victim.py

import socket
import os

# 服务器地址和端口
server_address = ("127.0.0.1", 8080)


def main():
    # 创建一个 TCP/IP 套接字
    s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)

    try:
        # 连接到服务器
        s.connect(server_address)
        # 构造正常请求 Content-Length == length(POST_BODY)
        print("[*] Sending and receive normal request...")
        post_request = (
            "POST /vulnerable.jsp HTTP/1.1\r\n"
            "Host: localhost\r\n"
            "Connection: keep-alive\r\n"
            "Content-Type: application/x-www-form-urlencoded\r\n"
            "Content-Length: 1488\r\n"
            "\r\n"
            "id=123456789123456789123456789123456789123456789123456789123456789123456789123456789123456789123456789123456789123456789123456789123456789123456789123456789123456789123456789123456789123456789123456789123456789123456789123456789123456789123456789123456789123456789123456789123456789123456789123456789123456789123456789123456789123456789123456789123456789123456789123456789123456789123456789123456789123456789123456789123456789123456789123456789123456789123456789123456789123456789123456789123456789123456789123456789123456789123456789123456789123456789123456789123456789123456789123456789123456789123456789123456789123456789123456789123456789123456789123456789123456789123456789123456789123456789123456789123456789123456789123456789123456789123456789123456789123456789123456789123456789123456789123456789123456789123456789123456789123456789123456789123456789123456789123456789123456789123456789123456789123456789123456789123456789123456789123456789123456789123456789123456789123456789123456789123456789123456789123456789123456789123456789123456789123456789123456789123456789123456789123456789123456789123456789123456789123456789123456789123456789123456789123456789123456789123456789123456789123456789123456789123456789123456789123456789123456789123456789123456789123456789123456789123456789123456789123456789123456789123456789123456789123456789123456789123456789123456789123456789123456789123456789123456789123456789123456789123456789123456789123456789123456789123456789123456789123456789"
        )
        # normal_body = "id=123456789123456789123456789123456789123456789"
        # 发送请求
        s.sendall(post_request.encode("utf-8"))
        # 接收响应
        response = []
        while True:
            data = s.recv(1024)
            if not data:
                break
            response.append(data)

        data = b"".join(response).decode("utf-8")
        # s.recv(2048)

        # print(f"[*] Received normal response:\n{response.decode('utf-8')}")
        print(f"[*] Received normal response:\n{data}")
        # 保持 socket 连接
        # import attacker

        # attacker.main()

        input("[*] Press Enter to close socket connection...")

    except Exception as e:
        print(f"An error occurred: {e}")

    finally:
        # 确保套接字关闭
        s.close()


if __name__ == "__main__":
    main()