China Telecom ADSL an advertisement push system SQL Injection

China Telecom ADSL an advertisement push system SQL Injection

This type of hard advertisement often pops up when you open a webpage.

 

URL: http: // 121.32.136.50: 701/gz_20151128/guangzhou/20141028/BadwebRemindPage. aspx? Param = Signature =



I can't bear it anymore. I have to dig it out.

Try to perform base64 decoding on the param value, which is garbled



See this code in js

var paraStr = params.substring(9);var paraArr = decode64(paraStr).split('&');for(var i=0;i<paraArr.length;i++){var strArr = paraArr[i].split('=');if(strArr[0] == "type"){type = strArr[1];}if(strArr[0] == "srcUrl"){sourceUrl = strArr[1];}}

Put? Remove the nine characters param = AB and then return the original text in base64.

UserName = 020xxxx@163.gd & srcUrl = www.baidu.com & policyId = 1375 & srcIp = 127.0.0.1 & type = 0


The injection points in the userName of thirdconfirm. aspx are tested.



In order to facilitate injection, a short piece of code is developed.

<? Phperror_reporting (1);?> <! DOCTYPE html> 

After testing, it is found that it is an Oracle database.
 

 

Solution:

Filter