2024年3月9日19:28:20评论14 views字数 2198阅读7分19秒阅读模式

点击「蓝色」字体关注我们！

太会了!女朋友挖了一个有意思的小程序漏洞

找的一个生活小程序

太会了!女朋友挖了一个有意思的小程序漏洞

这里来到登录处进行登录

太会了!女朋友挖了一个有意思的小程序漏洞

点击获取验证码后进行抓包

太会了!女朋友挖了一个有意思的小程序漏洞

抓取响应包看看

太会了!女朋友挖了一个有意思的小程序漏洞有sid和masToken,先记录下,看看后续利用

Response如下:

HTTP/1.1 200 Server: openrestyDate: Sat, 09 Mar 2024 04:09:11 GMTContent-Type: application/json;charset=UTF-8Connection: closeContent-Length: 233{"data":{"status":"1","msg":"请求成功!","data":null,"sid":"2726.4BCDBEF7A5934E738861653432AF339B1709957352381.0341036159538897.03410361","masToken":"8b7a6489ea6f1e3c500b8688113d8579","runTime":"2024-03-09 12:09:12"},"status":"1"}

太会了!女朋友挖了一个有意思的小程序漏洞

这里先填入正确的验证码,然后抓取响应包看看

太会了!女朋友挖了一个有意思的小程序漏洞

Response如下:

HTTP/1.1 200 Server: openrestyDate: Sat, 09 Mar 2024 04:10:31 GMTContent-Type: application/json;charset=UTF-8Connection: closeContent-Length: 1342{"data":{"id":114602200,"mobile":"1881924****","pwd":"******","userName":null,"gasAccount":null,"userCode":null,"userState":0,"level":1,"birthday":null,"sex":0,"addressId":0,"email":null,"registerTime":null,"inviter":null,"inviteCode":"1","lastLoginTime":null,"lastLoginIp":null,"allIntegral":0,"allConsume":0,"workUnits":null,"workPhone":null,"appuserHomePhone":"","createTime":null,"integral":0,"orderGasNo":"","gasCardCode":null,"remark":null,"growValue":0,"picdir":null,"isFinancial":0,"detailAddress":"","companyPhone":"","contacts":"","createDate":"","deliverAddress":"","gasCompanyId":null,"gasCompanyName":null,"gasOutletsId":null,"deliverCompanyName":"","floor":"","gasCardState":"","gasCardStateName":"","idNumber":"","keyWords":"","mobilePhone":"","operatorId":"","operatorName":"","gasOutletsName":null,"payType":"","payTypeName":"","sexName":"","updateDate":null,"updatePerson":"","userId":"","userType":"","userTypeName":"","appUserId":0,"userArea":"","elevator":"","position":"","userAddress":"","lpgInviteCode":"","gasUserName":"","homePhone":null,"custCode":"","GROUPNAME":"","metertype":"","platformadminId":"","appuserKey":"[B@5888e9d2","errorTime":0,"groupname":""},"masToken":"8b7a6489ea6f1e3c500b8688113d8579","sid":"2726.4BCDBEF7A5934E738861653432AF339B1709957352381.0341036159538897.03410361","status":"1"}