A giant network design defect cracking Weak Password

A giant network design defect cracking Weak Password

It's not easy. Ask for a homepage and a high rank.

We all know dudu.

Dudu.ztgame.com

They are all broadcasters. In theory, they all have backend management. Find them.


Google hack.

Http://bb.ztgame.com/backend/index/login
 

As you can see, when the user name does not exist, there will be a corresponding prompt, so let's crack it.
 

POST /backend/index/login HTTP/1.1Host: bb.ztgame.comUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:34.0) Gecko/20100101 Firefox/34.0Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8Accept-Language: zh-cn,zh;q=0.8,en-us;q=0.5,en;q=0.3Accept-Encoding: gzip, deflateReferer: http://bb.ztgame.com/backend/index/loginCookie: DUDUSID=bv84pt4togkebssqf880g5fc81Connection: closeContent-Type: application/x-www-form-urlencodedContent-Length: 31username=liubin&password=123456

We can see that several user names have been successfully run.

Zhanghao

Liubin

Liting

Zhangwei

Set the user name and run the password again.

Ran times and finally ran out.
 

Liubin/1, 567890

Log in

There are a lot of background functions, and I will not describe the harms of various permissions. Go straight to the back-end.
 

You can also describe the functions, such as user management, video monitoring, scheduling, and configuration. Various anchor operations, T people, etc.

Solution:

Fix.