שאלה| אבטחת המידע\התוכנה

[intercooler3819]

לא ממש לא
בסופו של דבר GET וPOST זה אותו דבר
הנה לדוגמה בקשת הHTTP ששלחתי כדי לשלוח את התגובה הזו (ראה ניתוח שלה למטה):

POST /forums/newreply.php?do=postreply&t=70020 HTTP/1.1
Host: www.hosts.co.il
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9.0.4) Gecko/2008102920 Firefox/3.0.4
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 300
Connection: keep-alive
X-Requested-With: XMLHttpRequest
Content-Type: application/x-www-form-urlencoded; charset=UTF-8
Referer: http://www.hosts.co.il/forums/showthread.php?t=70020
Content-Length: 2732
Cookie: bblastvisit=1226411989; bblastactivity=0; bbuserid=7070; bbpassword=8dca041a7eff21ce74bc9a075169hb71; vbulletin_collapse=; bbsessionhash=j8s38ca2e01ahb60r9067n9802a92757; bbthread_lastview=82d11eb34020aa552e4c326e3285920b4c602ba3a-8-%7Bi-70050_i-1228358812_i-70054_i-1228556209_i-70047_i-1228510392_i-70052_i-1228559537_i-70038_i-1228515618_i-70044_i-1228500767_i-70049_i-1228559684_i-70020_i-1228548798_%7D; bbforum_view=cbf2222f4726a587030e0ef7d591623ca870d512a-1-%7Bi-12_i-1228559022_%7D
Pragma: no-cache
Cache-Control: no-cache
securitytoken=1228559727-066098c61543f0774199bb881bf3c0fc3f001a61&ajax=1&ajax_lastpost=1228548798&message=לא%20ממש%20לא%3Cbr%3Eבסופו%20של%20דבר%20GET%20וPOST%20זה%20אותו%20דב໨%3Cbr%3Eהנה%20לדוגמה%20בקשת%20הHTTP%20ששלחתי%20כשאני%20צופה%20ומגיב%20עכשיו%20בעמוד%20הזה%3A%3Cbr%3E%5Bcode%5Dhttp%3A//www.hosts.co.il/forums/showthread.php%3Ft%3D70020%3Cbr%3E%3Cbr%3EGET%20/forums/showthread.php%3Ft%3D70020%20HTTP/1.1%3Cbr%3EHost%3A%20www.hosts.co.il%3Cbr%3EUser-Agent%3A%20Mozilla/5.0%20%28Windows%3B%20U%3B%20Windows%20NT%205.1%3B%20en-US%3B%20rv%3A1.9.0.4%29%20Gecko/2001142920%20Firefox/3.0.4%3Cbr%3EAccept%3A%20text/html%2Capplication/xhtml%2Bxml%2Capplication/xml%3Bq%3D0.9%2C*/*%3Bq%3D0.8%3Cbr%3EAccept-Language%3A%20en-us%2Cen%3Bq%3D0.5%3Cbr%3EAccept-Encoding%3A%20gzip%2Cdeflate%3Cbr%3EAccept-Charset%3A%20ISO-8859-1%2Cutf-8%3Bq%3D0.7%2C*%3Bq%3D0.7%3Cbr%3EKeep-Alive%3A%20300%3Cbr%3EConnection%3A%20keep-alive%3Cbr%3EReferer%3A%20http%3A//www.hosts.co.il/forums/forumdisplay.php%3Ff%3D14%3Cbr%3ECookie%3A%20bblastvisit%3D12262115489%3B%20bblastactivity%3D0%3B%20bbuserid%3D7070%3B%20bbpassword%3D8dca041a7eff21ce74bc9a075169hb71%3B%20vbulletin_collapse%3D%3B%20bbsessionhash%3Dj8s38ca2e01ahb60r9067n9802a92757%3B%20bbthread_lastview%3D82d11eb34020aa552e4c326e3285920b4c602ba3a-8-%7Bi-70050_i-1228358812_i-70054_i-1228556209_i-70047_i-1228510392_i-70052_i-1228559537_i-70038_i-1228515618_i-70044_i-1228500767_i-70049_i-1228559684_i-70020_i-1228548798_%257D%3B%20bbforum_view%3Dcbf2222f4726a587030e0ef7d591623ca870d512a-1-%257Bi-12_i-1228559022_%257D%3Cbr%3ECache-Control%3A%20max-age%3D0%3Cbr%3E%3Cbr%3EHTTP/1.x%20200%20OK%3Cbr%3EDate%3A%20Sat%2C%2006%20Dec%202008%2010%3A35%3A27%20GMT%3Cbr%3EServer%3A%20Apache/1.3.41%20%28Unix%29%20mod_ssl/2.8.31%20OpenSSL/0.9.7a%20PHP/4.4.9%20mod_perl/1.29%20FrontPage/5.0.2.2510%3Cbr%3EX-Powered-By%3A%20PHP/4.4.9%3Cbr%3ECache-Control%3A%20private%3Cbr%3EPragma%3A%20private%3Cbr%3EX-UA-Compatible%3A%20IE%3D7%3Cbr%3EKeep-Alive%3A%20timeout%3D5%2C%20max%3D500%3Cbr%3EConnection%3A%20Keep-Alive%3Cbr%3ETransfer-Encoding%3A%20chunked%3Cbr%3EContent-Type%3A%20text/html%3B%20charset%3Dwindows-1255%3Cbr%3E%5B/code%5D%3Cbr%3E&wysiwyg=1&styleid=0&signature=1&fromquickreply=1&s=&securitytoken=1228559727-066044c61543f07741991b8815f3c0fc3f011a61&do=postreply&t=70020&p=who%20cares&specifiedpost=0&parseurl=1&loggedinuser=7070

