res;
}6.3 未设置信任管理器下的请求
6.4 代码实现设置后
扫一扫
1138
被折叠的 条评论
为什么被折叠?
到【灌水乐园】发言
