挖洞经验 | 看我如何发现雅虎邮箱APP的存储型XSS漏洞

PGRpdiBjbGFzcz0idGl0bGUgY2xlYXJmaXgiPjxici8+PC9kaXY+PGRpdiBpZD0iY29udGVudHR4dCI+PHA+PGEgaHJlZj0iaHR0cDovL2ltYWdlLjMwMDEubmV0L2ltYWdlcy8yMDE4MDkxMS8xNTM2NjQ4NTEzXzViOTc2NTQxYjgzMWEuanBnIiBjbGFzcz0iaGlnaHNsaWRlLWltYWdlIiB0YXJnZXQ9Il9ibGFuayI+PGltZyBhbHQ9Iueci+aIkeWmguS9leWPkeeOsOmbheiZjumCrueusUFQUOeahOWtmOWCqOWei1hTU+a8j+a0niIgc3JjPSJodHRwOi8vaW1hZ2UuMzAwMS5uZXQvaW1hZ2VzLzIwMTgwOTExLzE1MzY2NDg1MTNfNWI5NzY1NDFiODMxYS5qcGchc21hbGwiIHN0eWxlPSJkaXNwbGF5OiBibG9jazsiIHdpZHRoPSI2OTAiLz48L2E+PHN0cm9uZyBzdHlsZT0iY29sb3I6IHJnYigwLCAxNzYsIDgwKTsiPuS7iuWkqeaIkeimgeWIhuS6q+eahOaYr+WPguS4jumbheiZju+8iFlhaG9vIe+8iea8j+a0nuS8l+a1i+mhueebruWPkeeOsOeahOS4gOS4quWFs+S6jumbheiZjumCrueusSBpT1PlupTnlKjnmoTmvI/mtJ7vvIzmnIDnu4jvvIzlh63lgJ/or6XmvI/mtJ7vvIzmiJHov5vlhaXkuobpm4XomY7lronlhajlkI3kurrloILlubbojrflvpfkuoYkMzUwMOe+jumHkeWlluWKseOAgjwvc3Ryb25nPjwvcD48aDI+5ryP5rSe5oOF5Ya1PC9oMj48cD7miJHmtYvor5XnmoTlr7nosaHmmK8gWWFob28hIE1haWwgaU9TIApBUFDlupTnlKjvvIzkuZ/lsLHmmK/pm4XomY7pgq7nrrHnmoRpT1PniYjmnKzvvIzlnKjor6VBUFDlupTnlKjnqIvluo/nmoR4bWzmlofku7bkuK3lrZjlnKjkuIDkuKrlrZjlgqjlnotYU1PmvI/mtJ7jgILmlLvlh7vogIXlj6/ku6XliKnnlKhYTUznibnmgKfmnoTpgKDku7vmhI9IVE1ML0phdmFzY3JpcHTku6PnoIHltYzlhaXpgq7ku7bvvIzlnKjor6VBUFDnlKjmiLfmiZPlvIDpgq7ku7bml7bvvIzpg73lj6/ku6Xlrp7njrDov5nnp43ku7vmhI/ku6PnoIHmuLLmn5PlkYjnjrDvvIzmnoHnq6/ngrnmnaXor7TvvIzliKnnlKhYTUznmoTlrp7kvZPmianlsZXmlLvlh7vvvIzlj6/ku6XlvaLmiJBEb1PmlLvlh7vvvIzpgKDmiJBBUFDmnI3liqHltKnmuoPjgII8L3A+PHA+WE1M5a6e5L2T5omp5bGV5pS75Ye777yaWE1MIEVudGl0eSAKRXhwYW5zaW9u5a6e546w77yM6YCa6L+H5ZyoWE1M55qERE9DVFlQReS4reWIm+W7uuiHquWumuS5ieWunuS9k+eahOWumuS5ieWunueOsO+8jOavlOWmgu+8jOi/meenjeWumuS5ieWPr+S7peWcqOWGheWtmOS4reeUn+aIkOS4gOS4quavlFhNTOeahOWOn+Wni+WFgeiuuOWkp+Wwj+Wkp+WHuuW+iOWkmueahFhNTOe7k+aehO+8jOeUqOWug+adpeS9v+i/meenjeaUu+WHu+W+l+S7peiAl+Wwvee9kee7nOacjeWKoeWZqOato+W4uOacieaViOi/kOihjOeahOW/hemcgOWGheWtmOi1hOa6kOOAgjwvcD48aDI+5ryP5rSe5YiG5p6QPC9oMj48aDM+5ryP5rSe5Yid5oqlPC9oMz48cD7lnKjku7vmhI/nmoTpm4XomY7pgq7nrrHnmbvlvZXnvZHpobXmiJblrqLmiLfnq6/kuK3nmbvlvZXov5vlhaXkvaDnmoTpm4XomY7pgq7nrrHvvIznhLblkI7kuIrkvKDku6XkuIvmoLflvI/nmoTkuIDkuKp4bWzmlofku7bkvZzkuLrpgq7ku7bpmYTku7bvvIzkuYvlkI7vvIzmiorov5nlsIHluKbku6XkuIsgeWFob28teHNzLnhtbCDpmYTku7bnmoTpgq7ku7bvvIzlj5HpgIHliLDkvaDoh6rlt7HnmoTpm4XomY7pgq7nrrHmiJblj6bkuIDpm4XomY7mtYvor5Xpgq7nrrHkuK3ljrvjgII8L3A+PHByZT48P3htbCZuYnNwO3ZlcnNpb2494oCdMS4w4oCzJm5ic3A7ZW5jb2Rpbmc94oCddXRmLTjigLM/Pgo8c3ZnJm5ic3A7eG1sbnM94oCdaHR0cDovL3d3dy53My5vcmcvMjAwMC9zdmfigJ0+CjxzY3JpcHQ+cHJvbXB0KGRvY3VtZW50LmxvY2F0aW9uKTwvc2NyaXB0Pgo8L3N2Zz48L3ByZT48cD7nlKjpm4XomY7pgq7nrrFpT1PlrqLmiLfnq6/vvIhZYWhvbyEgTWFpbCBpT1MgQVBQ77yJ77yM6L+b5YWl5L2g55qE5pS25Lu25rWL6K+V6ZuF6JmO6YKu566x77yM5p+l55yLIHlhaG9vLXhzcy54bWwg6ZmE5Lu277yM5omT5byA5a6D77yM55yL55yL5piv5ZCm5pyJWFNT5Y+N5bqU44CC57uT5p6c5piv5b2T54S25pyJ55qE77yM5Lya5ZCT5LqG5L2g5LiA6Lez44CC5aaC5LiL77yaPC9wPjxwPjxhIGhyZWY9Imh0dHA6Ly9pbWFnZS4zMDAxLm5ldC9pbWFnZXMvMjAxODA5MTEvMTUzNjY0NzY5OF81Yjk3NjIxMjUxYmUwLnBuZyIgY2xhc3M9ImhpZ2hzbGlkZS1pbWFnZSIgdGFyZ2V0PSJfYmxhbmsiPjxpbWcgYWx0PSLnnIvmiJHlpoLkvZXlj5HnjrDpm4XomY7pgq7nrrFBUFDnmoTlrZjlgqjlnotYU1PmvI/mtJ4iIHNyYz0iaHR0cDovL2ltYWdlLjMwMDEubmV0L2ltYWdlcy8yMDE4MDkxMS8xNTM2NjQ3Njk4XzViOTc2MjEyNTFiZTAucG5nIXNtYWxsIiBzdHlsZT0iZGlzcGxheTogYmxvY2s7IiB3aWR0aD0iNjkwIi8+PC9hPuazqOaEj++8muaIkeS5n+aQnuS4jeaHguWVpeWOn+WboO+8jOmbheiZjumCrueusWlPU+W6lOeUqOS4reeahFhNTOa4suafk+acuuWItumdnuW4uOaAquW8guWNsemZqeOAguWmguaenOS9oOaUtuWIsOWMheWQq+S7peS4inlhaG9vLXhzcy54bWwg6