The full-network user password of Apsara stack can be reset.

The full-network user password of Apsara stack can be reset.

The full-network user password of Apsara stack can be reset.
Simple

It is not a brute-force SMS verification code, but a logic reset vulnerability.

1. First, go to the forgot password
 

2. To get the verification code, here write down the url, https:// I .feiniu.com/lostPwd/verifyIdentity? Key = 865ea2a1e35e91b72c86d44ca2d32461

The following key = 865ea2a1e35e91b72c86d44ca2d32461 is used.

Click to obtain the verification code. You do not need to crack the text message verification code here,
 

In the actual test we found that step 3 reset the password url to https:// I .feiniu.com/lostPwd/setNewPwd? Key = xxxxxx. You can splice the key in the second step.
 

Successfully entered,
 

Successfully entered,
 

 

Solution:

You know.