WWW, unnamed BBS, a vulnerability (original)
Vulnerability discovery
We know that in telnet mode, we can set the picture signature file, set the format is: ![]()
picture URL This will after you set it, when you post an article, in WWW mode, the corresponding web page The following HTML code is automatically generated: 
This principle believes that everyone will understand, but if you carefully scrutinize and play it, you will be unexpected effect: Imagine if your picture signature file This setting: ![]()
> Any code So the corresponding HTML code in the page in your article in the WWW mode is: 
What will you realize now? That is, we can join any code in the unnamed BBS WWW mode (any code supported by the browser)!!! Let us give full play to our imagination to do what we want to play.
2. Use skills for vulnerabilities
Before we are ready to do it, you can do a simple test first: set the signature file to: ![]()
"> Alert () then go to TEST board. This way, you will see the pop-up Alert () window when you click on your article. But soon, you will find two flaws: 1) Image signature files due to IMG SRC = "", can not find the path, therefore appear with fork, which may be careful. 2) If you look at your article under Telnet, you will find that your signature file is a lot of code, which will cause administrators' suspicion. Therefore, we must try to solve these problems: For the first question, you can set the signature file to: ![]()
"style =" Display: none; "> Any code This picture is not Show out. For the second question, you can use the "obvision method", just set the signature file: a text signature file sufficiently long space ![]()
"style =" Display: none; "> Any code So all work is done very hidden, we can have a boldly play.
3. A terrible util of vulnerability - text with others ID, enter others mailbox
Some people may use the code to make some evil or join some vicious code to meet some kind of purpose, but after all, these will not bring very serious consequences, and do not play much of your imagination. In fact, a more terrible attempt is, can you use the code to get the user's information ?!! My idea is to get the user with code (as long as this ID browsing your article with that piece of code under WWW) ) Cookies on the machine, there is a user's related information, and then use the user's information to send a letter to me (preferably my vest) in the mailbox, the content is the cookie. User information.
With this idea, it is not so difficult ("I only can't think of, I can't do it", huh, I am the whole process of my "crime": First, make a JS file, for the sake of concealment, will file Extended .jpg, such as AAA.jpg, as follows: Document.write ('
