站点图标 谷姐靓号网

v免签有漏洞？支付宝wx收款被改损失几百！-超兽

root
Rate this post

看了下日志 直接试探了下后台入口 然后一个post 到/login 就进去了
支付宝 wx收款均被修改
想怀疑老密码被社工库搞了
但是。。。只有一次尝试就登录上了
29号开始登录了后台
30号晚上改的收款

    119.135.63.2 - - [29/Aug/2021:04:54:56 +0800] "GET / HTTP/1.1" 200 1489 "-" "Mozilla/5.0 (Linux; Android 10; GLK-AL00; HMSCore 6.0.1.305) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/88.0.4324.93 HuaweiBrowser/11.1.4.301 Mobile Safari/537.36"
    119.135.63.2 - - [29/Aug/2021:04:54:57 +0800] "GET /assets/fonts/source-sans-pro-600.woff2 HTTP/1.1" 200 86120 "http://pay.此处打码.xyz/assets/css/mikufont.css" "Mozilla/5.0 (Linux; Android 10; GLK-AL00; HMSCore 6.0.1.305) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/88.0.4324.93 HuaweiBrowser/11.1.4.301 Mobile Safari/537.36"
    119.135.63.2 - - [29/Aug/2021:04:54:57 +0800] "GET /assets/fonts/source-sans-pro-300.woff2 HTTP/1.1" 200 86284 "http://pay.此处打码.xyz/assets/css/mikufont.css" "Mozilla/5.0 (Linux; Android 10; GLK-AL00; HMSCore 6.0.1.305) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/88.0.4324.93 HuaweiBrowser/11.1.4.301 Mobile Safari/537.36"
    119.135.63.2 - - [29/Aug/2021:04:54:58 +0800] "GET /favicon.ico HTTP/1.1" 200 18624 "http://pay.此处打码.xyz/" "Mozilla/5.0 (Linux; Android 10; GLK-AL00; HMSCore 6.0.1.305) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/88.0.4324.93 HuaweiBrowser/11.1.4.301 Mobile Safari/537.36"
    119.135.63.2 - - [29/Aug/2021:04:54:58 +0800] "GET / HTTP/1.1" 304 0 "-" "Mozilla/5.0 (Linux; Android 10; GLK-AL00; HMSCore 6.0.1.305) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/88.0.4324.93 HuaweiBrowser/11.1.4.301 Mobile Safari/537.36"
    119.135.63.2 - - [29/Aug/2021:04:59:35 +0800] "GET /admin HTTP/1.1" 301 162 "-" "Mozilla/5.0 (Linux; Android 10; GLK-AL00; HMSCore 6.0.1.305) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/88.0.4324.93 HuaweiBrowser/11.1.4.301 Mobile Safari/537.36"
    119.135.63.2 - - [29/Aug/2021:04:59:35 +0800] "GET /admin/ HTTP/1.1" 403 548 "-" "Mozilla/5.0 (Linux; Android 10; GLK-AL00; HMSCore 6.0.1.305) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/88.0.4324.93 HuaweiBrowser/11.1.4.301 Mobile Safari/537.36"
    119.135.63.2 - - [29/Aug/2021:04:59:41 +0800] "GET /admin.php HTTP/1.1" 404 548 "-" "Mozilla/5.0 (Linux; Android 10; GLK-AL00; HMSCore 6.0.1.305) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/88.0.4324.93 HuaweiBrowser/11.1.4.301 Mobile Safari/537.36"
    119.135.63.2 - - [29/Aug/2021:05:01:28 +0800] "POST /login HTTP/1.1" 200 48 "http://pay.此处打码.xyz/" "Mozilla/5.0 (Linux; Android 10; GLK-AL00; HMSCore 6.0.1.305) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/88.0.4324.93 HuaweiBrowser/11.1.4.301 Mobile Safari/537.36"
    119.135.63.2 - - [29/Aug/2021:05:01:29 +0800] "GET /aaa.html HTTP/1.1" 200 2063 "http://pay.此处打码.xyz/" "Mozilla/5.0 (Linux; Android 10; GLK-AL00; HMSCore 6.0.1.305) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/88.0.4324.93 HuaweiBrowser/11.1.4.301 Mobile Safari/537.36"
