点击「蓝色」字体关注我们！
找的一个生活小程序
这里来到登录处进行登录
点击获取验证码后进行抓包
抓取响应包看看
有sid和masToken,先记录下,看看后续利用
Response如下:
HTTP/1.1 200Server: openrestyDate: Sat, 09 Mar 2024 04:09:11 GMTContent-Type: application/json;charset=UTF-8Connection: closeContent-Length: 233{"data":{"status":"1","msg":"请求成功!","data":null,"sid":"2726.4BCDBEF7A5934E738861653432AF339B1709957352381.0341036159538897.03410361","masToken":"8b7a6489ea6f1e3c500b8688113d8579","runTime":"2024-03-09 12:09:12"},"status":"1"}
这里先填入正确的验证码,然后抓取响应包看看
Response如下:
HTTP/1.1 200Server: openrestyDate: Sat, 09 Mar 2024 04:10:31 GMTContent-Type: application/json;charset=UTF-8Connection: closeContent-Length: 1342{"data":{"id":114602200,"mobile":"1881924****","pwd":"******","userName":null,"gasAccount":null,"userCode":null,"userState":0,"level":1,"birthday":null,"sex":0,"addressId":0,"email":null,"registerTime":null,"inviter":null,"inviteCode":"1","lastLoginTime":null,"lastLoginIp":null,"allIntegral":0,"allConsume":0,"workUnits":null,"workPhone":null,"appuserHomePhone":"","createTime":null,"integral":0,"orderGasNo":"","gasCardCode":null,"remark":null,"growValue":0,"picdir":null,"isFinancial":0,"detailAddress":"","companyPhone":"","contacts":"","createDate":"","deliverAddress":"","gasCompanyId":null,"gasCompanyName":null,"gasOutletsId":null,"deliverCompanyName":"","floor":"","gasCardState":"","gasCardStateName":"","idNumber":"","keyWords":"","mobilePhone":"","operatorId":"","operatorName":"","gasOutletsName":null,"payType":"","payTypeName":"","sexName":"","updateDate":null,"updatePerson":"","userId":"","userType":"","userTypeName":"","appUserId":0,"userArea":"","elevator":"","position":"","userAddress":"","lpgInviteCode":"","gasUserName":"","homePhone":null,"custCode":"","GROUPNAME":"","metertype":"","platformadminId":"","appuserKey":"[B@5888e9d2","errorTime":0,"groupname":""},"masToken":"8b7a6489ea6f1e3c500b8688113d8579","sid":"2726.4BCDBEF7A5934E738861653432AF339B1709957352381.0341036159538897.03410361","status":"1"}
发现sid和masToken是上一步我们抓取验证码响应包的,一模一样
(也就是信息泄露漏洞,泄露了sid签名和token值)
并且appuserKey经过多次抓取,不变!!!
那岂不是可以任意伪造(改好替换响应包),只要知道id值,从而变成任意用户登录(逻辑漏洞任意登录)
这里省略抓取请求验证码的响应包记录下sid和masToken,然后随便输入6个1,点击登录抓取响应包,改好后进行替换响应包
成功登录
PwnPigPig知识星球优惠卷
#
原文始发于微信公众号（PwnPigPig）：太会了!女朋友挖了一个有意思的小程序漏洞
原文始发于微信公众号（PwnPigPig）：太会了!女朋友挖了一个有意思的小程序漏洞
免责声明:文章中涉及的程序(方法)可能带有攻击性，仅供安全研究与教学之用，读者将其信息做其他用途，由读者承担全部法律及连带责任，本站不承担任何法律及连带责任；如有问题可邮件联系(建议使用企业邮箱或有效邮箱,避免邮件被拦截，联系方式见首页)，望知悉。
- 左青龙
- 微信扫一扫
-
- 右白虎
- 微信扫一扫
-
评论