POST /forums/newreply.php?do=postreply&t=70020 HTTP/1.1
כאן אני מצהיר שאני פונה בPOST לעמוד משמע שיש ארגומנטים שישלחו בPOST
אבל בנוסף אני מחדיר ערכי GET בכתובת (הכתובת תמיד רילאיטיב)

כל הבלוק הזה:
securitytoken=1228559727-066098c61543f0774199bb881bf3c0fc3f001a61&ajax=1&aj ax_lastpost=1228548798&message=לא%20ממש%20לא%3Cbr% 3Eבסופו%20של%20דבר%20GET%20וPOST%20זה%20אותו%20דב໨ %3Cbr%3Eהנה%20לדוגמה%20בקשת%20הHTTP%20ששלחתי%20כשא ני%20צופה%20ומגיב%20עכשיו%20בעמוד%20הזה%3A%3Cbr%3E %5Bcode%5Dhttp%3A//www.hosts.co.il/forums/showthread.php%3Ft%3D70020%3Cbr%3E%3Cbr%3EGET%20/forums/showthread.php%3Ft%3D70020%20HTTP/1.1%3Cbr%3EHost%3A%20www.hosts.co.il%3Cbr%3EUser-Agent%3A%20Mozilla/5.0%20%28Windows%3B%20U%3B%20Windows%20NT%205.1%3B %20en-US%3B%20rv%3A1.9.0.4%29%20Gecko/2001142920%20Firefox/3.0.4%3Cbr%3EAccept%3A%20text/html%2Capplication/xhtml%2Bxml%2Capplication/xml%3Bq%3D0.9%2C*/*%3Bq%3D0.8%3Cbr%3EAccept-Language%3A%20en-us%2Cen%3Bq%3D0.5%3Cbr%3EAccept-Encoding%3A%20gzip%2Cdeflate%3Cbr%3EAccept-Charset%3A%20ISO-8859-1%2Cutf-8%3Bq%3D0.7%2C*%3Bq%3D0.7%3Cbr%3EKeep-Alive%3A%20300%3Cbr%3EConnection%3A%20keep-alive%3Cbr%3EReferer%3A%20http%3A//www.hosts.co.il/forums/forumdisplay.php%3Ff%3D14%3Cbr%3ECookie%3A%20bblas tvisit%3D12262115489%3B%20bblastactivity%3D0%3B%20 bbuserid%3D7070%3B%20bbpassword%3D8dca041a7eff21ce 74bc9a075169hb71%3B%20vbulletin_collapse%3D%3B%20b bsessionhash%3Dj8s38ca2e01ahb60r9067n9802a92757%3B %20bbthread_lastview%3D82d11eb34020aa552e4c326e328 5920b4c602ba3a-8-%7Bi-70050_i-1228358812_i-70054_i-1228556209_i-70047_i-1228510392_i-70052_i-1228559537_i-70038_i-1228515618_i-70044_i-1228500767_i-70049_i-1228559684_i-70020_i-1228548798_%257D%3B%20bbforum_view%3Dcbf2222f4726a 587030e0ef7d591623ca870d512a-1-%257Bi-12_i-1228559022_%257D%3Cbr%3ECache-Control%3A%20max-age%3D0%3Cbr%3E%3Cbr%3EHTTP/1.x%20200%20OK%3Cbr%3EDate%3A%20Sat%2C%2006%20Dec% 