JAVA-Exploit编写(1)--HttpURLConnection库使用

JDK 自带的 HttpURLConnection 标准库,是一个多用途、轻量级的http客户端。它对网络请求的封装没有Httpclient彻底，api比较简单，用起来没有那么方便。但是正是由于此，使得我们能更容易的扩展和优化的HttpURLConnection。HttpURLConnection继承URLConnection，底层socket，最原始通信，使用HttpURLConnection 发起 HTTP 请求最大的优点是不需要引入额外的依赖。但无法提供额外的功能.

2.创建 HttpURLConnection请求.

urlstring = "http://xxxx"
URL url=new URL(urlstring);//传入url
HttpURLConnection connection =(HttpuRLConnection)url.openConnection();

2.1 HttpURLConnection的属性

int getResponsecode();//获取服务器的响应代码。
String getResponseMessage();//获取服务器的响应消息。
string getResponseMethod();//获取发送请求的方法
void setRequestMethod(string method);//设置发送请求的方法

2.2 设置相关的请求属性

//设置连接超时时间
connection.setConnectTimeout(5000); //5*1000
//设置读取超时时间
connection.setReadTime0ut(15000);
//设置请求参数，即具体的 HTTP方法
connection.setRequestMethod("GET");
connection.setRequestMethod("POST");
//添加 HTTPHEAD中的一些参数，可参考《Java 核心技术 卷II》
connection.setRequestProperty("connection",“Keep-Alive”);
//设置是否向 httpUrlconnection 输出，
//对于post请求，参数要放在 http正文内，因此需要设为true。
// 默认情况下是false;
connection.setDo0utput(true);
//设置是否从 httpUrlconnection 读入，默认情况下是true;
connection.setDoInput(true);

2.3 设置请求头参数

//设置发送请求的类型
connection.setRequestProperty("content-Type","application/x-www-form-urlencoded");//设置浏览器头信息

3 使用GET方法进行请求

package com.deger;

import java.io.BufferedReader;
import java.io.InputStream;
import java.io.InputStreamReader;
import java.net.HttpURLConnection;
import java.net.URL;
import java.net.URLConnection;

public class SendUtil {
    public static void main(String[] args) throws Exception{
        //调用方法
        System.out.println(doget("https://www.xxxxx.com", "name=admin"));
    }
    public static String doget(String urlstr,String params) throws Exception{
        // 接收返回结果
        String res = null;
        //创建url对象
        URL url = new URL(urlstr + "?" + params);
        // 通过url对象获取 HttpURLConnection对象
        HttpURLConnection connection = (HttpURLConnection) url.openConnection();
        //设置请求方法
        connection.setRequestMethod("GET");
        //设置连接超时时间毫秒
        connection.setConnectTimeout(5000); //5*1000
        //设置主机读取的响应时间毫秒
        connection.setReadTimeout(5000);
        //...设置请求头信息等等

        //发起请求
        connection.connect();
        
        //获取状态码
        int responseCode = connection.getResponseCode();
        if (responseCode == HttpURLConnection.HTTP_OK) {
            // 响应字节流 connection.getInputStream()
            // 将字节流转为为字符流 InputStreamReader
            // BufferedReader 缓冲输入流
            BufferedReader br = new BufferedReader(new InputStreamReader(connection.getInputStream(), "UTF-8"));
            StringBuffer sb = new StringBuffer();
            String line=null;
            while ((line=br.readLine())!=null){
                sb.append(line);
            }
             res = sb.toString();
        }
        connection.disconnect();
        return res;
    }
}

测试服务器可以用PHPStudy搭建环境,下面是test.php文件的代码

<?php
var_dump($_REQUEST);

4.POST方法进行请求

4.1 常规使用

public static void main(String[] args) throws Exception{
        //调用方法
//        System.out.println(doget("http://127.0.0.1/test.php?username=1234"));
        System.out.println(dopost("http://127.0.0.1/test.php","username=hacker"));
    }

//post方法进行请求
    public static String dopost(String urlstr,String params) throws Exception{

        // 接收返回结果
        String res = null;
        //创建url对象
//        URL url = new URL(urlstr + "?" + params);
        URL url = new URL(urlstr);
        // 通过url对象获取 HttpURLConnection对象
        HttpURLConnection connection = (HttpURLConnection) url.openConnection();
        //设置请求方法
        connection.setRequestMethod("POST");
        //设置连接超时时间毫秒
        connection.setConnectTimeout(5000); //5*1000
        //设置主机读取的响应时间毫秒
        connection.setReadTimeout(5000);

        //设置正文的请求
        connection.setDoOutput(true);
        //设置请求的类型是 application/x-www-form-urlencoded application/json
        connection.setRequestProperty("Content-Type", "application/x-www-form-urlencoded");
        //设置请求的浏览器信息(请求头)
        connection.setRequestProperty("User-Agent", "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.3");


        //发起请求--最后需要关闭连接
        connection.connect();

        //设置正文的数据
        OutputStream outputStream = connection.getOutputStream();
        outputStream.write(params.getBytes("UTF-8"));
        //获取状态码
        int responseCode = connection.getResponseCode();
        if (responseCode == HttpURLConnection.HTTP_OK) {
            // 响应字节流 connection.getInputStream()
            // 将字节流转为为字符流 InputStreamReader
            // BufferedReader 缓冲输入流
            BufferedReader br = new BufferedReader(new InputStreamReader(connection.getInputStream(), "UTF-8"));
            StringBuffer sb = new StringBuffer();
            String line=null;
            while ((line=br.readLine())!=null){
                sb.append(line);
            }
            res = sb.toString();
        }
        //关闭连接
        connection.disconnect();
        return res;
    }

