记录黑客技术中优秀的内容, 传播黑客文化,分享黑客技术精华

APP安全之鲜肉一处xss/SQL注入泄露3万用户信息手机/身份证(模特居多)

2016-06-24 23:55

code 区域
xss是下载APP反馈盲打





打到cookie



code 区域
location : http://123.57.206.21/index.php?c=suggest

toplocation : http://123.57.206.21/index.php

cookie : ci_session=a%3A6%3A%7Bs%3A10%3A%22session_id%22%3Bs%3A32%3A%22027e80b7b61d257f62dbb845ebf804fc%22%3Bs%3A10%3A%22ip_address%22%3Bs%3A14%3A%22124.126.150.87%22%3Bs%3A10%3A%22user_agent%22%3Bs%3A116%3A%22Mozilla%2F5.0 %28Macintosh%3B Intel Mac OS X 10_10_5%29 AppleWebKit%2F600.8.9 %28KHTML%2C like Gecko%29 Version%2F8.0.8 Safari%2F600.8.9%22%3Bs%3A13%3A%22last_activity%22%3Bi%3A1460777863%3Bs%3A9%3A%22user_data%22%3Bs%3A0%3A%22%22%3Bs%3A5%3A%22admin%22%3Ba%3A8%3A%7Bs%3A2%3A%22id%22%3Bs%3A12%3A%223tvtg990pfe4%22%3Bs%3A8%3A%22username%22%3Bs%3A15%3A%22x3t8lmRqr99ric1%22%3Bs%3A8%3A%22password%22%3Bs%3A32%3A%229df3b8a17bb9b5b133fcdc3bfb34cd9d%22%3Bs%3A8%3A%22truename%22%3Bs%3A5%3A%22admin%22%3Bs%3A5%3A%22email%22%3Bs%3A14%3A%22it%40xianrou.com%22%3Bs%3A10%3A%22createdate%22%3Bs%3A19%3A%220000-00-00 00%3A00%3A00%22%3Bs%3A12%3A%22sys_group_id%22%3Bs%3A12%3A%223sbsuljdlov8%22%3Bs%3A10%3A%22flag_valid%22%3Bs%3A1%3A%221%22%3B%7D%7Dba439dd5a5669ac679ee474610917634; PHPSESSID=4h2pr178pfoa14vtnug99vaee5





不过进不去- -我在cookie看到个网站



ame%22%3Bs%3A5%3A%22admin%22%3Bs%3A5%3A%22email%22%3Bs%3A14%3A%22it%40xianrou.com%22%3Bs%3A10%3A%22createdate%22%3Bs%3A19%3A%220000-00-00





xianrou.com



我们访问看看





http://www.xianrou.com/index.php?s=Details&id=41l0157s7bb0



不访不知道,一访吓一跳。找到个注入。。



id存在注入



1.jpg







2.jpg





还有很多这种大尺度的视频。。哎



无语了。



随意的count了下看下数量



code 区域
user_online_log       | 3988

user_follow | 3068

device_token | 7633

user_order | 5961

square_praise | 4425

`user` | 3534

user_album_photo | 3471

square_comment | 2242

payment | 1520

list_all | 6989

complex | 6267

square_personal | 6110

system_info | 3805

month_order_list | 3367

dict_region | 3338

sys_log | 2931

user_black | 783

room | 762

withdrawal | 487

system_infos | 475

xianrou_report | 446

`sensitive` | 433

square_report | 307

datas | 235

suggest | 216

product | 211

user_technician_skill | 126

album | 123

sys_group_permission | 82

site_dict | 74

sys_module | 51

tags | 45

square | 40

user_address | 38

order_review | 37

skill | 37

week | 30

xianrou | 13

video | 12

`month` | 8

news | 8

notice | 8

search | 7

review | 6

robert | 6

sys_user_group | 6

season | 4

orderlists | 3

user_technician | 3

`year` | 2

carousel | 2

sys_user | 2

user_comment | 2

user_work_time | 2

`module` | 1

online_day | 1

site_info | 1

upgrade | 1

user_reward | 1









把手机号码跑出来证明下



3.jpg









漏洞证明:

11

修复方案:

11

知识来源: www.wooyun.org/bugs/wooyun-2016-0196969

阅读:127052 | 评论:0 | 标签:xss 注入

想收藏或者和大家分享这篇好文章→复制链接地址

“APP安全之鲜肉一处xss/SQL注入泄露3万用户信息手机/身份证(模特居多)”共有0条留言

发表评论

姓名:

邮箱:

网址:

验证码:

公告

九层之台,起于累土;黑客之术,始于阅读

推广

工具

标签云