php curl帶有csrf-token驗證類比提交方法

最後更新：2018-04-18 來源：互聯網

上載者：User

創建阿里雲帳戶，並獲得超過 40 款產品的免費試用版；而企業帳戶則可以享有總值 $1200 的免費試用版。立即註冊！

這篇文章主要介紹了詳解php curl帶有csrf-token驗證類比提交方法，現在分享給大家，也給大家做個參考。一起跟隨小編過來看看吧

通常為了安全會在表單裡加入一個隨機的token值來防止csrf攻擊。

要想類比提交有token驗證的網站其實也不難。

1.通過正則擷取token
2.帶上擷取到的token類比提交

下面是一個成功的例子

目錄結構

│ form.php –需要類比的表單 │ getForm.php – 類比提交程式 │ post.php –表單驗證程式 │ └─cookie – cookie存放目錄

getForm.php

<?php$cookie_file = './cookie/'.time().'.cookie';$str = getResponse('http://a.curl.com:81/form.php',[],$cookie_file);setcookie("PHPSESSID", "vc0heoa6lfsi3gger54pkns152");preg_match('/<input name="token" type="hidden" value="(.*)"/U', $str, $match);$post['token'] = $match[1];$post['name'] = '3333333';$post['password'] = '12121213';print_r(getResponse('http://a.curl.com:81/post.php', $post, $cookie_file));function getResponse($url, $data=[], $cookie_file='', $timeout = 3)  {    if(empty($cookie_file))    {      $cookie_file = '.cookie';    }    $ch = curl_init();    curl_setopt($ch, CURLOPT_URL, $url);    curl_setopt($ch, CURLOPT_REFERER, "https://www.baidu.com");  //構造來路    curl_setopt($ch, CURLOPT_USERAGENT,"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/54.0.2840.59 Safari/537.36");    if(!empty($data))    {      curl_setopt($ch, CURLOPT_POST, true);      curl_setopt($ch, CURLOPT_POSTFIELDS, $data);    }    curl_setopt($ch, CURLOPT_COOKIEJAR, $cookie_file);// 取cookie的參數是    curl_setopt ($ch, CURLOPT_COOKIEFILE, $cookie_file); //發送cookie    curl_setopt($ch, CURLOPT_RETURNTRANSFER, 1);    curl_setopt($ch, CURLOPT_CONNECTTIMEOUT, $timeout);    try    {       $handles = curl_exec($ch);       curl_close($ch);       return $handles;    }    catch (Exception $e)    {      echo 'Caught exception: ', $e->getMessage(), "\n";    }    unlink($cookie_file);  }

form.php

<?phpsession_start();$_SESSION['token'] = md5($_SERVER['REQUEST_TIME']);$_SESSION['time'] = date("Y-m-d H:i:s");session_write_close();//echo $_SESSION['auth'];?><!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"><html xmlns="http://www.w3.org/1999/xhtml"> <head> <title> new document </title> <meta name="generator" content="editplus" /> <meta name="author" content="" /> <meta name="keywords" content="" /> <meta name="description" content="" /> </head> <body><form action="post.php" method="post">  <p><input name="name" type="text"></p>  <p><input name="password" type="password"></p>  <p><input name="token" type="hidden" value="<?php echo $_SESSION['token']?>"></p>  <p><input type="submit"></p></form> </body></html>

post.php

<?phpsession_start();if(empty($_POST['token'])){  exit ("token is empty!");}if(empty($_SESSION['token'])){ exit ("session is empty");}if($_POST['token'] != $_SESSION['token']){  exit ("token ");} else{  unset($_SESSION['token']);}echo PHP_EOL;echo "pass";print_r($_REQUEST);echo PHP_EOL;print_r($_SERVER);

本文章原先以中文撰寫並發佈於 aliyun.com，亦設英文版本，僅作資訊用途。本網站不對文章的準確性，完整性或可靠性或其任何翻譯作出任何明示或暗示的陳述或保證。如對該文章有任何疑慮或投訴，請傳送電郵至 info-contact@alibabacloud.com 並提供相關疑慮或投訴的詳細說明。職員會於 5 個工作天內與您聯絡，一經驗證之後，即會刪除該侵權內容。

A Free Trial That Lets You Build Big!

Start building with 50+ products and up to 12 months usage for Elastic Compute Service

Get Started for Free

Sales Support

1 on 1 presale consultation

Chat Contact Sales
After-Sales Support

24/7 Technical Support 6 Free Tickets per Quarter Faster Response

Open a Ticket
Alibaba Cloud offers highly flexible support services tailored to meet your exact needs.

Learn More