APP安全之三维度从一个毫无用处的xss到获取大量身份证信息图片(包括李刚身份证)

客户端盲打
 
 得到
 
 toplocation : https://112.124.8.165:5887/orders/orders_list.jsp#
 cookie : username=tdd152; AgentID=1006; DeviceID=8106

request payload status error timeout length comment
 1 18682130587e 200 false false 2216 
 11 caojing 200 false false 2393 
 19 chenbin 200 false false 2583 
 49 chenjingli 200 false false 2346 
 52 chenjun 200 false false 2293 
 54 chenlei 200 false false 2339 
 56 chenliang 200 false false 2224 
 57 chenlin 200 false false 2367 
 62 chenmei 200 false false 2305 
 65 chenmin 200 false false 2301 
 66 chenming 200 false false 2437 
 69 chenping 200 false false 2311 
 70 chenqi 200 false false 2462 
 71 chenqiang 200 false false 2246 
 78 chentao 200 false false 2424 
 86 chenxia 200 false false 2386 
 88 chenxiaojuan 200 false false 2358 
 95 chenyan 200 false false 2308 
 98 chenyong 200 false false 2321 
 148 gaofeng 200 false false 2245 
 151 gaoshang 200 false false 2493 
 188 hepeng 200 false false 2315 
 204 huangjuan 200 false false 2327 
 214 huangwei 200 false false 2216 
 220 huangyong 200 false false 2445 
 247 jinyan 200 false false 2375 
 273 libing 200 false false 2386 
 280 lifang 200 false false 2277 
 282 lifeng 200 false false 2195 
 284 ligang 200 false false 2293