Netease mailbox sets up messages to send text messages to bypass front-end restrictions to implement SMS bombs

Netease mailbox sets only the front-end sending time verification when messages are sent. Direct POST Data bypasses the front-end restrictions to implement SMS bombs, but the information content is basically fixed
Https://ssl.mail.163.com/config/mobileconfig/index
 
Enter the email account and password, enter the mobile phone number, and click send ....
 
 


 
 
Record the post data www.2cto.com
 
 
 
 
Send it in various ways .....
 
 
 
 
The password of the email account is required. The mobile phone number can be customized.

Proof of vulnerability:

{"Code": 200, "msg": "OK "}

Solution:

Restrict the number of messages to be received by each mobile phone number in the background program
Client JS is only used to improve user experience, and restrictions require background programs...