本帖最后由 40huo 于 2018-7-3 10:11 编辑
老外的链接
http://seclists.org/fulldisclosure/2018/Jul/3
国外哥们测试了vivo和momo
In order to prove this, I got 2 chinese famous company:
a、momo: Well-known chat tools like WeChat
b、vivo :China's famous mobile phone,that also famous in my country
- Example momo :
- attack:
- notify url: https://pay.immomo.com/weixin/notify
- cmd: /home/
- result:
- ***
- logs
- zhang.jiax**
- zhang.shaol**
- zhang.xia**
- ****
- attack:
- notify url: https://pay.immomo.com/weixin/notify
- cmd: /home/logs
- result:
- ***
- moa-service
- momotrace
- ****
- Example vivo :
- attack:
- notify url: https://pay.vivo.com.cn/webpay/wechat/callback.oo
- cmd: /home/
- result:
- tomcat
- attack:
- notify url: https://pay.vivo.com.cn/webpay/wechat/callback.oo
- cmd: /home/tomcat
- result:
- .bash_logout
- .bash_profile
- .bashrc
- logs
- attack:
- notify url: https://pay.vivo.com.cn/webpay/wechat/callback.oo
- cmd: /home/tomcat/logs
- result:
- ****
- tomcat-2018-06-28.log
- tomcat-2018-06-29.log
- tomcat-2018-06-30.log
- *****
复制代码
赶紧先下线了吧。。。
看大家好像没看明白,这是读服务器的文件,接了微信支付接口的,不是微信APP的问题。 |