Record once, modify password logic vulnerability actual combat

Catalog

0x0a Status code information ：

0x0b The nature of the vulnerability ：

0x0c Information gathering ： js White box

0x0d Don't talk much, do it

0x01 Verification code bypass

0x02 Intercept the return packet , Modify the status code

0x03 Modify reset password

It is found that Prompt process error

0x04  Modify the status code

0x05  Log in with the new password   Successfully logged in  

The vulnerability has been fixed , Do not operate carelessly . 

0x0a Status code information ：

HTTP Status code from Three decimal digits make up

There are five types of responses ： Information response (100–199), Successful response (200–299), Redirect (300–399),

Client error (400–499) And server errors (500–599).

0x0b The nature of the vulnerability ：

Lack of back-end authentication or server authentication , And the front end lacks logic .

0x0c Information gathering ： js White box

vue frame , miscellaneous webpack, Infer the use of js Front end validation .

f12 see ctrl+f Search for logical vulnerability keywords “ Verify success ”

Combine the front , There may be a single front-end certification

Ideas ： Grab the bag , modify response Status code for ：200

0x0d Don't talk much, do it

0x01 Verification code bypass

Note that the verification code is not obtained at this time

0x02 Intercept the return packet , Modify the status code

 do intercept ——> Response to this request

  Modify the status code to 200

  Verification code bypassed successfully

0x03 Modify reset password

0x00 It is found that Prompt process error

f12 View source code

I found that there are still js authentication   , Because the last step may lack js Parameters

That's it   Try whether you can bypass here

0x04  Modify the status code

  Successfully bypassed

0x05  Log in with the new password   Successfully logged in  

The vulnerability has been fixed , Do not operate carelessly .