A brief analysis of HTTP alternative post-header data RFC1867 protocol format

yesterday in the Combat form simulation submission, there are found in the submission of a form, the page (discuz. Forum) error, unable to detect the source of data and so on, but I did submit a http_referer ah, how can this happen? Asked the next haohappy, he gave a pear class, http/client, just found, I studied for a few days of Dongdong, there is a ready-made can use, "use pear standing on the shoulders of giants", this is not wrong. Try to assemble a client in a few days. Again pull far, book back to the story, said to study an alternative post head, why say alternative, because the general post head of the content-type:application/x-www-form-urlencoded and his is content-type: Multipart/form-data; boundary=-------7d71f4234700b8 Then there is the difference between the two. 1, has done the form HTML coder all know, when needs to have uploads the file operation, the form type must be Enctype= "Multipart/form-data", then here also for this reason, investigates its origin, can trace back to the RFC1867 agreement,   This protocol is mainly based on the HTTP protocol for the input tag added to the file attribute, while defining the form must be post,enctype must be multipart/form-data. 2, the latter increased the boundary, the so-called boundary is actually split line, RFC1867 use Boundary Segmentation HTTP Entity data.   The numeric character areas in boundary are randomly generated. 3. Changes to HTTP Entities

Because RFC1867 adds the ability to upload files, the content of uploaded files will naturally be added to the HTTP entity. Now because there are both HTTP-generic parameter entities and entities that upload files, each entity is split with boundary, and the HTTP entity will look something like the following:

-----------------------------7d71f4234700b8
Content-disposition:form-data; Name= "Formhash"


59329e15
-----------------------------7d71f4234700b8
Content-disposition:form-data; Name= "Isblog"




-----------------------------7d71f4234700b8
Content-disposition:form-data; Name= "FID"


104
-----------------------------7d71f4234700b8
Content-disposition:form-data; Name= "Subject"


Test
-----------------------------7d71f4234700b8
Content-disposition:form-data; Name= "iconID"


0
-----------------------------7d71f4234700b8
Content-disposition:form-data; Name= "Usesig"


1
-----------------------------7d71f4234700b8
Content-disposition:form-data; Name= "Message"


Test
-----------------------------7d71f4234700b8
Content-disposition:form-data; Name= "attachperm[]"


0
-----------------------------7d71f4234700b8
Content-disposition:form-data; Name= "attachdesc[]"




-----------------------------7d71f4234700b8
Content-disposition:form-data; Name= "attach[]"; Filename= ""
Content-type:application/octet-stream




-----------------------------7d71f4234700b8
Content-disposition:form-data; Name= "attachperm[]"


0
-----------------------------7d71f4234700b8
Content-disposition:form-data; Name= "attachdesc[]"




-----------------------------7d71f4234700b8
Content-disposition:form-data; Name= "attach[]"; Filename= ""
Content-type:application/octet-stream




-----------------------------7d71f4234700b8
Content-disposition:form-data; Name= "WYSIWYG"


1
-----------------------------7d71f4234700b8--

Obviously, the HTTP entity becomes slightly more complex after the file is uploaded, first by separating the entities through boundary to facilitate reading, and then restricting the format of the FileUpload.

4, then again, this format also needs to provide the Content-length attribute, then compare with the simple post data head, can discover, the change place has:

......

Content-type:

......
Content-length:

......

Data body goes here~

When you notice the changes in these places, you can post them as usual.

Written in the final, in this combat post process, I used wsockexport this software to carry out the bag operation, so that the whole process simplified a lot, here to pay tribute to the author, (Btw:rising to the Hook.dll seem not to like, when everyone uses, please turn off antivirus software, or join the white list)