http协议自学（5）

http协议比较重要的部分————表单

首先我们还是使用上次测试cookies的代码（两次要测试的东西很接近，不是吗？）：

uses zul_socket;
var
 server:Tserver;
 b:Vlabel;
 port:Vport;
 procedure responder;
 var
  s,resp:ansistring;
  fin:text;
  ch:char;
 begin
  repeat
   s:=server.recv(b);
  until s<>'';
  writeln(s);
  resp:='HTTP/1.1 200 OK'+#13#10+'Content-Type: text/html'+#13#10#13#10;
  assign(fin,'test.html');
  reset(fin);
  while not eof(fin) do
   begin
    read(fin,ch);
    resp:=resp+ch;
   end;
  close(fin);
  server.send(resp,b);
  server.close(b);
  writeln('connection of ',b,' has ended');
 end;
begin
 port:=8000;
 server:=Tserver.create(port);
 writeln('opened the port of:',port);
 server.init;
 writeln('init success');
 while true do
  begin
   b:=server.accept;
   writeln('connected:',b);
   responder;
  end;
end.

但是这次的test.html要改成这样：

<html>
    <head>
        <title>test</title>
        <meta charset="utf-8">
    </head>
    <body>
        <form method="GET" action="test.html">
            <input type="input" name="wtf">
            <input type="submit">
        </form>
    </body>
</html>

然后我访问这个网站（什么都没有输入的时候，显示：

connected:416
GET / HTTP/1.1
Host: localhost:8000
Connection: keep-alive
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/73.0.3683.103 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3
Accept-Encoding: gzip, deflate, br
Accept-Language: zh-CN,zh;q=0.9


connection of 416 has ended
connected:416
GET /favicon.ico HTTP/1.1
Host: localhost:8000
Connection: keep-alive
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/73.0.3683.103 Safari/537.36
Accept: image/webp,image/apng,image/*,*/*;q=0.8
Referer: http://localhost:8000/
Accept-Encoding: gzip, deflate, br
Accept-Language: zh-CN,zh;q=0.9


connection of 416 has ended
connected:420

注意第二段中的Referer

这个主要是用来验证和防御CSRF攻击的

但是我们现在不需要管那么多：

我们来发送一个表单试试；

咦，怎么no response?

此处应该有多线程

修改后的代码：

uses zul_socket,windows;
var
 server:Tserver;
 b:Vlabel;
 port:Vport;
 trdno:dword;
 procedure responder;stdcall;
 var
  s,resp:ansistring;
  fin:text;
  ch:char;
 begin
  repeat
   s:=server.recv(b);
  until s<>'';
  writeln(s);
  resp:='HTTP/1.1 200 OK'+#13#10+'Content-Type: text/html'+#13#10#13#10;
  assign(fin,'test.html');
  reset(fin);
  while not eof(fin) do
   begin
    read(fin,ch);
    resp:=resp+ch;
   end;
  close(fin);
  server.send(resp,b);
  server.close(b);
  writeln('connection of ',b,' has ended');
 end;
begin
 port:=8000;
 server:=Tserver.create(port);
 writeln('opened the port of:',port);
 server.init;
 writeln('init success');
 while true do
  begin
   b:=server.accept;
   writeln('connected:',b);
   createthread(nil,0,@responder,nil,0,trdno);
  end;
end.

然后我在输入框中输入123后提交表单：

于是程序又有了如下输出：

connected:412
GET /test.html?wtf=123 HTTP/1.1
Host: localhost:8000
Connection: keep-alive
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/73.0.3683.103 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3
Referer: http://localhost:8000/
Accept-Encoding: gzip, deflate, br
Accept-Language: zh-CN,zh;q=0.9


connection of 412 has ended
connected:448
GET /favicon.ico HTTP/1.1
Host: localhost:8000
Connection: keep-alive
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/73.0.3683.103 Safari/537.36
Accept: image/webp,image/apng,image/*,*/*;q=0.8
Referer: http://localhost:8000/test.html?wtf=123
Accept-Encoding: gzip, deflate, br
Accept-Language: zh-CN,zh;q=0.9


connection of 448 has ended
connected:416

注意两次握手时Referer的不同值

那个C什么攻击下次再测

Never too old to learn.

目录