脚本实现浏览器调用Gitlab
实现效果


分析步骤
1.在浏览器开发者工具面板分析请求信息
一般分析请求地址(path)和请求头(Request Headers),请求体(payload) 三部分数据



脚本代码实现
import requests GITLAB_URL = 'https://192.168.30.197:8090' # Your GitLab API token with admin privileges GITLAB_API_TOKEN = 'Yp78iWbXSU4taDuNwY_t' # Function to create personal access token for a user def create_personal_access_token(scopes): headers = { 'content-type':'application/x-www-form-urlencoded', 'cookie':'sidebar_collapsed=false; experimentation_subject_id=eyJfcmFpbHMiOnsibWVzc2FnZSI6IklqVmpObUZtTm1VMUxUazFNVEV0TkdGbVlpMDROVEF3TFRBeE1HTm1NbU5tTXpobU1TST0iLCJleHAiOm51bGwsInB1ciI6ImNvb2tpZS5leHBlcmltZW50YXRpb25fc3ViamVjdF9pZCJ9fQ%3D%3D--bac7545787ce9d8e8306d04aa7d02a49508d13b2; diff_view=inline; _gitlab_session=286c78f855c9afd45b9e81d4ae08bdd8; event_filter=all', 'user-agent':'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36' } data = { #这里的data的key和value都不需要urlencoded后的数据 #requests.post会根据content-type的设置自动进行url编码 #如果设置成下面编码后的内容提交就会报错 # authenticity_token: vik4iKt9wNdebsRvptU6V%2BYR9gkF56n2PFUtuHki7DEv1DgLtc7Y9QRvFIoWPD5sR9phmTJNz87Ku95Jl3quOw%3D%3D # personal_access_token%5Bname%5D: gitclone # personal_access_token%5Bexpires_at%5D: 2025-01-25 # personal_access_token%5Bscopes%5D%5B%5D: api 'authenticity_token': 'vik4iKt9wNdebsRvptU6V+YR9gkF56n2PFUtuHki7DEv1DgLtc7Y9QRvFIoWPD5sR9phmTJNz87Ku95Jl3quOw==', 'personal_access_token[name]': 'usertoken2', 'personal_access_token[scopes][]': scopes, 'personal_access_token[expires_at]': '2025-05-01T00:00:00Z' } response = requests.post(f'{GITLAB_URL}/admin/users/liujun/impersonation_tokens', headers=headers, data=data,verify=False) print(response.reason) def main(): scopes = ['api'] # You can add more scopes as needed, e.g., ['api', 'read_user'] create_personal_access_token(scopes) if __name__ == "__main__": print("开始创建token") main()


调用脚本创建成功
冒充用户令牌

通过这种方式,管理员可以只要创建自己的一个token便可以实现所有用户的交替操作,而不需要不断切换用户来进行相关操作
数据库创建方式
1.找到用户存储token的表名

2.使用sql语句批量给用户添加token记录

此场景不适合用sql语句来批量给用户添加token
本文来自博客园,作者:不懂123,转载请注明原文链接:https://www.cnblogs.com/yxh168/p/18689310
浙公网安备 33010602011771号