ZmE5Lu255qE5aSa5Liq6ZmE5Lu277yM6YKj5LmI77yM5Y2z5L2/5L2g5omT5byA5YW25a6D6ZmE5Lu255qE5pe25YCZ77yM6L+Z5LiqIHlhaG9vLXhzcy54bWwg6Kem5Y+R55qE5a2Y5YKo5Z6LWFNT6YO95Lya6Kej5p6Q6Lez5Ye644CCPC9wPjxwPuaIkeWMhuWMhuW/meW/meWcsOS4iuaKpeS6hui/meS4qua8j+a0nu+8jOS7peS4i+aYr+mbheiZjuWuieWFqOWboumYn+S6uuWRmOWcqEhhY2tlck9uZeS4iue7meaIkeeahOWbnuW6lO+8mjwvcD48cD48YSBocmVmPSJodHRwOi8vaW1hZ2UuMzAwMS5uZXQvaW1hZ2VzLzIwMTgwOTExLzE1MzY2NDc3MzlfNWI5NzYyM2JlMmZlYi5wbmciIGNsYXNzPSJoaWdoc2xpZGUtaW1hZ2UiIHRhcmdldD0iX2JsYW5rIj48aW1nIGFsdD0i55yL5oiR5aaC5L2V5Y+R546w6ZuF6JmO6YKu566xQVBQ55qE5a2Y5YKo5Z6LWFNT5ryP5rSeIiBzcmM9Imh0dHA6Ly9pbWFnZS4zMDAxLm5ldC9pbWFnZXMvMjAxODA5MTEvMTUzNjY0NzczOV81Yjk3NjIzYmUyZmViLnBuZyFzbWFsbCIgc3R5bGU9ImRpc3BsYXk6IGJsb2NrOyIgd2lkdGg9IjY5MCIvPjwvYT7liLDkuobov5nmraXvvIzmjqXkuIvmnaXmiJHopoHlgZrnmoTlsLHmmK/mg7Plip7ms5XmnaXmnIDlpKfljJbliKnnlKjov5nkuKrmvI/mtJ7vvIznnIvnnIvog73lr7npm4XomY7pgq7nrrFpT1PlupTnlKjlvaLmiJDku4DkuYjmr5TovoPlnY/nmoTlronlhajlqIHog4HlkozlvbHlk43jgILkvYbml6DlpYjmiJHkuIDml7bljYrkvJrkuZ/msqHku4DkuYjlpLTnu6rvvIzlj6rlpb3lhYjmlL7kuIDmlL7jgII8L3A+PGgzPua8j+a0nue7reaKpTwvaDM+PHA+5ZCO5p2l5pyJ5LiA5aSp77yM5oiR56qB54S25oOz5Yiw5LqG5LiA56eN5o+Q5Y2H5ryP5rSe5Yip55So5LiU5a6J5YWo5peg5a6z55qE5pa55rOV77yM6YKj5bCx5piv5oiR5Y+v5Lul55SoSFRUUOivt+axgu+8jOWDj+KAnEdFVOKAneaWueW8j+S4gOagt++8jOWwneivleWvueacrOWcsEFQUOWuouaIt+err+i1hOa6kOi/m+ihjOiOt+WPlu+8gUJpbmdHb++8geaIkeS4gOivle+8jOecn+aIkOS6hu+8geaIkeWPr+S7peeUqOi/meenjeaWueazleiOt+WPluWIsOmbheiZjumCrueusWlPU+W6lOeUqOeahOaVtOS4que8k+WtmOaVsOaNru+8jOWFtuS4reWMheaLrOeUqOaIt2Nvb2tpZeOAgemAmuiur+W9leWIl+ihqOOAgemCruS7tuWGheWuueetieetieOAgjwvcD48aDI+5ryP5rSe5Yip55So5aSN546wPC9oMj48cD7pppblhYjvvIzlnKjku7vmhI/pm4XomY7pgq7nrrHnvZHpobXmiJblrqLmiLfnq6/kuK3nmbvlvZXkvaDnmoTpm4XomY7pgq7nrrHotKbmiLfvvIzkuIrkvKDkuIDkuKrlpoLkuIvljIXlkKvlpoLkuIvku6PnoIHnmoRYTUzmlofku7bvvIznhLblkI7vvIzmiorlroPkvZzkuLrpmYTku7blj5HpgIHliLDkvaDnmoTlj6blpJbkuIDkuKrmtYvor5Xpm4XomY7pgq7nrrHkuK3vvIjlj5flrrPogIXpgq7nrrHvvInjgII8L3A+PHA+PGEgaHJlZj0iaHR0cDovL2ltYWdlLjMwMDEubmV0L2ltYWdlcy8yMDE4MDkxMS8xNTM2NjQ3ODA2XzViOTc2MjdlOWU5ODgucG5nIiBjbGFzcz0iaGlnaHNsaWRlLWltYWdlIiB0YXJnZXQ9Il9ibGFuayI+PGltZyBhbHQ9Iueci+aIkeWmguS9leWPkeeOsOmbheiZjumCrueusUFQUOeahOWtmOWCqOWei1hTU+a8j+a0niIgc3JjPSJodHRwOi8vaW1hZ2UuMzAwMS5uZXQvaW1hZ2VzLzIwMTgwOTExLzE1MzY2NDc4MDZfNWI5NzYyN2U5ZTk4OC5wbmchc21hbGwiIHN0eWxlPSJkaXNwbGF5OiBibG9jazsiIHdpZHRoPSI2OTAiLz48L2E+5Zyo5L2g55qE6ZuF6JmO5rWL6K+V6YKu566x5Lit5omT5byA6L+Z5Liq5pS25Yiw55qEWE1M6ZmE5Lu277yM5Z+65LqO5LiK6Z2i5oiR5o+Q5Yiw55qE6YKj5Liq4oCc5oCq5byC4oCd55qEWE1M6Kej5p6Q5Y6f5Zug77yM6L+Z6YeM5Y+v5Lul5oOz5YOP5LiA56eN5oOF5Ya177ya5b2T5pS75Ye76ICF5ZCR5L2g5Y+R6YCB5LqG5LiA5LiqUFBU5paH5qGj77yM5L2G5Zyo6ZmE5Lu25Lit5Lmf6ZmE5Yqg5LqG5Lul5LiK6YKj5Liq5Y+v5Lul6Kem5Y+RWFNT55qEWE1M5paH5Lu277yM6YKj5LmI77yM5b2T5L2g5omT5byA5pS25Yiw55qEUFBU5paH5qGj5pe277yM6L+Z5LiqWE1M5paH5Lu25Lmf5bCx5Lya5ZCM5pe26Kem5Y+RWFNT5Y+N5bqU44CC5Lmf5bCx5piv6K+077yM5peg6K665L2g5pyJ5aSa5bCR5Liq6ZmE5Lu277yI5YyF5ous6KeG6aKR6ZmE5Lu277yJ77yM5Y+q6KaB5YyF5ZCr5Lul5LiK6YKj5LiqWE1M6ZmE5Lu277yM5L2g5omT5byA5YW25a6D5Lu75L2V5LiA5Liq6ZmE5Lu277yM6YO95Lya5aWH5oCq5Zyw6Kem5Y+RWE1M5paH5Lu25LitWFNT5ryP5rSe44CCPC9wPjxwPuWIqeeUqOivpea8j+a0nu+8jOaehOmAoGtleS54bWzvvIzmiJHlj6/ku6Xojrflj5blj5flrrPogIXpgq7nrrHkuK3ljIXmi6zlj5HpgIHogIXjgIHmjqXmlLbogIXlkozogZTns7vkurrlnKjlhoXnmoTpgJrorq/lvZXkv6Hmga/jgILlnKhYTUzpmYTku7bku6PnoIHkuK3vvIxYU1PmvI/mtJ7kvJrpppblhYjmmL7npLrlrqLmiLfnq6/nmoTmtY/op4jlmajniYjmnKzkv6Hmga/vvIznhLblkI7mmK/lrprkvY3mlofku7bkvY3nva7vvIzlho3kuYvlkI7mmK/ojrflj5bpgq7ku7bliJfooajkv6Hmga/vvIjov5nph4znnIvnvZHpgJ/vvIzkvLDorqHpnIDopoEzMOenkuW3puWPs+eahOaXtumXtO+8ieOAguS5i+WQju+8jOeCueWHu2tleS54bWznmoRPS+S5i+WQju+8jOmCruS7tuWIl+ihqOS/oeaBr+WwsemAmui/h0dFVOaWueW8j+WbnuS8oOe7meaUu+WHu+iAheS6hu+8jOWDj+S4i+Wbvui/meagt+OAguaIkeaYr+WcqOWGhemDqOWxgOWfn+e9keS4reWBmueahOa1i+ivle+8jOaIkeeahFNlcnZlcuaOpeaUtuerr+eUqG5jCiAtbHZ2diA4MDkw5byA5ZCv5LqGODA5MOerr+WPo+ebkeWQrO+8mjwvcD48cD48YSBocmVmPSJodHRwOi8vaW1hZ2UuMzAwMS5uZXQvaW1hZ2VzLzIwMTgwOTExLzE1MzY2NDc4MzVfNWI5NzYyOWI2OGZlOS5wbmciIGNsYXNzPSJoaWdoc2xpZGUtaW1hZ2UiIHRhcmdldD0iX2JsYW5rIj48aW1nIGFsdD0i55yL5oiR5aaC5L2V5Y+R546w6ZuF6JmO6YKu566xQVBQ55qE5a2Y5YKo5Z6LWFNT5ryP5rSeIiBzcmM9Imh0dHA6Ly9pbWFnZS4zMDAxLm5ldC9pbWFnZXMvMjAxODA5MTEvMTUzNjY0NzgzNV81Yjk3NjI5YjY4ZmU5LnBuZyFzbWFsbCIgc3R5bGU9ImRpc3BsYXk6IGJsb2NrOyIgd2lkdGg9IjY5MCIvPjwvYT7liKnnlKjor6XmvI/mtJ7vvIzmnoTpgKBjYWNoZWRicG9zdC54bWzvvIzmiJHlj6/ku6Xojrflj5blj5flrrPogIXnmoRDb29raWXkv6Hmga/jgILngrnlh7tjYWNoZWRicG9zdC54bWznmoRPS+S5i+WQju+8jOaVtOS4qkNhY2hlLmRi5paH5Lu25bCx5Lya6YCa6L+HUE9TVOaWueW8j+WbnuS8oOe7meaUu+WHu+iAhe+8jOWmguS4i+WbvuaJgOekuuOAguaIkeWcqOWGhemDqOWxgOWfn+e9keS4reWBmueahOa1i+ivle+8jOaIkeeahFNlcnZlcuaOpeaUtuerr+eUqG5uYwogLWx2dnYgODA5MCA+IHlhaG9vLmRi5ZG95Luk5byA5ZCv5LqGODA5MOerr+WPo+ebkeWQrO+8jOW5tuaKikNhY2hlLmRiZOWtmOWCqOS4unlhaG9vLmRi77yaPC9wPjxwPjxhIGhyZWY9Imh0dHA6Ly9pbWFnZS4zMDAxLm5ldC9pbWFnZXMvMjAxODA5MTEvMTUzNjY0Nzg1Nl81Yjk3NjJiMDhlNTlmLnBuZyIgY2xhc3M9ImhpZ2hzbGlkZS1pbWFnZSIgdGFyZ2V0PSJfYmxhbmsiPjxpbWcgYWx0PSLnnIvmiJHlpoLkvZXlj5HnjrDpm4XomY7pgq7nrrFBUFDnmoTlrZjlgqjlnotYU1PmvI/mtJ4iIHNyYz0iaHR0cDovL2ltYWdlLjMwMDEubmV0L2ltYWdlcy8yMDE4MDkxMS8xNTM2NjQ3ODU2XzViOTc2MmIwOGU1OWYucG5nIXNtYWxsIiBzdHlsZT0iZGlzcGxheTogYmxvY2s7IiB3aWR0aD0iNjkwIi8+PC9hPuaUtuWIsOWujOaVtOeahENhY2hlLmRi5paH5Lu25LmL5ZCO77yM5oiR5Lus5oqK5YW25Lit55qE5qCH6aKY5aS05YaF5a656L+H5ruk77yM55So5Lul5LiL5ZG95Luk5qOA57Si5b2i5oiQ5a6M5pW055qE5Y+X5a6z6ICFY29va2ll5L+h5oGv77yaPC9wPjxwPnN0cmluZ3MgeWFob28uZGIgfCBncmVwIC1pIENvb2tpZSAtQSAxMCAtQiA1PC9wPjxwPuWPpuWklu+8jOi/mOWPr+S7peaMiWh0dHDmnI3liqHnq6/mnaXov5vooYzmnprkuL7vvIzlvaLmiJDlr7nnibnlrprnvZHnq5nnmoTor7fmsYJjb29raWXvvJo8L3A+PHA+c3RyaW5ncyB5YWhvby5kYiB8IGdyZXAgLWkgaHR0cHM8L3A+PHA+6ZuF6JmO5a6J5YWo5Zui6Zif5bel5L2c5Lq65ZGY5o6l5pS25Yiw6K+l5ryP5rSe5ZCO77yM6L+F6YCf6L+b6KGM5LqG5YiG57G744CB5L+u5aSN5ZKM5aSE572u44CCPC9wPjxoMj48aW1nIGFsdD0i55yL5oiR5aaC5L2V5Y+R546w6ZuF6JmO6YKu566xQVBQ55qE5a2Y5YKo5Z6LWFNT5ryP5rSeIiBzcmM9Imh0dHA6Ly9pbWFnZS4zMDAxLm5ldC9pbWFnZXMvMjAxODA5MTEvMTUzNjY0NzkwNl81Yjk3NjJlMjFjYTliLnBuZyFzbWFsbCIgd2lkdGg9IjY5MCIvPjxpbWcgYWx0PSLnnIvmiJHlpoLkvZXlj5HnjrDpm4XomY7pgq7nrrFBUFDnmoTlrZjlgqjlnotYU1PmvI/mtJ4iIHNyYz0iaHR0cDovL2ltYWdlLjMwMDEubmV0L2ltYWdlcy8yMDE4MDkxMS8xNTM2NjQ3OTEzXzViOTc2MmU5Yzk5YTUucG5nIXNtYWxsIiBzdHlsZT0iZGlzcGxheTogYmxvY2s7IiB3aWR0aD0iNjkwIi8+5ryP5rSe5b2x5ZONPC9oMj48cD7ku7vkvZXmlLvlh7vogIXlj6/ku6XliKnnlKjor6XmvI/mtJ7vvIzmnoTpgKDnibnlrprnmoRYTUzmlofku7blj5HpgIHnu5nku7vkvZXnlKjmiLfvvIzov5vogIzojrflj5bliLDlj5flrrPogIXnlKjmiLfpgq7nrrHkuK3ljIXmi6zlj5HpgIHogIXjgIHmjqXmlLbogIXjgIFDb29raWXlkozogZTns7vkurrlnKjlhoXnmoTmlY/mhJ/kv6Hmga/jgII8L3A+PHA+5oiR55qE5rWL6K+V546v5aKD77yaPC9wPjxwPmlQaG9uZSA2IOKAkyBpT1MgdjExLjIuNS48L3A+PHA+5Y+X5b2x5ZONaU9T5a6i5oi356uv54mI5pysOjwvcD48cD5ZYWhvbyEgTWFpbCBhcHAgdjQuWFguWCAoWFhYWFgpPC9wPjxwPjxici8+PC9wPjxwPjxzdHJvbmcgc3R5bGU9ImNvbG9yOiByZ2IoMTU5LCAxNjMsIDE2OCk7Ij4q5Y+C6ICD5p2l5rqQ77yab21lc3Bpbm/vvIxjbG91ZHPnvJbor5HvvIzovazovb3mnaXoh6pGcmVlQnVmLkNPTSZuYnNwOzwvc3Ryb25nPjwvcD48L2Rpdj48cD48YnIvPjwvcD4=