163 reset the password of any user on the Network Disk (admin demo)

163 reset the password of any user on the Network Disk (admin demo)

Register a test account first:

 

Account: test2 password :******

If you want to find an account, such as "admin", reset the password of the Account "admin.

1. Use the account test2 to retrieve the password normally,
 

 

The email has received the link,
 

2. Open the link in the google browser and enter the new password "cs666666 ",
 

Burp captures packets and modifies the user parameter to "admin ",
 

After submission, the page returns "server return failed ".

It doesn't matter. Try again. Click "Submit" again, capture packets, modify user parameters, and find that this operation is successful,
 

3. log on to the admin account with the password "cs666666" in the 360 browser,
 

The Reset is successful.

Repair Solution

1. Verify the permission;

2. When I started to test the admin account, I tried to see if I could reset the administrator account.