diff --git a/data.json b/data.json index 6debf66b..736984c4 100644 --- a/data.json +++ b/data.json @@ -15478,5 +15478,6 @@ "https://mp.weixin.qq.com/s?__biz=MzkzMTcwMTg1Mg==&mid=2247491896&idx=1&sn=c52b969d0b012a6773d7ef3681533d09": "畅捷通T+ Load SQL注入漏洞", "https://mp.weixin.qq.com/s?__biz=MzkzMTcwMTg1Mg==&mid=2247491904&idx=1&sn=18ff4be2062e7c1b0a44bbe77e253c32": "畅捷通T+ GLSyncService.asmx SQL注入漏洞", "https://mp.weixin.qq.com/s?__biz=MzAxMjE3ODU3MQ==&mid=2650611137&idx=4&sn=c96596b23eeaad179dcc02c1869813a2": "一款专为安全研究人员和白帽子设计的漏洞赏金工具", - "https://mp.weixin.qq.com/s?__biz=MzA4NTY4MjAyMQ==&mid=2447900798&idx=1&sn=f544a5fc8f6bc1f5eccb9d9001634c4f": "从LNK到Chrome零日漏洞，揭秘高级间谍组织TaxOff的狩猎进化史" + "https://mp.weixin.qq.com/s?__biz=MzA4NTY4MjAyMQ==&mid=2447900798&idx=1&sn=f544a5fc8f6bc1f5eccb9d9001634c4f": "从LNK到Chrome零日漏洞，揭秘高级间谍组织TaxOff的狩猎进化史", + "https://mp.weixin.qq.com/s?__biz=MzkxMjg3NzU0Mg==&mid=2247485825&idx=1&sn=63bc1d9d12159ac55bcba9ff7c7f35f2": "某证书站邮箱轰炸漏洞" } \ No newline at end of file diff --git a/doc/2025-06/某证书站邮箱轰炸漏洞.md b/doc/2025-06/某证书站邮箱轰炸漏洞.md new file mode 100644 index 00000000..1f349fac --- /dev/null +++ b/doc/2025-06/某证书站邮箱轰炸漏洞.md @@ -0,0 +1,66 @@ +# 某证书站邮箱轰炸漏洞 +原创 锐鉴安全 锐鉴安全 2025-06-22 14:41 + +声明：请勿利用文章内的相关技术从事非法测试，由于传播、利用此文所提供的信息而造成的任何直接或者间接的后果及损失，均由使用者本人负责，作者不为此承担任何责任。 + +关注公众号，设置为星标！ + +![](https://mmbiz.qpic.cn/mmbiz_png/RLTNmn7FBP4ricRiaXQ6WVVlTAgCW8HUbC2rHkicA2rpDNEPAGyiatRibqB9LN5NyHcqLCmbibM1siaumqF5Yu6UtSsYA/640?wx_fmt=png "") + + +在某证书站的统一支付系统，通过“免费注册”，注册一个账号。注册过程要求输入邮箱。 + +![](https://mmbiz.qpic.cn/mmbiz_png/RLTNmn7FBP6jrU18NtPWlqsC2slJIJR5UhTcsMzIrLmEdzuY4gcFEr1bnvbwHtsVa25cEF1PJLLFbn1HZR2IMA/640?wx_fmt=png&from=appmsg "") + + +使用注册的账号，测试密码重置功能。点击确认发送，重置密码数据包。 + +![](https://mmbiz.qpic.cn/mmbiz_png/RLTNmn7FBP6jrU18NtPWlqsC2slJIJR5ibY6FSYHYE3sA0cSDcAa5QxRoWzewxlI00A8SzygOO18b2VaOsRslvQ/640?wx_fmt=png&from=appmsg "") + + +通过利用burp或者其它抓包截断工具，抓取发送邮件的数据包，并且进行重放攻击。 + +![](https://mmbiz.qpic.cn/mmbiz_png/RLTNmn7FBP6jrU18NtPWlqsC2slJIJR5icGuCIqxmndp2RSWLV1K9cLpibLtchxWYgvGwNTcSzQgQiaRl1XJ19b3A/640?wx_fmt=png&from=appmsg "") + + +重放多次后，邮箱收到大量的密码重置链接。 + + +![](https://mmbiz.qpic.cn/mmbiz_png/RLTNmn7FBP6jrU18NtPWlqsC2slJIJR5p1SialGIicnGcicglQQXm4QPAZoeEsBEns4f8NNJIePqTT7gCdBQdq1Cg/640?wx_fmt=png&from=appmsg "") + + +往期好文推荐 + +[通过隐藏接口发现ruoyi和druid漏洞](https://mp.weixin.qq.com/s?__biz=MzkxMjg3NzU0Mg==&mid=2247485719&idx=1&sn=80c65694743eb5e5397583d0620d9b99&scene=21#wechat_redirect) + + +[【渗透测试】UEditor漏洞挖掘实战](https://mp.weixin.qq.com/s?__biz=MzkxMjg3NzU0Mg==&mid=2247483787&idx=1&sn=7fe88690fa76a2717670672ac500b3ee&scene=21#wechat_redirect) + + +[【漏洞挖掘】Minio对象存储漏洞挖掘](https://mp.weixin.qq.com/s?__biz=MzkxMjg3NzU0Mg==&mid=2247483930&idx=1&sn=2689a7fea3787e5d6637c50254aebad6&scene=21#wechat_redirect) + + +[SRC挖洞必备技巧及案例分享](https://mp.weixin.qq.com/s?__biz=MzkxMjg3NzU0Mg==&mid=2247485449&idx=1&sn=c3745d89c364e18d82b09c349fd09541&scene=21#wechat_redirect) + + +[挖洞赚钱必备清单，推荐收藏](https://mp.weixin.qq.com/s?__biz=MzkxMjg3NzU0Mg==&mid=2247485452&idx=1&sn=67aa5d74b0c6944e5e802e11b2c6d925&scene=21#wechat_redirect) + + +[拿来即用SQL注入POC，亲测好用](https://mp.weixin.qq.com/s?__biz=MzkxMjg3NzU0Mg==&mid=2247485347&idx=1&sn=295383c5facaf1c481ac363d502b770e&scene=21#wechat_redirect) + + +[好文推荐！针对SSO认证绕过技巧！](https://mp.weixin.qq.com/s?__biz=MzkxMjg3NzU0Mg==&mid=2247485275&idx=1&sn=f210d8e8027507feaf2d735e16a864af&scene=21#wechat_redirect) + + +[【漏洞挖掘】swagger未授权漏洞利用](https://mp.weixin.qq.com/s?__biz=MzkxMjg3NzU0Mg==&mid=2247484484&idx=1&sn=dcde56e7fceac94cffbec52f7ef09005&scene=21#wechat_redirect) + + +[文件预览组件kkfileview被玩坏了，没想到这么多漏洞](https://mp.weixin.qq.com/s?__biz=MzkxMjg3NzU0Mg==&mid=2247484074&idx=1&sn=d4e633e1d08544954150f90362f211d5&scene=21#wechat_redirect) + + +[【渗透测试】针对混淆JS代码的动态调试技巧](https://mp.weixin.qq.com/s?__biz=MzkxMjg3NzU0Mg==&mid=2247483935&idx=1&sn=6076e8a54ccc9169777087517df1f943&scene=21#wechat_redirect) + + +[【漏洞挖掘】APP渗透测试必备](https://mp.weixin.qq.com/s?__biz=MzkxMjg3NzU0Mg==&mid=2247484263&idx=1&sn=b13b066eca0cb0eeecbd04af903b062d&scene=21#wechat_redirect) + +