I bought a mobile client account interface security request Restriction Bypass and repair solution

Bypass the mobile client interface can not directly request the policy first, the client data packet capture, get interface http://mobile.womai.com/wmapi/loginpassword=123456&username=wooyun6 direct hackbar access, no data but through the black box test, add the client to identify, you can directly request it. You can use other pants to hit the database, perform brute force verification, and try again, directly check the length of the returned data and you will know that this bypass is good for the hacker.
Registration as above, direct hackbar request invalid http://mobile.womai.com/wmapi/register conirmpw = wooyun123 & password = wooyun123 & email = wooyun1 % 40123.com& username = wooyun1 join parameter bypass, you can registerSolution:

The verification code is displayed for multiple requests from the same ip address. It is important for the ip address not to go to the x-forward-for interface in e-commerce.