<em id="ddznf"></em>

<form id="ddznf"></form>
<noframes id="ddznf">

    
    

        技術干貨 > 文章詳情

        6種常見web漏洞坑

        柳絮飄飄_joan2年前

        邏輯漏洞挖掘一直是安全測試中“經久不衰”的話題。相比SQL注入、XSS漏洞等傳統安全漏洞,現在的攻擊者更傾向于利用業務邏輯層的應用安全問題,這類問題往往危害巨大,可能造成了企業的資產損失和名譽受損,并且傳統的安全防御設備和措施收效甚微。今天漏洞盒子安全研究團隊就與大家分享Web安全測試中邏輯漏洞的挖掘經驗。

        漏洞一:訂單金額任意修改

        解析

        很多中小型的購物網站都存在這個漏洞。在提交訂單的時候抓取數據包或者直接修改前端代碼,然后對訂單的金額任意修改。

        如下圖所示:

        222.png
















        333.png

        經常見到的參數大多為rmb、value、amount、cash、fee、money

          關于支付的邏輯漏洞這一塊還有很多種思路,比如相同價格增加訂單數量,相同訂單數量減少產品價格,訂單價格設定為負數等等。

        預防思路

        1.訂單需要多重效驗,如下圖所演示

        444.png



        2. 訂單數值較大時需要人工審核訂單信息,如下圖所演示。



        555.png

















        3. 以上只是提到兩個非常簡單的預防思路,第二個甚至還有一些不足之處。這里需要根據業務環境的不同總結出自己的預防方式,最好咨詢專門的網絡安全公司。

        漏洞二:驗證碼回傳

        解析

          這個漏洞主要是發生在前端驗證處,并且經常發生的位置在于:賬號密碼找回、賬號注冊、支付訂單等,驗證碼主要發送途徑為郵件、短信。其運行機制如下圖所示:

        6.png














        黑客只需要抓取Response數據包便知道驗證碼是多少。

        漏洞三.未進行登陸憑證驗證

        解析

        有些業務的接口,因為缺少了對用戶的登陸憑證的效驗或者是驗證存在缺陷,導致黑客可以未經授權訪問這些敏感信息甚至是越權操作。

        常見案例:

        1. 某電商后臺主頁面,直接在管理員web路徑后面輸入main.php之類的即可進入。

        666.png

        2. 某航空公司訂單ID枚舉

        888.png


















        漏洞四:接口無限制枚舉

        解析有些關鍵性的接口因為沒有做驗證或者其它預防機制,容易遭到枚舉攻擊。

        常見案例:1.某電商登陸接口無驗證導致撞庫



        99.png












        2. 某招聘網驗證碼無限制枚舉


        858585.png














        漏洞五:cookie設計存在缺陷

        解析

        這里需要對其詳細的說一下。我們先一個一個來吧。

        Cookie的效驗值過于簡單。有些web對于cookie的生成過于單一或者簡單,導致黑客可以對cookie的效驗值進行一個枚舉,如下圖所示:




        6757.png

























          根據上圖,我們可以分析出,這家網站對于cookie的效驗只單純的采用了一組數字,并且數值為常量,不會改變,這樣非常容易遭到黑客的枚舉。甚至有一些網站做的更簡單,直接以用戶名,郵箱號或者用戶ID等來作為cookie的判斷標準。

        漏洞六:找回密碼存在設計缺陷

        解析

        1.auth設計缺陷

          經常研究邏輯漏洞的人可能會對以下URL很熟悉  www.xxx.com/resetpassword.php?id=MD5

         用戶修改密碼時,郵箱中會收到一個含有auth的鏈接,在有效期內用戶點擊鏈接,即可進入重置密碼環節。而大部分網站對于auth的生成都是采用rand()函數,那么這里就存在一個問了,Windows環境下rand()最大值為32768,所以這個auth的值是可以被枚舉的。如下面這個代碼可以對auth的值做一個字典。

        999.png

        然后重置某個賬號,并且對重置鏈接內的auth進行枚舉

        000.png









        2.對response做驗證

          這個漏洞經常出現在APP中,其主要原因是對于重置密碼的的驗證是看response數據包,由于之前的案例沒有截圖,只能畫個流程圖給大家演示一下。


        858586666.png













        總結

        以上見到的只是幾個比較經典的和常見的邏輯漏洞,這些邏輯漏洞也是程序開發人員和安全檢測人員需要留意的。



        版權保護聲明:本文轉自ArthurKiller@漏洞盒子安全研究團隊,本文僅代表作者觀點,麥子學院可能會進行刪節修改,但不代表麥子學院的官方立場。我們極其尊重并保護原創作品的版權,若原作者有任何疑問,請聯系微信號:chengxuyuan8



















        1

        登錄 后參與討論

        沒有更多評論了

        免費領取價值1888元求職寶典!

