Multiple vulnerabilities of dongle can be exploited to manipulate website configurations of any account and blacklist all users with one click (users will be blocked by dongle)

Source: Internet
Author: User

Multiple vulnerabilities of dongle can be exploited to manipulate website configurations of any account and blacklist all users with one click (users will be blocked by dongle)

The vulnerability may seem silly but harmful.

By the way, the Postmaster pays close attention to the advertisement.

PyDbg, a powerful web debugging tool, originally used to deal with Google's security policies

Main modules:
Http Analysis Tool (under construction)
Http client (stable version)
Mitm proxy (Beta)
Automated Tools for autoit functions (stable Edition)
Email client (test version)
Adsl dial-up database (stable version)
Distributed proxy client, server (stable version)
Distributed Task client, server (under construction)
Desktop simulation client, server (under construction)

Cross-platform http analysis tools and secondary programming
Underlying socket of the http client, built-in socks proxy, timeout retry, automatic decoding, custom packet size, automatic post-byte calculation, etc.
The mailbox client directly calls the web api to send and receive emails (mobile phone verification is required for pop functions)
Autoit is an automated tool for most of autoit functions, optimized color recognition, close to the real mouse track and speed, etc.

What other functions are missing? pm, website construction in progress. Please wait for the test version

If you are studying the logic vulnerability defense policy, you can also pm me.

Target for the web version of OllyDbg and VMProtect


Register an account at register a domain name:

Then go to the monitoring module:

Because it is get, after we modify the id, there will be a strange thing:

Random change:

The first few are safe dogs:

1 server security dog

2 server security dog official forum

3. Safety dog detection

6. dongle cloud security center

Put it first, and return to your website list. click Modify Name:


Change to the dongle id:

Let's take a look at the safe dog page and change it:

Then let's take a look at the website configuration. We randomly check one and click pause:

Unauthorized access:

Further modification:


The dongle has another defect that can be exploited:

Go back to your website list and modify the configuration:

Packet Capture analysis:

We add 0 to the networkNode value. The Error 500 is displayed when you access the dongle page:

It is completely blocked and cannot be refreshed. It is impossible to modify the configuration information:

Change back to the original value to restore normal.

This is your user list. After traversing a little bit (Powered by PyDbg), do you have any monitoring information? :

After traversing the page, all accounts will be locked. Even if you unlock the account and configure the account, the account will be completely out of sight. There are even more amazing things to be tested by yourself, such as deleting the domain name or something.

Currently, the defense against logical vulnerabilities is still blank:

With the gradual migration of various businesses to the cloud, enterprises will face more and more in the future: unauthorized operations, data leaks, credential stuffing, cracking, business attacks, automated attacks, etc. These are all ignored by existing WAF.

Without legal restrictions, it would be terrible to launch an automated business attack. Enterprises will eventually be overwhelmed by junk data.



Related Article

Contact Us

The content source of this page is from Internet, which doesn't represent Alibaba Cloud's opinion; products and services mentioned on that page don't have any relationship with Alibaba Cloud. If the content of the page makes you feel confusing, please write us an email, we will handle the problem within 5 days after receiving your email.

If you find any instances of plagiarism from the community, please send an email to: and provide relevant evidence. A staff member will contact you within 5 working days.

A Free Trial That Lets You Build Big!

Start building with 50+ products and up to 12 months usage for Elastic Compute Service

  • Sales Support

    1 on 1 presale consultation

  • After-Sales Support

    24/7 Technical Support 6 Free Tickets per Quarter Faster Response

  • Alibaba Cloud offers highly flexible support services tailored to meet your exact needs.