如何写requests包里的cookie

[wtdata99]

我在写一个禅道命令执行漏洞时候，他先要访问misc-captcha-user.html获取一个有效的cookie，我如何在模板请求的时候将此cookie设为变量，供下一个包去使用？

### Tasks

[princechaddha]

@wtdata99, if I understand correctly, you want to extract the cookie values from a request and use them in the next request?"

You can simply use cookie-reuse: true for maintaining a browser-like session with cookie-based session handling between multiple requests.

http:
  - raw:
      - |
        GET / HTTP/1.1
        Host: {{Hostname}}
        Origin: {{BaseURL}}

      - |
        POST / HTTP/2
        Host: {{Hostname}}
        Origin: {{BaseURL}}
        Content-Type: application/x-www-form-urlencoded

    cookie-reuse: true

Example: https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-2546.yaml

[wtdata99]

@wtdata99，如果我理解正确的话，您想从请求中提取 cookie 值并在下一个请求中使用它们吗？”

您可以简单地使用cookie-reuse:true来维护类似的浏览器的会话，并在多个请求之间进行基于cookie的会话处理。

http:
  - raw:
      - |
        GET / HTTP/1.1
        Host: {{Hostname}}
        Origin: {{BaseURL}}

      - |
        POST / HTTP/2
        Host: {{Hostname}}
        Origin: {{BaseURL}}
        Content-Type: application/x-www-form-urlencoded

    cookie-reuse: true

示例：https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-2546.yaml

Thank you very much for your answer, I will try it tomorrow

[wtdata99]

@wtdata99, if I understand correctly, you want to extract the cookie values from a request and use them in the next request?"

You can simply use cookie-reuse: true for maintaining a browser-like session with cookie-based session handling between multiple requests.

http:
  - raw:
      - |
        GET / HTTP/1.1
        Host: {{Hostname}}
        Origin: {{BaseURL}}

      - |
        POST / HTTP/2
        Host: {{Hostname}}
        Origin: {{BaseURL}}
        Content-Type: application/x-www-form-urlencoded

    cookie-reuse: true

Example: https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-2546.yaml I want to ask a question. Nuclei has defined the request content. Can I still get the request content?

[princechaddha]

@wtdata99 I am not sure what you mean by request content?

[wtdata99]

@wtdata99我不确定你的意思request content? There is such a loophole:There is such a vulnerability: before exploiting this vulnerability, you need to obtain a cookie. This cookie is automatically added when making a request. I want to obtain the requested cookie. Currently, I know that nuclei can only define the request content and cannot obtain the request. content.