SiJiDo / H

H是一款强大的资产收集管理平台
846 stars 169 forks source link

Fixed cookie directing admin to unauthorized login(固定的cookie导致管理员未授权登录) #27

Open hackAK97 opened 2 years ago

hackAK97 commented 2 years ago
  1. Set up a successful H system environment locally, log in with the administrator, and use burpsuite to obtain the administrator's cookie 在本地搭建成功H系统环境,使用管理员登录后,使用burpsuite获取到管理员的cookie

图片1

  1. Find the target_ip where the H system is installed on the Internet, and visit http://target_ip:5005/index. The result is as follows: 在互联网上查找安装H系统的target_ip,访问http://target_ip:5005/index ,结果如图:

image

  1. Use burpsuite to intercept the request packet of http://target_ip:5005/index, and modify the cookie in the request packet to the cookie obtained locally in step 1 使用burpsuite拦截http://target_ip:5005/index的请求包,修改请求包中的cookie为第1步中本地获得的cookie image The response interface is as follows (you can log in successfully) 响应界面如下所示(即可成功登录) image
WULINPIN commented 2 years ago

wa