新人第一次写个POST，求大神指点一下，提交遇到返回含有非法字符，提交数据有WebKi...

曾几何时此地 · 发表于 2018-5-1 17:18:12

新人第一次写POST，金币不多，还望大神位不要嫌弃

。
提交页的数据：提交页：
POST http://www.zygxlt.com/member.php?mod=register&inajax=1 HTTP/1.1
Host: www.zygxlt.com
Connection: keep-alive
Content-Length: 1622
Cache-Control: max-age=0
Origin: http://www.zygxlt.com
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/56.0.2924.90 Safari/537.36 2345Explorer/9.3.2.17331
Content-Type: multipart/form-data; boundary=----WebKitFormBoundarysI5xUyr66ox49B54
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8
Referer: http://www.zygxlt.com/member.php?mod=register
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.8
Cookie: Id8H_2132_saltkey=Yi865ziA; Id8H_2132_lastvisit=1525062664; Id8H_2132_onlineusernum=114; Id8H_2132_sendmail=1; UM_distinctid=16315095e43507-
0e*F25c33b1b-62381459-100200-16315095e444*FId8H_2132_sid=GOPC2p; pgv_pvi=8832912928; pgv_info=ssi=s2643682812; CNZZDATA1260076333=448360653-
1525064290-%7C1525064290; Id8H_2132_secqaa=713.8a4fcac587f2d67c3a; Id8H_2132_seccode=714.d7e6351e52*Ff1ff; Id8H_2132_lastact=1525066309%09misc.php
%09seccode
------WebKitFormBoundarysI5xUyr66ox49B54
Content-Disposition: form-data; name="regsubmit"
yes
------WebKitFormBoundarysI5xUyr66ox49B54
Content-Disposition: form-data; name="formhash"
2f5119a4
http://www.zygxlt.com/
------WebKitFormBoundarysI5xUyr66ox49B54
Content-Disposition: form-data; name="activationauth"
------WebKitFormBoundarysI5xUyr66ox49B54
Content-Disposition: form-data; name="l7yCqJ"
kiwkfow_2019
------WebKitFormBoundarysI5xUyr66ox49B54
Content-Disposition: form-data; name="myTpft"
Kpl123456
------WebKitFormBoundarysI5xUyr66ox49B54
Content-Disposition: form-data; name="PTZV08"
Kpl123456
------WebKitFormBoundarysI5xUyr66ox49B54
Content-Disposition: form-data; name="o4788j"
569897993@qq.com
------WebKitFormBoundarysI5xUyr66ox49B54
Content-Disposition: form-data; name="freeaddon_avatar_id"
35
------WebKitFormBoundarysI5xUyr66ox49B54
Content-Disposition: form-data; name="secqaahash"
qSGOPC2p
------WebKitFormBoundarysI5xUyr66ox49B54
Content-Disposition: form-data; name="secanswer"
1
------WebKitFormBoundarysI5xUyr66ox49B54
Content-Disposition: form-data; name="seccodehash"
cSGOPC2p
------WebKitFormBoundarysI5xUyr66ox49B54
Content-Disposition: form-data; name="seccodemodid"
member::register
------WebKitFormBoundarysI5xUyr66ox49B54
Content-Disposition: form-data; name="seccodeverify"
etrv
------WebKitFormBoundarysI5xUyr66ox49B54
Content-Disposition: form-data; name="agreebbrule"
1f8ea*F
------WebKitFormBoundarysI5xUyr66ox49B54--

返回的数据包：

HTTP/1.1 200 OK
Date: Mon, 30 Apr 2018 05:31:49 GMT
Server: Apache
Expires: -1
Cache-Control: no-store, private, post-check=0, pre-check=0, max-age=0
Pragma: no-cache
Set-Cookie: Id8H_2132_lastact=1525066309%09member.php%09register; expires=Tue, 01-May-2018 05:31:49 GMT; Max-Age=86400; path=/
Set-Cookie: Id8H_2132_ulastactivity=a2dd6%2BN3HbVa5yU106beMik4EwEJ95%2BgZ66FjMTb9osgKqChkZi0; expires=Tue, 30-Apr-2019 05:31:49 GMT; Max-Age=31536000;
path=/
Set-Cookie: Id8H_2132_sid=GOPC2p; expires=Tue, 01-May-2018 05:31:49 GMT; Max-Age=86400; path=/
Set-Cookie: Id8H_2132_auth=5ef21UwzVwTN7KcNLd0oXW07EVz73V4Je9zKxlNWLWpTo1%2B%2BjO7Dzvswrq0YNEuBYyTyE9fVQRJ3%2FFGEfmWRKu%2B39w; path=/; httponly
Set-Cookie: Id8H_2132_loginuser=deleted; expires=Thu, 01-Jan-1970 00:00:01 GMT; Max-Age=0; path=/
Set-Cookie: Id8H_2132_activationauth=deleted; expires=Thu, 01-Jan-1970 00:00:01 GMT; Max-Age=0; path=/
Set-Cookie: Id8H_2132_pmnum=deleted; expires=Thu, 01-Jan-1970 00:00:01 GMT; Max-Age=0; path=/
Set-Cookie: Id8H_2132_creditnotice=0D0D2D0D0D0D0D0D0D15481; path=/
Set-Cookie: Id8H_2132_creditbase=0D0D0D0D0D0D0D0D0; path=/
Set-Cookie: Id8H_2132_creditrule=%E6%AF%8F%E5%A4%A9%E7%99%BB%E5%BD%95; path=/
Set-Cookie: Id8H_2132_loginuser=deleted; expires=Thu, 01-Jan-1970 00:00:01 GMT; Max-Age=0; path=/
Set-Cookie: Id8H_2132_activationauth=deleted; expires=Thu, 01-Jan-1970 00:00:01 GMT; Max-Age=0; path=/
Set-Cookie: Id8H_2132_invite_auth=deleted; expires=Thu, 01-Jan-1970 00:00:01 GMT; Max-Age=0; path=/
Vary: User-Agent,Accept-Encoding
Content-Length: 901
Keep-Alive: timeout=15, max=299
Connection: Keep-Alive
Content-Type: text/xml; charset=gbk
<?xml version="1.0" encoding="gbk"?>
<root><![CDATA[<script type="text/javascript" reload="1">if($('succeedmessage')) {$('succeedmessage').innerHTML = '感谢您zc 资源共享论坛-专业共享VIP视频，现在将以新
手上路身份登录站点';}if(typeof succeedhandle_=='function') {succeedhandle_('http://www.zygxlt.com/', '感谢您zc 资源共享论坛-专业共享VIP视频，现在将以新手上路身份登录站
点', {'bbname':'资源共享论坛-专业共享VIP视频','username':'kiwkfow_2019','usergroup':'新手上路','uid':'15481'});}</script><script type="text/javascript">setTimeout
("window.location.href ='http://www.zygxlt.com/';", 3000);$('succeedmessage_href').href = 'http://www.zygxlt.com/';$('main_message').style.display = 'none';
$('main_succeed').style.display = '';$('succeedlocation').innerHTML = '<a rel="nofollow" href="home.php?mod=spacecp">现在去完善资料</a> <a href="home.php?
mod=space&do=home">先去逛逛</a>';</script>]]></root>