        客服熱線 400-862-8862

        回到頂部

        916官方彩票 www.91779l.com | 83086c.com | www.50999z.com | www.343177.com | 500000419.com | www.89677x.com | tt5443.com | www.js60g.com | www.55785.com | 3304f.com | www.854569.com | www.173880.com | 31780000.com | www.25688e.com | js909020.com | www.q32939.com | usacits.com | www.yh77702.com | www.68568h.com | 8037xxx.com | www.5981h.com | 365808.com | ms38648ff.cc | www.hg9945.com | www.22ttz.com | js11213.com | www.68365y.com | hg28.com | www.615073.com | 3189ee.com | www.js50333.cc | www.c602.cc | 2381rr.com | www.120611.com | 0667.com | www.73990s.com | 22205pj.com | www.glc555.com | 22225003.com | www.qn268.com | www.178385.com | www.825909.com | www.686536.com | 159194.com | www.5086f.com | 55ii8332.com | www.6364y.com | aobo12.com | www.vip88.so | 8569811c.com | www.ok95.com | www.76060m.com | www.869576.com | www.68666w.com | www.qucp7.com | 888234.com | www.41msc.com | www.2875r.com | 3379s.com | www.91233k.com | hh5443.com | www.16878c.com | 50000977.com | www.775710.com | www.ylg268.com | www.661526.com | www.383050.com | www.106572.com | www.rf615.com | 20775511.com | www.huangma26.com | yl66yl77.com | www.yuehengsz.com | 3405y.com | www.6653e.com | 6261ss.com | www.05500w.com | vns6618.com | www.910882.com | www.www8181sun.com | www.36166u.com | www.634599.com | 0612h.com | www.26123jj.com | 6269qq.com | www.28891a.com | 1077gg.com | www.943893.com | www.3332558.com | www.77210a.com | www.881389.com | 77225002.com | www.402997.com | 35zz.vip | www.qmkl2.com | www.0679555.com | www.54400o.com | www.0477msc.com | blr3033.com | www.vnsr2345.com | 7508a.com | www.799486.com | www.hg5100.com | 7874.cc | www.4546200.com | 61324466.com | www.501354.com | www.8222000.com | 188qq444.com | www.7239c.com | www.237015.com | www.80075e.com | www.daf005.com | www.803875.com | www.pjbet444.com | d3644.com | www.788495.com | www.60108z.com | www.55070y.com | www.18599.com | 705558.com | 06006p.com | www.hy6935.com | www.7036g.com | www.44799.com | 8901x.com | 9679i.com | hd2629.com | www.001ac.com | www.4196s.com | www.hg5588l.com | 314.cc | s99345.am | www.106576.com | www.50024x.com | www.1429g1.com | www.hg514.com | www.200448.com | lh66x.com | 6641q.com | www.912485.com | www.2y930.com | alpk22.com | www.977389.com | www.7140988.com | www.23 | www.mgm006.com | wns3.net | 65561177.com | 3238.com | hd5009.com | www.dqz7.com | www.954321u.com | www.472705.com | www.0003yh.com | 6220gg.com | 90856i.com | 9949z.com | www.77114e.com | www.500cd.com | www.48330g.com | www.4136q.com | www.3331js.com | www.yh6001.com | pj300.cc | 8181msc.com | 8892958.com | www.61655v.com | www.ya022.com | www.89777q.com | www.33678rr.com | www.sscb77.com | www.13798a.com | www.hg00555.com | cc2205.com | 55388.com | 3304r.com | 1859002.com | m00351.com | www.813770.com | www.60108h.com | www.ag99365.com | www.8473o.com | www.67799.com | www.0151u.com | www.pj8585.com | 253508.com | 4340s.com | 7720w.net | yabo6000.com | 11683344.com | www.001036.com | www.717671.com | www.2350s.com | www.65707b.com | www.910655.com | www.103565.com | www.4058yy.com | www.98698b.com | www.6003q.com | www.88399b.com | www.20161144.com | www.362878.com | www.8473d.com | jimei6666.com | 44vv8331.com | k35151.com | 33313c.com | 7989g.com | 0015vv.com | 8569811n.com | y08199.com | 4025h.com | 4775566.com | zhibet188.com | 5988365.com | cabet266.com | 4694b.com | dianzi580.com | 4646755.com | 19880.com | 56988g.com | 61789k.com | k5429.com | 8547r.com | www.4102u.com | www.cn365m.com | www.55545q.com | www.8865tt.com | www.8864tt.com | www.71071u.com | 11005p.com | 41188844.com | 15a14.net | 681068.com | 6261kk.com | 83377f.com | ii2205.com | www.4123nn.com | www.vns9982.com | www.xpj5t5.com | www.kelake22.com | www.hg8547.com | www.599234.com | www.msc855.com | www.0057c.com | www.673888c.com | www.9822ae.com | www.s63568.com | www.37377h.com | www.77114g.com | www.5441z.com | www.qucw8.com | www.673266.com | www.215602.com | 5906zz.com | 3121c.com | 01885q.com | 7599w.com | 25288m.com | 8742d.com | www.ylg08.com | www.tb186.com | www.705msc.com | www.55060p.com | www.1764j.com | www.71789.cc | www.550174.com | hg77750.com | 4018j.com | 99698q.com | jinguanylc9.com | js29391.com | www.00618v.com | www.168345.com | www.28000z.com | www.838957.com | www.53900k.com | www.715934.com | x33.vip | 58588q.com | 118888u.com | xx2649.com | www.hg5801.com | www.626suncity.com | www.115527x.com | www.4323c.com | www.916044.com | 7335n.com | 7742ww.com | 1cp055.com | www.8694y.com | www.998855x.com | www.js89l.vip | www.98528e.com | www.229958.com | feicai0790.com | 8159eee.cc | 3336609.com | www.0885k.com | www.js8888888830.com | www.51331g.com | www.394811.com | 35252d.com | 4036n.com | www.hjha77.com | www.18997.com | www.0600a.cc | www.959122.com | xpj708.com | 9068yy.com | www.0099hg.com | www.www-737475.com | www.07679y.com | www.c1959.com | ca5055.com | 4557.com | www.zzzz0266.com | www.5981o.com | www.50052j.com | www.095335.com | 6245t.com | kk2205.com | www.861000.com | www.8082.am | www.585116.com | 22207q.com | 59889m.com | www.173msc.com | www.837929.com | www.811672.com | 49490524.com | j8159.cc | www.f948f.com | www.dfw993.com | www.65707v.com | 3405o.com | www.9992558.com | www.7225k.com | www.3cpb.com | 1389w.com | 22556b.com | www.0748.cc | www.71399p.com | 0986.com | 159666m.com | www.56520u.com | www.vip7033.com | www.80065o.com | 4590l.com | www.358012.com | www.12136f.com | www.249770.com | 9679m.com | www.2078e.com | www.380820.com | www.217630.com | x14666.com | www.dd7920.com | www.68993253.com | 50067.com | 2127ll.com | www.8886567.com | www.39500l.com | sbfa999.com | 777hg000.com | www.829797b.com | www.616971.com | 66681y.com | www.hg1733.com | www.16065e.com | 168cp-c.com | 5443gg.com | www.938w.cc | www.976115.com | 4379c.com | www.88807x.com | www.00797b.com | 2019ii.cc | 2381xx.com | www.04567p.com | www.976821.com | 13825522.com | www.636123.com | www.9356n.com | 4995x.com | xin98886.com | 386kzi.com | www.4694q.com | www.422323.com | 8547uu.com | www.56655n.com | www.934077.com | 3405xxx.com | www.11139l.com | www.658zf.com | 83378a.com | www.33352055.com | www.8618aa.com | 0683g.com | www.pj2299.com | www.3552g.com | 33013.com | www.6699ok.com | www.055j.cc | 7555v.com | www.901690.com | www.807266.com | c7742.com | www.8473q.com | www.43131v.com | 23800j.com | www.1434p.com | 2851b.com | www.10899g.com | www.07949.com | 99151j.com | www.771990.com | www.876879.com | 9649g.com | www.673888q.com | 1168l.com | www.ylg777555.com | www.9646w.com | 0099066.com | www.hg7939.com | www.758022.com | 83138u.com | www.vnsr398.com | 8030x.com | www.362833.com | www.622by.com | 9958966.com | www.hg173i.com | 8569811t.com | www.8694f.com | www.3416x.com | b9957.com | www.93955c.com | 3169r.com | www.99997488.com | www.608850.com | 66876q.com | www.hg3006.tw | uc375.com | www.28000g.com | 80060404.com | www.zb933.com | www.844141.com | 2613d.com | www.89777d.com | yabo535.com | www.tyc8138.com | hg97222.com | www.amh008.com | www.602630.com | www.kfa6.com | www.5086s.com | 00774tt.com | www.6678579.com | 91019p.com | www.bet63l.com | ribo25.cc | www.813365.com | 8036xx.com | www.3xh3.com | www.253529.com | www.hg33555.com | www.928621.com | xpj677i.com | www.12656.cc | 31894000.com | www.68682m.com | 1591vip.com | www.89777n.com | 22222ylg.com | www.55717c.com | xpj05000.com | www.68365e.com | 35222m.com | www.m.195668.com | 6175hh.com | www.0600l.cc | 316x.cc | www.js2016.com | yh99949.com | www.820568.com | a81570.com | www.http://448378.com/ | 62222v.com | www.4196d.com | 8757055.com | www.58908b.com | 7555v.com | www.7240c.com | xx3405.com | www.585732.com | 0559688.com | www.bet73g.com | 6269pp.com | www.31847.com | 6922012.com | www.959589.com | www.3xinhao.com | www.375953.com | www.5599pj.com | 00hh8331.com | www.11132.com | 7893w23.com | www.10999f.com | yth67.com | www.amjs779.com | 10104688.com | www.9149a.com | www.1112xj.com | www.506951.com | www.ylzz7770.com | 2613v.com | www.1168l.com | 1770s.com | www.495.bb | m77304.com | www.lfu8.com | www.362822.com | P35u.com | www.5099ss.com | 2222.ag | www.159433.com | ylzz7.cc | www.268177.com | www.499456.com | feicai0991.com | www.86339z.com | 00774tt.com | www.799666aa.com | www.pj88137.com | 3844dd.com | www.bwinyz40.com | 6146m.com | www.7782m.com | www.809990.com | 3189z.com | www.10999y.com | 33882007.com | www.c9337.com | www.js466.com | 5360m.com | www.1764a.com | x86002.com | www.324877.com | www.369038.com | b1458.com | www.8039o.com | www.7025z.com | 76543g.com | www.535083.com | LXYL352.com | www.230278.com | www.85857r.com | 3890f.com | www.ya150.com | www.cs55222.com | 4155.cc | www.68cc3.com | www.pj39330.com | 86611c.com | www.55676c.com | 00778f.com | 2014a.com | www.083377.com | y980.com | 5533412.com | www.0022737.com | 35442777.com | www.209703.com | www.89599n.com | 2127.com | www.187512.com | www.bet91485.com | 2649c.com | www.88065a.com | www.hyi158.com | 68963888.com | 4195dd.com | www.http://489633.com/ | 2505am.com | 4338099.com | www.209576.com | www.kf388.com | 88993u.com | www.68993267.com | www.b27229.com | c67890.com | www.27775.cc | www.745968.com | 4136q.com | www.665039.com | www.sscb22.cc | 6868aa.cc | es999.net | www.amjs449.com | www.059778.com | g67890.com | www.371p.cc | www.yinhe6.cc | 2012bet6.com | 79964c.com | www.487bbb.com | www.yh1357.com | 66300.org | www.ct8877.com | www.27363f.com | 9030z.com | xyccwlkj.com | www.sx1855.com | www.xpj2718.com | bbb5657.com | www.324177.com | www.88000xpj.com | www.yh1555.com | 55331xs.com | www.907844.com | www.4136s.com | www.kkw915.com | 118888k.com | www.ascp9.com | www.6776dd.com | 5130.cc | 22883n.com | www.637012.com | www.6664ylg.com | www.hg2239.com | x33y.vip | www.611669.com | www.327969.com | www.365815c.com | 01234cc.com | www.178759.com | www.81608s.com | www.wns4567.com | xx7742.com | 22betbet365.com | www.39500q.com | www.5504k.com | 