Interesting multi-play cross-site

From the multi-play substation, let's review the previous two pop-up methods.

Site: http://y.duowan.com
Pop-up window 1:
The first pop-up window is easier to implement. Due to the vulnerability repair, it is impossible. To put it bluntly, you have to play more and love Weibo. There are several functions that have been tested, I found that some functions of content insertion are filtered, including modifying other content with Tamper Data. I also found that the text and image are no problem, so I can test other functions, I found that the video function requires a video playback page, so I casually found a page with "> <script> alert (1) </script>, click Save to find that there is no situation, and then click post, then the box pops up.


The function of music is tested immediately. After the screenshot is filtered, the content after the screenshot is found to be dropped by X, so it is added in the middle, but it cannot be saved. Because it cannot be played, http: // "> <script> alert (1) is used) </script> @ www.xxx.com/xxx.mp3 bypass. The window is displayed successfully.
Then there is the link function. The link is filtered after testing, but there is a preview title function, so I made a space title and put an XSS, that's it.

Pop-up window 2:
I don't know why. I have love to disable the post function, and I am a little confused. I can't start xss from the post without posting, so I had to look at the few functions left.

Some boxes in the modification of basic information are inserted in a sensitive manner. Two unfiltered fields are found, and the box is displayed after being modified using tamper Data.

 

Pop-up window 3: I changed the position of the bullet. Let's take a look at other places. I had a picture change and thought about how nice it would be to directly pass the php horse. It is unlikely that you can take a single look.

With a try, I uploaded an image and clicked Save settings. I looked at the TamperData package. The second package and the third package were a bit strange.

　　http://upload.y.duowan.com/photo_upload.do?userAgent=Mozilla/5.0%20%28Windows%20NT%205.1;%20rv:17.0%29%20Gecko/20100101%20Firefox/17.0 　　http://y.duowan.com/person/myphoto_post?photoUrl=http%3A%2F%2Fimg4.y.duowan.com%2F1667137.jpg&_=1358839269545

One request is HTTP_USER_AGENT, and the other one is Url. The two replay results are 500, but the second returns a json string,

Click here to control the photoUrl and submit the following content:

　http://y.duowan.com/person/myphoto_post?photoUrl=http://">&_=1358839269545 　　

Dialog box. Finished.