我自己写的提交代码：
新数据＝到文本 (文本_替换 (#提交的数据, , , , “dwfsfw_3554”, 用户名, “Kpl123456”, 编辑框_psd.内容, “cmge”, 编辑框_yzm.内容, “75”, 编辑框_an.内容, [url=mailto:“568796648@qq.com]“568796648@qq.com[/url]”, 编辑框_email.内容))
新数据＝文本_替换 (新数据, , , , “13”, 随机图片名)
调试输出 (新数据)
zc结果＝到文本 (网页_访问 (“http://www.zygxlt.com/member.php?mod=register&inajax=1”, 1, 新数据, 返回CK, , #ua集, , , , , , ))
调试输出 (zc结果)
.如果 (寻找文本 (zc结果, “if($('succeedmessage')”, , 假) ＞ 0)
编辑框_显示.加入文本 (“成功zc的账户和密码:” ＋用户名＋ “-------” ＋编辑框_psd.内容)
调试输出 (“zc成功”)
.否则
调试输出 (“zc失败”)
变量#ua集，里面的WebKitFormBoundarysI5xUyr66ox49B54也改成和提交的WebKitFormBoundarysI5xUyr66ox49B54一致的。
其中#提交的数据是用直接替换了WebKitFormBoundarysI5xUyr66ox49B54里面的一点内容而已。
但显示返非法字符：
* “<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html>
<head>
<title>www.zygxlt.com - System Error</title>
<meta http-equiv="Content-Type" content="text/html; charset=gbk" />
<meta name="ROBOTS" content="NOINDEX,NOFOLLOW,NOARCHIVE" />
<style type="text/css">

</style>
</head>
<body>
<div id="container">
<h1>Discuz! System Error</h1>
<div class='info'><li>您当前的访问请求当中含有非法字符，已经被系统拒绝</li></div>
<div class="info"><p><strong>PHP Debug</strong></p><table cellpadding="5" cellspacing="1" width="100%" class="table"><tr><td><ul><li>[Line: 0026]member.php
(discuz_application->init)</li><li>[Line: 0071]source/class/discuz/discuz_application.php(discuz_application->_init_misc)</li><li>[Line: 0552]
source/class/discuz/discuz_application.php(discuz_application->_xss_check)</li><li>[Line: 0355]source/class/discuz/discuz_application.php(system_error)</li><li>[Line: 0023]
source/function/function_core.php(discuz_error::system_error)</li><li>[Line: 0024]source/class/discuz/discuz_error.php(discuz_error::debug_backtrace)
</li></ul></td></tr></table></div><div class="help"><a >www.zygxlt.com</a> 已经将此出错信息详细记录, 由此给您带来的访问不便我们深感
歉意. </div>
</div>
</body>
</html>”

虽然有点长。金币不多，但还望大神能指点一下，是不是JS生成的WebKitFormBoundarys限制了提交？

q936171457 · 发表于 2018-5-1 17:26:05

协yi头和cookies WebKitFormBoundarysI5xUyr66ox49B54 这个值别改动试试

q936171457 · 发表于 2018-5-1 17:41:40

你看一下是这个吗

漏洞王 · 发表于 2018-5-1 18:26:09

看的都头晕了没帮上

曾几何时此地 · 发表于 2018-5-1 20:13:23

q936171457 发表于 2018-5-1 17:26
协yi头和cookies WebKitFormBoundarysI5xUyr66ox49B54 这个值别改动试试

cookies不变？

曾几何时此地 · 发表于 2018-5-1 21:05:47

q936171457 发表于 2018-5-1 17:41
你看一下是这个吗

按照你的代码，提示如下错误：
<?xml version="1.0" encoding="gbk"?>
<root><![CDATA[抱歉，验证问答填写错误<script type="text/javascript" reload="1">if(typeof errorhandle_=='function') {errorhandle_('抱歉，验证问答填写错误', {});}</script>]]>

是不是COOKIES经过了加密处理的？