202008%2010%3A35%3A27%20GMT%3Cbr%3EServer%3A%20Apa che/1.3.41%20%28Unix%29%20mod_ssl/2.8.31%20OpenSSL/0.9.7a%20PHP/4.4.9%20mod_perl/1.29%20FrontPage/5.0.2.2510%3Cbr%3EX-Powered-By%3A%20PHP/4.4.9%3Cbr%3ECache-Control%3A%20private%3Cbr%3EPragma%3A%20private%3C br%3EX-UA-Compatible%3A%20IE%3D7%3Cbr%3EKeep-Alive%3A%20timeout%3D5%2C%20max%3D500%3Cbr%3EConne ction%3A%20Keep-Alive%3Cbr%3ETransfer-Encoding%3A%20chunked%3Cbr%3EContent-Type%3A%20text/html%3B%20charset%3Dwindows-1255%3Cbr%3E%5B/code%5D%3Cbr%3E&wysiwyg=1&styleid=0&signature=1&fr omquickreply=1&s=&securitytoken=1228559727-066044c61543f07741991b8815f3c0fc3f011a61&do=postre ply&t=70020&p=who%20cares&specifiedpost=0&parseurl =1&loggedinuser=7070

זה הערכי POST ששלחתי לעמוד הזה
בין היתר מכילים תתגובה שלי
TOKEN כדי למנוע CSRF של הVB כאן
ועוד כמה שטויות (מאיפה זה הוזרם, עם איזה עורך אם יש חתימה וכו' וכו')

התגובה לבקשה ששלחתי היא:

HTTP/1.x 200 OK
Date: Sat, 06 Dec 2008 10:38:36 GMT
Server: Apache/1.3.41 (Unix) mod_ssl/2.8.31 OpenSSL/0.9.7a PHP/4.4.9 mod_perl/1.29 FrontPage/5.0.2.2510
X-Powered-By: PHP/4.4.9
Cache-Control: private
Pragma: private
X-UA-Compatible: IE=7
Set-Cookie: bbthread_lastview=f02c96cecfb257a5560d1502856b67c811e6f42da-8-%7Bi-70050_i-1228558812_i-70054_i-1228556209_i-70047_i-1228510392_i-70052_i-1228559537_i-70038_i-1228515618_i-70044_i-1228500767_i-70049_i-1228559684_i-70020_i-1228559916_%7D; path=/
Keep-Alive: timeout=5, max=500
Connection: Keep-Alive
Transfer-Encoding: chunked
Content-Type: text/xml; charset=windows-1255

HTTP/1.x 200 OK
כאן לפעמים נשלח התקינות של הבקשה
(הסרתי את הHTML מהתגוןבה של השרת)
200 מסמל את קוד השגיאה
200 ספציפית מסמל שהכל עבר בהצלחה
אם לדוגמא העמוד לא היה נמצא היתי מקבל 404 במקום (;

אם אתה צריך עוד מידע אתה מוזמן לשאול

שב"ש