How did I bypass Sina Weibo's defense and continue to attract fans?

1. this hole is not the title party; 2. first refer to the vulnerability http://www.bkjia.com/Article/201302/191898.html to share a major Internet manufacturers to prevent CSRF common problems; 3. in fact, before that, I mentioned with Jin long that Sina has a problem with CSRF prevention. However, at that time, there was no strong evidence available, and today we are sending this together.
1. I will talk about two cases here. Let's start from the worst! 2. The problem of the site is microblogging media, see here: http://media.weibo.com/profile.php? Uid = 1807689562 & ref = 3. Click "follow" to capture the packet and view the sent request: a POST request! I thought it would be okay again: 4. the parameter uid is the object you want to pay attention to, and fromuid is your own. Others are not important and can be ignored. Of course, fromuid can also be ignored, I tried to change the n post I encountered to GET, and finally succeeded once. A lazy programmer! Construct the following link http://media.weibo.com/attention/aj_addfollow.php? Uid = 1981622273 & fromuid = uid is of course the official Weibo of wooyun! 5. Direct access is not acceptable. The referer is verified! I told the previous vulnerability that I put it under the Weibo domain. I first posted it on the Weibo homepage and clicked to access it. It seems that referer verification is deep enough! M00004 should be an error code: 6. Fortunately, this media.weibo.com can leave a message. Please leave a message here! The generated short links are also captured and spread. If you can match the texts of the literary style, the spoofing effect will be better: Click to access, because the referer at this time is indeed media.weibo.com, then I will be able to help wooyun brush fans!
1. This case is the same as described above. You can skip it! 2. Another micro-blog channel is called: http://kan.weibo.com/here, Weibo users can start a publishing. Other users can subscribe to this publication if they like it, but once subscribed, they must follow the publication owner! Click subscribe, capture the packet, and view the request. Wipe, a GET request, subscription and follow the journal master is this link to achieve: http://kan.weibo.com/aj/subscribe? Wid = 3444217594949975 & _ t = 0 & __ rnd = 13580832225143. the above Link parameter wid should be the unique identifier of the micropublication. The other two parameters can be ignored. I directly access the GET request and return the following information. The server will know that I want CSRF!
4. So I sent this link directly to the Weibo homepage: The generated short link is as follows: 5. Successfully subscribed to and followed by the Journal:
Solution: 1. It is better to change the key request to post! 2. It is better to add token to key requests! 3. Gifts and gifts! I am busy at the end of the year. I still don't forget to find holes for Sina. I want to encourage this kind of spirit.