360 change the password of any user

360 any user password modification (critical 360 mobile guard, 360 cloud disk, 360 browser cloud synchronization, leakage of Address Book, SMS, call records, etc.) and a female star account Oh! Ps: I tested the mailboxes of several 360 executives. As a result, people did not use their own products at all. The primary school student's memory was poor, and the password of the 360 account was forgotten in a timely manner. So we have the following plot. Retrieve the account password and send an email to my mailbox. http://i.360.cn/findpwd/setpwdfromemail?vc=e%2FwljiqD9WGv%2FwDyS93BghveGh%2FDYG4oMjJwcxGlcnSDZP3qIW4deYwnCpkdbCSZ3ByODXHZYDCx32A46l%2FBXxk6qo5oABIr6ZrywAoPB8DZuX81j%2Bb%2F2w%3D%3D&qid=507290669 Is this the connection address for changing the Password Found? Qid = 507290669 if the qid is modified, will it be useful and then changed http://i.360.cn/findpwd/setpwdfromemail?vc=e%2FwljiqD9WGv%2FwDyS93BghveGh%2FDYG4oMjJwcxGlcnSDZP3qIW4deYwnCpkdbCSZ3ByODXHZYDCx32A46l%2FBXxk6qo5oABIr6ZrywAoPB8DZuX81j%2Bb%2F2w%3D%3D&qid=507290670 Then the 360 website prompts you to modify the settings. Oh, my God, that's not the case. Why can't all accounts be changed? The problem is that I don't know other people's accounts. I went to my personal center and didn't have this id. I was prompted not to worry. Let's continue digging and find a website under 360: http://www.woxihuan.com/ http://www.woxihuan.com/ Star/timeline? Qid = 268296138 is there anything found? Yes, qid = 268296138. We are looking for the qid of the star nursery and then construct the following link: http://i.360.cn/findpwd/setpwdfromemail?vc=e%2FwljiqD9WGv%2FwDyS93BghveGh%2FDYG4oMjJwcxGlcnSDZP3qIW4deYwnCpkdbCSZ3ByODXHZYDCx32A46l%2FBXxk6qo5oABIr6ZrywAoPB8DZuX81j%2Bb%2F2w%3D%3D&qid=268296138 We sent the artifact Burpsuite. When we used the password retrieval link to change the password, we intercepted its post package.


In addition, we can also change the password when we know the mailbox does not know the qid: first, use your account to get a 360 password retrieval url, then we change the uname here to the target mailbox destination mailbox to change the password: 410316816@qq.com can change the password of the specified mailbox