55295zz.com | 00774ii.com | www.dacp123.com | www.7350.vip | www.1007b.cc | 951202.com | 2008oo.com | www.ck6587.com | www.2021g.com | www.20161166.com | 2757d.com | kf121.net | www.hf5887.com | www.gbt0201.com | www.yh8434.com | 00048g.com | 51133c.com | www.767198.com | www.7920q.com | www.hg6651.com | d3144.com | 1104.com | www.89894d.com | www.71399g.com | www.4694b.com | www.551701.com | 26119.com | aa33332.com | www.550194.com | www.js7582.com | www.79500t.com | www.vip6277.com | 33318o.com | 530598.com | www.399049.com | www.3978c.com | www.4212h.com | www.0860s.com | 6175oo.com | 08159a.com | pcdd.net | www.ybao4.com | www.56011d.com | www.70852a.com | www.www-36525h.com | e86811.com | 30019rr.com | 134345.com | www.03gcw.com | www.56011l.com | www.9611msc.com | www.dwc4.com | 9149v.com | 2222k05.com | 0029d.com | www.544646.com | www.54968f.com | www.9895h.com | www.868444.com | www.831813.com | 44488d.com | 33432y.com | www.196903.com | www.3552e.com | www.4809t.com | www.38345x.com | www.33318x.com | 3379jj.com | y7062.com | 1479o.com | amzsyl8.com | www.890723.com | www.77802l.com | www.8c999.com | www.58665l.com | www.09323.cc | www.xhtd09.com | zhcp25.com | bg867.com | y2557.com | 20833g.com | www.35155o.com | www.766076.com | www.64040.com | www.hg77740.com | www.88mgm777.com | www.5966eee.com | www.063801v.com | www.tushan98.com | 3434ccc.com | x33g.vip | 35222s.com | 4809x.com | 26444d.com | 518cp4.com | www.127192.com | www.677397.com | www.1368e.cc | www.2846.cc | www.1115.com | www.77782yh.com | www.4078s.com | www.751cp55.com | www.767.cc | www.wns08888.com | www.2222558.com | www.hg0002.com | 4116g.com | jsh600.com | 2005.com | 2490h.com | 3890b.com | 9068x.com | 8668099.com | mayait.cn | y888.com | 5360ss.com | 712930.com | 36989.com | 6363i.com | 89892.com | 11989v.com | 66300vip16.com | www.87668u.com | www.202417.com | www.364077.com | www.560121.com | www.587344.com | www.648668.com | www.809182.com | www.825799.com | www.911924.com | www.903019.com | www.901770.com | www.809215.com | www.703027.com | www.703602.com | www.628846.com | www.599845.com | www.530534.com | www.395411.com | www.339125.com | www.277320.com | www.178192.com | www.35918e.com | 0139365.com | 33567e.com | by301.com | 80850e.com | 9193.com | 11422b.com | 3066rrr.com | 4488x.com | 00226132.com | 3379s.com | 496677.com | www.546004.com | www.4972oo.com | www.34557.com | www.bj448.com | www.w75.com | www.cp98.com | www.5189222.com | www.99552ff.com | www.rrqp222.com | www.6000hd.com | www.94580.cc | www.980797.com | www.607269.com | www.66653i.com | 69990u.com | ff555v.com | 4828.com | 3685.com | le888a.com | www.yl78776.com | www.y18001.com | www.888345.com | www.h92776.com | www.993776.com | www.866067.com | www.2934g.com | www.675630.com | rgcp.com | xpj238803.com | 9694p.com | 3700988.com | 131v.net | www.z30226.com | www.499456.com | www.222jyh.com | www.7920u.com | www.60007d.com | www.933771.com | www.33112a.com | youfa111.vip | 7599hh.com | 2506d.com | www.bet3652019.com | www.hg8053.com | www.4963zz.com | www.773560.com | www.36166n.com | www.576411.com | 95gamevip3.com | hg999333r.com | 5588xpj.com | www.pj5722.com | www.03345.com | www.0031331.com | www.aobo191.com | www.842223.com | 01885j.com | d2306.com | 44hh8332.com | www.hg1966.com | www.9101901.com | www.81508y.com | www.9478b.com | www.178562.com | 66c51.com | a3672.com | www.yh8333.com | www.8888bmw.com | www.668puj.com | www.022sc.cc | df8t.com | 1669s.com | 123456vip.cc | www.066005.com | www.88166h.com | www.22062c.com | www.500823.com | 77605i.com | jing7771.com | www.dwc4.com | www.755.so | www.7239x.com | www.332092.com | 00w77.vip | 1077kk.com | www.9284444.com | www.9737tt.com | www.52303z.com | www.83993v.com | n888vv.com | 8052.am | www.4406132.com | www.hbet98.com | www.769117.com | yh7788.bet | heji271.com | www.vns7330.com | www.115527c.com | www.ztc7.com | 2355.com | 00bb8331.com | www.284444.me | www.88325c.com | www.cb3988.com | 7240k.com | 7894x53.com | www.js9997.com | www.4546700.com | www.938751.com | 88894v.com | 2677mmm.com | www.77938.com | www.966668.com | www.567620.com | dzhcp7.com | bm1394.com | www.56655q.com | www.62118d.com | 83378j.com | 87965.com | www.17011.com | www.8577.com | www.550436.com | 1697033.com | www.hgw3999.com | www.jz5777.com | www.3416e.com | 3614p.com | 777777070.com | www.622206.com | www.73736d.com | 0030.com | 8666.hk | www.285280.com | www.868339.com | 196600.com | 2005.com | www.365.pw | www.71233l.com | 212300.com | 3009y.com | www.fff3997.com | www.31847.com | 66458m.com | 3016.com | www.5099tt.com | www.917699.com | 0253.com | www.995f.net | www.55676m.com | h61653.com | 7742nn.com | www.188sb.21.sb | www.022sx.cc | 3834503.com | www.99955508.com | www.3846g.com | www.71233u.com | ag81155.com | www.397888b.com | www.6661f.cc | 36404433.com | www.557337.com | www.792065.com | 29918uu.com | 2677www.com | www.c32537.com | www.980996.com | 47751.com | www.708118.com | www.77802f.com | 1119420.com | www.vbo66.net | www.wns123d.com | rgcp.com | 500000434.com | www.04567c.com | www.401276.com | bowang005.com | www.6a444.com | www.919309.com | z21148.com | www.767.cc | www.0849.com | www.999999qipai.com | 414199.vip | www.81866l.com | www.7036ss.com | 80850y.com | 87680a.com | www.32031h.com | 6861.com | 4546vip3.com | www.666xx.cc | 4195u.com | www.jtx888.com | www.679.com | 500000565.com | www.80689.com | www.94383.com | 5360m.com | www.964808.com | www.33588c.com | 993311.com | www.hg474.com | www.cf9901.com | 4955t.com | www.50000955.co | www.502433.com | 97799p.com | www.627464.com | 5389.com | www.0xinhao.com | www.86267s.com | 2595v.com | www.67r6.com | www.821260.com | 80850nn.com | www.sha2244.com | 8381q.com | www.g88998.com | www.4323r.com | 1669s.com | www.511838.com | www.533081.com | js8800.net | www.280770.com | 88851q.com | www.hg656.com | www.216777aa.com | 13638.com | www.40598.com | 44zz8332.com | www.o8867.com | www.556zf.com | 0015zz.com | www.2021u.com | 80032233.com | www.hg10978.com | www.993621.com | 11jj8331.com | www.y2894.com | 074634.com | www.yy085.com | www.726032.com | h2649.com | www.954321a.com | 37775145.com | www.007ggb01.com | 11ss8331.com | www.h7788q.com | www.zch7.com | 9030y.com | www.222999qipai.com | 33143.cc | www.668cp11.com | shsxiwl.cn | www.9702e.com | www.681090.com | 4833044.com | www.66332y.com | bzl995.com | www.860840.com | 008423.com | www.04tyc.com | ibet888.net | www.969516.com | www.540577.com | www.yh77706.com | www.5522e.cc | 33382n.com | www.89777o.com | 3890f.com | www.73990f.com | 66150.com | www.5146z7.com | 15a47.net | www.2011.vip | 30019h.com | www.72477b.com |