    119.135.63.2 - - [29/Aug/2021:05:01:30 +0800] "GET /layui/font/iconfont.woff?v=240 HTTP/1.1" 200 26744 "http://pay.此处打码.xyz/layui/css/layui.css" "Mozilla/5.0 (Linux; Android 10; GLK-AL00; HMSCore 6.0.1.305) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/88.0.4324.93 HuaweiBrowser/11.1.4.301 Mobile Safari/537.36"
    119.135.63.2 - - [29/Aug/2021:05:01:30 +0800] "GET /main.html HTTP/1.1" 200 1290 "http://pay.此处打码.xyz/aaa.html" "Mozilla/5.0 (Linux; Android 10; GLK-AL00; HMSCore 6.0.1.305) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/88.0.4324.93 HuaweiBrowser/11.1.4.301 Mobile Safari/537.36"
    119.135.63.2 - - [29/Aug/2021:05:01:30 +0800] "POST /getMenu HTTP/1.1" 200 722 "http://pay.此处打码.xyz/aaa.html" "Mozilla/5.0 (Linux; Android 10; GLK-AL00; HMSCore 6.0.1.305) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/88.0.4324.93 HuaweiBrowser/11.1.4.301 Mobile Safari/537.36"
    119.135.63.2 - - [29/Aug/2021:05:01:30 +0800] "POST /admin/index/getMain HTTP/1.1" 200 336 "http://pay.此处打码.xyz/aaa.html" "Mozilla/5.0 (Linux; Android 10; GLK-AL00; HMSCore 6.0.1.305) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/88.0.4324.93 HuaweiBrowser/11.1.4.301 Mobile Safari/537.36"
    119.135.63.2 - - [29/Aug/2021:05:01:32 +0800] "POST /admin/index/checkUpdate HTTP/1.1" 200 60 "http://pay.此处打码.xyz/aaa.html" "Mozilla/5.0 (Linux; Android 10; GLK-AL00; HMSCore 6.0.1.305) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/88.0.4324.93 HuaweiBrowser/11.1.4.301 Mobile Safari/537.36"
    119.135.63.2 - - [29/Aug/2021:05:01:37 +0800] "GET /admin/jk.html?t=1630184490 HTTP/1.1" 200 1219 "http://pay.此处打码.xyz/aaa.html" "Mozilla/5.0 (Linux; Android 10; GLK-AL00; HMSCore 6.0.1.305) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/88.0.4324.93 HuaweiBrowser/11.1.4.301 Mobile Safari/537.36"
    119.135.63.2 - - [29/Aug/2021:05:01:38 +0800] "POST /admin/index/getSettings HTTP/1.1" 200 443 "http://pay.此处打码.xyz/aaa.html" "Mozilla/5.0 (Linux; Android 10; GLK-AL00; HMSCore 6.0.1.305) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/88.0.4324.93 HuaweiBrowser/11.1.4.301 Mobile Safari/537.36"
    119.135.63.2 - - [29/Aug/2021:05:01:38 +0800] "GET /enQrcode?url=pay.此处打码.xyz/21d2e6e2d457c3ad149ce2c505ccc286 HTTP/1.1" 200 13377 "http://pay.此处打码.xyz/aaa.html" "Mozilla/5.0 (Linux; Android 10; GLK-AL00; HMSCore 6.0.1.305) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/88.0.4324.93 HuaweiBrowser/11.1.4.301 Mobile Safari/537.36"
    119.135.63.2 - - [29/Aug/2021:05:01:52 +0800] "GET /api.html?t=1630184490 HTTP/1.1" 200 4736 "http://pay.此处打码.xyz/aaa.html" "Mozilla/5.0 (Linux; Android 10; GLK-AL00; HMSCore 6.0.1.305) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/88.0.4324.93 HuaweiBrowser/11.1.4.301 Mobile Safari/537.36"
    119.135.63.2 - - [29/Aug/2021:05:02:01 +0800] "GET /admin/orderlist.html?t=1630184490 HTTP/1.1" 200 2442 "http://pay.此处打码.xyz/aaa.html" "Mozilla/5.0 (Linux; Android 10; GLK-AL00; HMSCore 6.0.1.305) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/88.0.4324.93 HuaweiBrowser/11.1.4.301 Mobile Safari/537.36"
