=Start=
缘由:
之前在学习Java的时候就说要整理一篇如何进行HTTP操作的文章,不过一直都没有写好,这两天刚好想到了验证的方法,所以整个过程很快就OK了,在此记录一下,方便以后参考。
正文:
参考解答:
1、使用 HttpURLConnection
package com.ixyzero.learn.utils;
import javax.net.ssl.HttpsURLConnection;
import java.io.BufferedReader;
import java.io.DataOutputStream;
import java.io.InputStreamReader;
import java.net.HttpURLConnection;
import java.net.URL;
/**
* Created by ixyzero on 2019/5/11.
*/
public class HttpURLConnectionExample {
private final String USER_AGENT = "Mozilla/5.0";
public static void main(String[] args) throws Exception {
HttpURLConnectionExample http = new HttpURLConnectionExample();
System.out.println("Testing 1 - Send Http GET request");
http.sendGet();
System.out.println("\nTesting 2 - Send Http POST request");
http.sendPost();
}
// HTTP GET request
private void sendGet() throws Exception {
String url = "https://httpbin.org/get?q=test";
URL obj = new URL(url);
HttpURLConnection con = (HttpURLConnection) obj.openConnection();
// optional default is GET
con.setRequestMethod("GET");
//add request header
con.setRequestProperty("User-Agent", USER_AGENT);
int responseCode = con.getResponseCode();
System.out.println("\nSending 'GET' request to URL : " + url);
System.out.println("Response Code : " + responseCode);
BufferedReader in = new BufferedReader(
new InputStreamReader(con.getInputStream()));
String inputLine;
StringBuffer response = new StringBuffer();
while ((inputLine = in.readLine()) != null) {
response.append(inputLine);
}
in.close();
System.out.println(response.toString());
}
// HTTP POST request
private void sendPost() throws Exception {
String url = "https://httpbin.org/post";
URL obj = new URL(url);
HttpsURLConnection con = (HttpsURLConnection) obj.openConnection();
//add reuqest header
con.setRequestMethod("POST");
con.setRequestProperty("User-Agent", USER_AGENT);
con.setRequestProperty("Accept-Language", "en-US,en;q=0.5");
String urlParameters = "sn=123&id=12345";
// Send post request
con.setDoOutput(true);
DataOutputStream wr = new DataOutputStream(con.getOutputStream());
wr.writeBytes(urlParameters);
wr.flush();
wr.close();
int responseCode = con.getResponseCode();
System.out.println("\nSending 'POST' request to URL : " + url);
System.out.println("Post parameters : " + urlParameters);
System.out.println("Response Code : " + responseCode);
BufferedReader in = new BufferedReader(
new InputStreamReader(con.getInputStream()));
String inputLine;
StringBuffer response = new StringBuffer();
while ((inputLine = in.readLine()) != null) {
response.append(inputLine);
}
in.close();
System.out.println(response.toString());
}
}
2、使用 HttpClient
package com.ixyzero.learn.utils;
import org.apache.http.HttpResponse;
import org.apache.http.NameValuePair;
import org.apache.http.client.ClientProtocolException;
import org.apache.http.client.HttpClient;
import org.apache.http.client.entity.UrlEncodedFormEntity;
import org.apache.http.client.methods.HttpGet;
import org.apache.http.client.methods.HttpPost;
import org.apache.http.impl.client.HttpClientBuilder;
import org.apache.http.message.BasicNameValuePair;
import java.io.BufferedReader;
import java.io.IOException;
import java.io.InputStreamReader;
import java.io.UnsupportedEncodingException;
import java.util.ArrayList;
import java.util.HashMap;
import java.util.List;
import java.util.Map;
/**
* Created by ixyzero.com on 2019/5/11.
