计算cookies长度===>你把fillepath改了之后、肯定是或＋或—cookies的长度变了

----------------------------
......

host: _blank>www.xin126.com

content-length: 1969 <======就是这个

connection: keep-alive

cache-control: no-cache

......
计算会吧?一个字母、数字就是1

对于上传漏洞提出的解决思路：(仅供参考)

1、一般的上传是把上传路径作为一个变量来处理

===>我们的对策就是把filepath变成常量。。。

这个方法是目前最有效的(我认为的)

2、加强对于的处理,原来我们是读到这里就结束

我们继续读直道下一个变量开始的地方，处理就ok了

附：NC Usage:

监听外部主机

nc [-options] hostname port[s] [ports] ...

监听本地主机

nc -l -p port [options] [hostname] [port]

options:

-d detach from console, stealth mode

-e prog inbound program to exec [dangerous!!]

-g gateway source-routing hop point[s], up to 8

-g num source-routing pointer: 4, 8, 12, ...

-h this cruft

-i secs delay interval for lines sent, ports scanned

-l listen mode, for inbound connects

-l listen harder, re-listen on socket close

-n numeric-only ip addresses, no dns

-o file hex dump of traffic

-p port local port number

-r randomize local and remote ports

-s addr local source address

-t answer telnet negotiation

-u udp mode

-v verbose [use twice to be more verbose]

-w secs timeout for connects and final net reads

-z zero-i/o mode [used for scanning]

port numbers can be individual or ranges: m-n [inclusive]