Test the vulnerability of an icloud phishing site

Test the vulnerability of an icloud phishing site

Yesterday, a great guy hacked an icloud phishing site for the goddess for 10 minutes. He didn't want to receive a phishing email today, but also followed by a brush. But the phishing site of the scammers really does nothing.

Yesterday, a great guy hacked an icloud phishing site for the goddess for 10 minutes. He didn't want to receive a phishing email today, but also followed by a brush. But the phishing site of the scammers really does nothing.



First, the site: http ://**.**.**.**/



CLICKING In the UI is good, but there is basically no tag hyperlink on the page to click, except for the user name and password to enter.
 

If any password is entered, an error is prompted, so you can view the source code and find that the data will be sent to this page.
 

Try to inject and find that there will be:
 

Traverse the site directory and find that the site permissions are not protected at all
 

Decisively take wwwroot and sell the producer easily
 

 

By the way... I also saw a file written in pinyin... Xiugai_email.asp, but no cookie is added ..

So the smtp mailbox and password are all sent out...
 

Yesterday, a great guy hacked an icloud phishing site for the goddess for 10 minutes. He didn't want to receive a phishing email today, but also followed by a brush. But the phishing site of the scammers really does nothing.



First, the site: http ://**.**.**.**/



CLICKING In the UI is good, but there is basically no tag hyperlink on the page to click, except for the user name and password to enter.
 

If any password is entered, an error is prompted, so you can view the source code and find that the data will be sent to this page.
 

Try to inject and find that there will be:
 

Traverse the site directory and find that the site permissions are not protected at all
 

Decisively take wwwroot and sell the producer easily
 

 

By the way... I also saw a file written in pinyin... Xiugai_email.asp, but no cookie is added ..

So the smtp mailbox and password are all sent out...
 

 

Solution:

It is not easy for a phishing site to achieve this by renting a server.

Permission and user authentication. In addition, the code can be encapsulated to reduce the number of problems.