*/
public class HttpUtils {
private static String getURL = "http://httpbin.org/get?q=test";
private static String postURL = "https://httpbin.org/post";
private static String USER_AGENT = "Mozilla/5.0";
private static int TIMEOUT = 50;
public String httpGet(String url) {
HttpClient client = HttpClientBuilder.create().build();
HttpGet request = new HttpGet(url);
request.addHeader("User-Agent", USER_AGENT);
StringBuffer result = new StringBuffer();
try {
HttpResponse response = client.execute(request);
System.out.println("Response Code : "
+ response.getStatusLine().getStatusCode());
BufferedReader rd = new BufferedReader(
new InputStreamReader(response.getEntity().getContent()));
String line;
while ((line = rd.readLine()) != null) {
result.append(line);
}
} catch (IOException e) {
e.printStackTrace();
}
return result.toString();
}
public String httpPost(String url, Map<String, String> mapParam) {
StringBuffer result = new StringBuffer();
HttpClient client = HttpClientBuilder.create().build();
HttpPost post = new HttpPost(url);
post.setHeader("User-Agent", USER_AGENT);
List<NameValuePair> urlParameters = new ArrayList<>();
for (Map.Entry<String, String> entry : mapParam.entrySet()) {
urlParameters.add(new BasicNameValuePair(entry.getKey(), entry.getValue()));
}
try {
post.setEntity(new UrlEncodedFormEntity(urlParameters));
HttpResponse response = client.execute(post);
System.out.println("Response Code : "
+ response.getStatusLine().getStatusCode());
BufferedReader rd = new BufferedReader(
new InputStreamReader(response.getEntity().getContent()));
String line;
while ((line = rd.readLine()) != null) {
result.append(line);
}
} catch (UnsupportedEncodingException e) {
e.printStackTrace();
} catch (ClientProtocolException e) {
e.printStackTrace();
} catch (IOException e) {
e.printStackTrace();
}
return result.toString();
}
public static void main(String[] args) {
HttpUtils httpUtils = new HttpUtils();
String response;
response = httpUtils.httpGet(getURL);
System.out.println(String.format("URL: %s\nResponse:\n%s\n", getURL, response));
Map<String, String> map = new HashMap<String, String>() {
{
put("name", "test");
put("age", "20");
}
};
System.out.println(map);
response = httpUtils.httpPost(postURL, map);
System.out.println(String.format("URL: %s\nResponse:\n%s\n", postURL, response));
}
}
&
<dependency>
<groupId>org.apache.httpcomponents</groupId>
<artifactId>httpclient</artifactId>
<version>4.4.1</version>
</dependency>
3、借助 https://httpbin.org/验证效果
该网站会把你给它发出的请求信息打出来,方便你验证参数和设置是否正确,上面的POST信息如下(包含请求内容、请求头信息、外网IP等):
{
"args": {},
"data": "",
"files": {},
"form": {
"age": "20",
"name": "test"
},
"headers": {
"Accept-Encoding": "gzip,deflate",
"Content-Length": "16",
"Content-Type": "application/x-www-form-urlencoded",
"Host": "httpbin.org",
"User-Agent": "Mozilla/5.0"
},
"json": null,
"origin": "x1.x2.x3.x4, x1.x2.x3.x4",
"url": "https://httpbin.org/post"
}
4、如何解析返回的json数据
在Java中处理json数据时,我一般用的是Alibaba的fastjson库,所以这里也用这个库的相关方法进行说明:
// 当response为json格式的字符串时,直接将其传给JSONObject.parseObject方法进行解析即可得到对应的json对象 JSONObject jsonObj = JSONObject.parseObject(response);
参考链接:
- Java的HTTP GET和POST 请求 #全面、详细
- How to send HTTP request in java?
- How to use java.net.URLConnection to fire and handle HTTP requests#非常详细!
http://zetcode.com/java/getpostrequest/ - HttpClient Tutorial& Examples
http://hc.apache.org/httpcomponents-client-ga/tutorial/html/statemgmt.html#d5e576 - 用Java发起GET/POST请求并解析返回的json数据
https://stackoverflow.com/questions/22816335/java-httprequest-json-response-handling
=END=
《 “Java中如何发起HTTP请求” 》 有 4 条评论
协议层的攻击——HTTP请求走私
https://paper.seebug.org/1048/
`
1. 前言
2. 发展时间线
3. 产生原因
3.1 CL不为0的GET请求
3.2 CL-CL
3.3 CL-TE
3.4 TE-CL
3.5 TE-TE
4. HTTP走私攻击实例——CVE-2018-8004
4.1 漏洞概述
4.2 测试环境
4.2.1 简介
4.2.2 搭建过程
4.3 漏洞测试
4.3.1 第一个补丁
4.3.2 第二个补丁
4.3.3 第三个补丁
4.3.4 第四个补丁
5. 其他攻击实例
5.1 绕过前端服务器的安全控制
5.1.1 使用CL-TE绕过前端服务器安全控制
5.1.1 使用TE-CL绕过前端服务器安全控制
5.2 获取前端服务器重写请求字段
5.3 获取其他用户的请求
5.4 利用反射型XSS
5.5 进行缓存投毒
6. 如何防御
参考链接
`
https://regilero.github.io/english/security/2019/10/17/security_apache_traffic_server_http_smuggling/
https://portswigger.net/research/http-desync-attacks-request-smuggling-reborn
https://www.cgisecurity.com/lib/HTTP-Request-Smuggling.pdf
Java HttpClient无证书访问HTTPS请求
https://github.com/imaidev/imaidev.github.io/wiki/Java-HttpClient%E6%97%A0%E8%AF%81%E4%B9%A6%E8%AE%BF%E9%97%AEHTTPS%E8%AF%B7%E6%B1%82
轻松把玩HttpClient之配置ssl,采用绕过证书验证实现https
https://www.kancloud.cn/longxuan/httpclient-arron/117503
https://blog.csdn.net/xiaoxian8023/article/details/49865335
轻松把玩HttpClient之配置ssl,采用设置信任自签名证书实现https
https://www.kancloud.cn/longxuan/httpclient-arron/117504
https://blog.csdn.net/xiaoxian8023/article/details/49866397
HttpClient 官方给的demo
http://hc.apache.org/httpcomponents-client-4.5.x/httpclient/examples/org/apache/http/examples/client/QuickStart.java
http://hc.apache.org/httpcomponents-client-4.5.x/httpclient/examples/org/apache/http/examples/client/
http://hc.apache.org/httpcomponents-client-4.5.x/httpclient/examples/org/apache/http/examples/client/ClientCustomSSL.java
Java实现HttpClient发送GET、POST请求(https、http)
https://www.cnblogs.com/klslb/p/9121276.html
https://stackoverflow.com/questions/52988677/allow-insecure-https-connection-for-java-jdk-11-httpclient