This article mainly introduces the detailed explanation of the simulated submission method of php curl with csrf-token verification. The editor thinks it is quite good. Now I will share it with you and give it as a reference. Let’s follow the editor and take a look.
Usually for security reasons, a random token value is added to the form to prevent CSRF attacks.
It is actually not difficult to simulate submitting a website with token verification.
1. Obtain the token through regular expressions
2. Bring the obtained token to simulate submission
The following is a successful example
Table of Contents Structure
│ form.php –需要模拟的表单 │ getForm.php – 模拟提交程序 │ post.php –表单验证程序 │ └─cookie – cookie存放目录
getForm.php
<?php $cookie_file = './cookie/'.time().'.cookie'; $str = getResponse('http://a.curl.com:81/form.php',[],$cookie_file); setcookie("PHPSESSID", "vc0heoa6lfsi3gger54pkns152"); preg_match('/<input name="token" type="hidden" value="(.*)"/U', $str, $match); $post['token'] = $match[1]; $post['name'] = '3333333'; $post['password'] = '12121213'; print_r(getResponse('http://a.curl.com:81/post.php', $post, $cookie_file)); function getResponse($url, $data=[], $cookie_file='', $timeout = 3) { if(empty($cookie_file)) { $cookie_file = '.cookie'; } $ch = curl_init(); curl_setopt($ch, CURLOPT_URL, $url); curl_setopt($ch, CURLOPT_REFERER, "https://www.baidu.com"); //构造来路 curl_setopt($ch, CURLOPT_USERAGENT,"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/54.0.2840.59 Safari/537.36"); if(!empty($data)) { curl_setopt($ch, CURLOPT_POST, true); curl_setopt($ch, CURLOPT_POSTFIELDS, $data); } curl_setopt($ch, CURLOPT_COOKIEJAR, $cookie_file);// 取cookie的参数是 curl_setopt ($ch, CURLOPT_COOKIEFILE, $cookie_file); //发送cookie curl_setopt($ch, CURLOPT_RETURNTRANSFER, 1); curl_setopt($ch, CURLOPT_CONNECTTIMEOUT, $timeout); try { $handles = curl_exec($ch); curl_close($ch); return $handles; } catch (Exception $e) { echo 'Caught exception: ', $e->getMessage(), "\n"; } unlink($cookie_file); }
form.php
<?php session_start(); $_SESSION['token'] = md5($_SERVER['REQUEST_TIME']); $_SESSION['time'] = date("Y-m-d H:i:s"); session_write_close(); //echo $_SESSION['auth']; ?> <!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <title> new document </title> <meta name="generator" content="editplus" /> <meta name="author" content="" /> <meta name="keywords" content="" /> <meta name="description" content="" /> </head> <body> <form action="post.php" method="post"> <p><input name="name" type="text"></p> <p><input name="password" type="password"></p> <p><input name="token" type="hidden" value="<?php echo $_SESSION['token']?>"></p> <p><input type="submit"></p> </form> </body> </html>
post.php
<?php session_start(); if(empty($_POST['token'])) { exit ("token is empty!"); } if(empty($_SESSION['token'])) { exit ("session is empty"); } if($_POST['token'] != $_SESSION['token']) { exit ("token "); } else { unset($_SESSION['token']); } echo PHP_EOL; echo "pass"; print_r($_REQUEST); echo PHP_EOL; print_r($_SERVER);
The above is the entire content of this article, I hope it will be helpful to everyone Learning is helpful, and I hope everyone will support php Chinese website.
PHP iterator and implementation and use of iteration analysis PHP skills
PHP operates MongoDB to implement the add, delete, modify and query function php skills
PHP operates Redis common skills summary php skills
The above is the detailed content of Detailed explanation of php curl with csrf-token verification simulation submission method php example. For more information, please follow other related articles on the PHP Chinese website!