4.2 单独调用

单独创建一个主函数,然后来调用也是可以的

package com.deger;

public class Main {
    public static void main(String[] args) throws Exception{
       //写逻辑,然后调用工具类的方法就可以了
        String doget = SendUtil.doget("http://127.0.0.1/test.php?username=admin");
        System.out.println(doget);
        String dopost = SendUtil.dopost("http://127.0.0.1/test.php", "username=hacker");
        System.out.println(dopost);
    }
}

5. 设置代理

5.1 直接设置代理

System.setProperty("http.proxyHost","127.0.0.1");
System.setProperty("http.proxyPort","8888");
L url = new URL(urlstr);
HttpURLConnection connection = (HttpURLConnection) url.openConnection();

5.2 配置Proxy代理类

//配置代理类
Proxy proxy = new Proxy(Proxy.Type.HTTP, new InetsocketAddress("127.0.8.1",8888));
URL url = new URL(path);
//通过代理类建立连接
HttpURLConnection conn =(HttpURLconnection)url.openonnection(proxy);

burp多添加一个代理端口

注意抓到的包的UA头,为了防止服务器监测,可以在创建HttpURLConnection后,在发送请求前时设置UA头

抓到的包可以发送到burp的重放器模块,然后或者其他模块,然后就可以进行测试了

6.https请求协议引起的证书信任问题解决

现在多数的网站都是https协议网站是https请求的是http会出现错,可以使用 URL中的 httpsURLconnection 这个协议是请求https请求但是还要设置证书

6.1 解决方法:信任所有证书忽略检测

信任管理器

final static HostnameVerifier DO_NOT_VERIFY = new HostnameVerifier() {
        @Override
        public boolean verify(String hostname, SSLSession session) {
            return true; // 将所有验证的结果都设为true，不进行主机名验证
        }
    };

    private static void trustAllHosts()  {
        final String TAG = "trustAllHosts";


            // 创建信任所有证书的信任管理器
            TrustManager[] trustAllCerts = new TrustManager[]{
                    new X509TrustManager() {
                        @Override
                        public X509Certificate[] getAcceptedIssuers() {
                            return new X509Certificate[]{};
                        }

                        @Override
                        public void checkClientTrusted(X509Certificate[] chain, String authType) {
                            // 不做任何检查，信任所有客户端证书
                        }

                        @Override
                        public void checkServerTrusted(X509Certificate[] chain, String authType) {
                            // 不做任何检查，信任所有服务器证书
                        }
                    }
            };

            // 安装信任管理器
            try {
                SSLContext sc = SSLContext.getInstance("TLS");
                sc.init(null, trustAllCerts, new SecureRandom());
                HttpsURLConnection.setDefaultSSLSocketFactory(sc.getSocketFactory());
            } catch (Exception e) {
                e.printStackTrace();
            }
        }

6.2 具体实现

//get方法进行请求
    public static String doget(String urlstr) throws Exception{
        HttpURLConnection connection;
        HttpsURLConnection httpsURLConnection;
        
        //设置一代理类
        Proxy proxy = new Proxy(Proxy.Type.HTTP, new InetSocketAddress("127.0.0.1", 8888));
        // 需要删掉这个参数String params
        // 接收返回结果
        String res = null;
        //创建url对象
//        URL url = new URL(urlstr + "?" + params);
        URL url = new URL(urlstr);
        // 处理http与https
        trustAllHosts();

        httpsURLConnection = (HttpsURLConnection)url.openConnection(proxy);
        //判断是https请求还是http请求
        if (url.getProtocol().toLowerCase().equals("https")) {
            httpsURLConnection.setHostnameVerifier(DO_NOT_VERIFY);
            connection = httpsURLConnection;
        } else {
            connection = (HttpURLConnection) url.openConnection();
        }

        //设置请求方法
        connection.setRequestMethod("GET");
        //设置连接超时时间毫秒
        connection.setConnectTimeout(5000); //5*1000
        //设置主机读取的响应时间毫秒
        connection.setReadTimeout(5000);
        //...设置请求头信息等等

        //发起请求--最后需要关闭连接
        connection.connect();

        //获取状态码
        int responseCode = connection.getResponseCode();
        if (responseCode == HttpURLConnection.HTTP_OK) {
            // 响应字节流 connection.getInputStream()
            // 将字节流转为为字符流 InputStreamReader
            // BufferedReader 缓冲输入流
            BufferedReader br = new BufferedReader(new InputStreamReader(connection.getInputStream(), "UTF-8"));
            StringBuffer sb = new StringBuffer();
            String line = null;
            while ((line = br.readLine()) != null){
                sb.append(line);
            }
            res = sb.toString();
        }
        //关闭连接
        connection.disconnect();
        return res;
    }

6.3 未设置信任管理器下的请求

6.4 代码实现设置后

标签：JAVA,String,--,connection,url,Exploit,new,HttpURLConnection,请求
From： https://blog.csdn.net/weixin_72543266/article/details/145175052