    119.135.63.2 - - [29/Aug/2021:05:02:01 +0800] "GET /admin/index/getOrders?page=1&limit=10&state=&type= HTTP/1.1" 200 3554 "http://pay.此处打码.xyz/aaa.html" "Mozilla/5.0 (Linux; Android 10; GLK-AL00; HMSCore 6.0.1.305) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/88.0.4324.93 HuaweiBrowser/11.1.4.301 Mobile Safari/537.36"
    119.135.63.2 - - [29/Aug/2021:05:02:12 +0800] "GET /admin/setting.html?t=1630184490 HTTP/1.1" 200 2738 "http://pay.此处打码.xyz/aaa.html" "Mozilla/5.0 (Linux; Android 10; GLK-AL00; HMSCore 6.0.1.305) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/88.0.4324.93 HuaweiBrowser/11.1.4.301 Mobile Safari/537.36"
    119.135.63.2 - - [29/Aug/2021:05:02:13 +0800] "POST /admin/index/getSettings HTTP/1.1" 200 443 "http://pay.此处打码.xyz/aaa.html" "Mozilla/5.0 (Linux; Android 10; GLK-AL00; HMSCore 6.0.1.305) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/88.0.4324.93 HuaweiBrowser/11.1.4.301 Mobile Safari/537.36"
    119.135.63.2 - - [29/Aug/2021:05:02:13 +0800] "GET /enQrcode?url=wxp://f2f0fij2gwf1Mj6nUsCK8ZNaglcnJjRcGsxt HTTP/1.1" 200 13023 "http://pay.此处打码.xyz/aaa.html" "Mozilla/5.0 (Linux; Android 10; GLK-AL00; HMSCore 6.0.1.305) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/88.0.4324.93 HuaweiBrowser/11.1.4.301 Mobile Safari/537.36"
    119.135.63.2 - - [29/Aug/2021:05:02:13 +0800] "GET /enQrcode?url=https://qr.alipay.com/fkx18160aubbekhp8nh9m4f HTTP/1.1" 200 13529 "http://pay.此处打码.xyz/aaa.html" "Mozilla/5.0 (Linux; Android 10; GLK-AL00; HMSCore 6.0.1.305) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/88.0.4324.93 HuaweiBrowser/11.1.4.301 Mobile Safari/537.36"
    119.135.63.2 - - [29/Aug/2021:05:02:21 +0800] "GET /admin/addwxqrcode.html?t=1630184490 HTTP/1.1" 200 2012 "http://pay.此处打码.xyz/aaa.html" "Mozilla/5.0 (Linux; Android 10; GLK-AL00; HMSCore 6.0.1.305) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/88.0.4324.93 HuaweiBrowser/11.1.4.301 Mobile Safari/537.36"
    119.135.63.2 - - [29/Aug/2021:05:02:26 +0800] "GET /admin/wxqrcodelist.html?t=1630184490 HTTP/1.1" 200 1183 "http://pay.此处打码.xyz/aaa.html" "Mozilla/5.0 (Linux; Android 10; GLK-AL00; HMSCore 6.0.1.305) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/88.0.4324.93 HuaweiBrowser/11.1.4.301 Mobile Safari/537.36"
    119.135.63.2 - - [29/Aug/2021:05:02:27 +0800] "GET /admin/index/getPayQrcodes?page=1&limit=10&type=1 HTTP/1.1" 200 62 "http://pay.此处打码.xyz/aaa.html" "Mozilla/5.0 (Linux; Android 10; GLK-AL00; HMSCore 6.0.1.305) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/88.0.4324.93 HuaweiBrowser/11.1.4.301 Mobile Safari/537.36"

热议
2楼 optimism 3小时前

有漏洞

3楼 h20 3小时前

和打印自己的二维码贴到别人的上面有异曲同工之妙

4楼 马化滕 3小时前

用的什么发卡程序

5楼 超兽 3小时前

用的什么发卡程序

发卡是独角兽 但是支付是vmq的被改 发卡没动

6楼 烟花三月 3小时前

后台目录再设置个访问密码

7楼 SzeMeng76 3小时前

作者都好久没更新了 正常
时常扫下后台的码看有没被换呗
这种貌似sql注入，可能加个防火墙呗

8楼 Venkio 3小时前

https://gitee.com/muchos/VPay/ 试一下这个二开版的v免签 安全很多 修复了很多漏洞

9楼 朕的大清完了？ 3小时前

原版的java版屁事没有，3年了好好的

10楼 clcomeon 3小时前

1 v免签怎么搞 有搭建教程吗啊

申明：本文内容由网友收集分享，仅供学习参考使用。如文中内容侵犯到您的利益，请在文章下方留言，本站会第一时间进行处理。

退出移动版