Chapter 6 Massive Vulnerabilities

The vulnerability scanning tool is written.

Li Yi began to test.

Log in to the Hackerone platform, register an account, log in to the platform, enter the vulnerability public testing project initiated by a company, and obtain the IP address of the relevant server. Next, Li Yi starts his self-made vulnerability scanning tool with one click.

The next second, the green code waterfall frantically emerged, the vulnerability scanning tool ran smoothly, and each sub-module started to work to analyze the vulnerability of the service site.

...

Fenggu Technology, a listed software company headquartered in Magic City, aims to promote the deep integration of informatization and industrialization, and improve the level of urban intelligence. Its business covers steel, transportation, medicine, chemical industry, finance, and other industries, and it is deeply involved in software. In the field, he has the ultimate pursuit of software security and system security.

Zhang Peiyong, head of Fenggu Science and Technology Department, just like in the past, turned on the computer as soon as possible after going to work, checked his mailbox, reviewed the work progress of his subordinates, and planned the next step.

Suddenly, there was a knock on the door, interrupting Zhang Peiyong's thoughts.

"Come in!" Zhang Peiyong raised his eyes and looked out the door.

"Brother Yong, it's not good. The Rongcheng Smart Cloud project found a lot of bugs. After fixing these bugs, the workload is almost equivalent to knocking down and redoing." A young man with sparse hair - Zhao Xiaohui, pushed in the door and reported with a sad face.

"Rongcheng Wisdom Cloud? Which project to put on the platform for public testing?" Zhang Peiyong looked at Zhao Xiaohui calmly and asked.

"Yes! A lot of loopholes have been dug up by a master." Zhao Xiaohui confirmed with a bitter face.

Zhang Peiyong quickly opened the platform and logged in to enter the background.

The next moment, the website background displays a piece of vulnerability data, RCE vulnerability, SQL injection vulnerability, account hijacking vulnerability, CORS, CSRF, source code leak, rate limit, ..., etc., a total of 227 vulnerabilities.

Zhang Peiyong saw his scalp go numb.

There are so many?

real or fake!

Zhang Peiyong was full of disbelief, and clicked on the data of an RCE vulnerability.

This vulnerability targets a subdomain target, and its .git directory was discovered when using Dirb to explode the directory. When using in-depth detection, the POST parameters of the call were not filtered and audited, and it was associated with a remote code execution vulnerability.

Zhang Peiyong's expression tightened, and according to the above vulnerability description, he immediately started the test.

Zhang Peiyong put his hands on the keyboard, and after a burst of operations, soon, according to the description of the vulnerability, he directly cut into the vulnerability of the Rongcheng Smart Cloud project.

Oh shit!

There really is this loophole.

Zhang Peiyong panicked and continued to test the next loophole in disbelief.

Soon, Zhang Peiyong demonstrated according to the description of the vulnerability discoverer, and successfully obtained all the source code of the application service on the site. This vulnerability is much more serious than the previous RCE vulnerability.

A drop of cold sweat fell on Zhang Peiyong's forehead.

If this vulnerability is not discovered, once the project goes online and is exploited, it will seriously threaten the customer's data security.

Zhang Peiyong took a deep breath and continued to look at the next loophole.

This is an account hijacking vulnerability. By replacing the email address with the email address of another user, the password contained in the request packet can be used to replace and change the account password of others. The whole process does not require any verification mechanism.

Zhang Peiyong tested five or six loopholes in a row, and each loophole was real.

very good!

Zhang Peiyong was both angry and happy, and his mood was very complicated.

The reason for his anger, his own technical team wrote a buggy gadget full of loopholes, which is simply a pile of rubbish.

The reason for my happiness is that these problems have been found out and avoided to be handed over to the customers, resulting in huge hidden dangers.

"Brother Yong,

What to do next? "Looking at Zhang Peiyong's angry face, Zhao Xiaohui asked nervously.

"What to do? What to do! Everyone helped us find the loopholes, why don't you just leave it alone? Tell everyone to gather in the conference room!" Zhang Pei shouted in a panic.

"Okay!" Zhao Xiaohui bowed in response and left the office as if fleeing.

Zhang Peiyong stood up and rushed to the conference room to arrange revision tasks.

Not long after, in the conference room, there were bursts of mourning from the programmers.

More than 200 loopholes have to be corrected within the specified time limit, the huge workload, the future period of time, is destined to work overtime for a long time, weekends, holidays and so on, don't even think about it.

Watching his subordinates leave in despair, Zhang Peiyong was also full of sadness. He originally planned to spend the weekend with his daughter on her birthday, but if the project had such a serious problem, he, the person in charge, would definitely not be able to leave.

"Brother Yong, how should the bug finder be rewarded? If there are more than 200 bugs, if the reward is too much, the financial side will definitely not approve the money." Zhao Xiaohui looked at Zhang Peiyong nervously and asked for instructions.

Hearing this, Zhang Peiyong's face became even more ugly.

Normally, digging a loophole will usually give the discoverer thousands or even tens of thousands of bonuses. If it is replaced by international giants such as Microsoft and Apple, if a major loophole is discovered, they can even get hundreds of thousands or even tens of millions of bonuses. , the unit is still the US knife.

A few thousand yuan bonus for a bug is already very few.

Even if a loophole is only given a few thousand, more than two hundred loopholes will cost nearly one million. For the company, it is a large unexpected expenditure. It is strange that the financial manager does not trouble him.

Moreover, this money must be given. This guy can find so many loopholes. He must be a master of technology. The ghost knows whether he has other loopholes in his hands.

Giving less is inappropriate, and giving more is not approved by finance.

Thinking of this question, Zhang Peiyong's head froze.

"Brother Yong, if it's all right, I'll go to work first!" Seeing Zhang Peiyong's face getting worse and worse, Zhao Xiaohui hurriedly said goodbye.

"Wait a minute, I have a task for you." Zhang Peiyong quickly stopped Zhao Xiaohui.

Zhao Xiaohui paused, showing a remorseful face, wishing he could slap himself.

Let you talk more, this is good, the task is coming!

"Brother Yong, what is the mission!" Zhao Xiaohui turned around and asked with a wry smile.

"You can get in touch with this expert and get a price cut." Zhang Peiyong arranged.

"Brother Yong, I don't know how to bargain! Why don't you talk to him in person!" Zhao Xiaohui looked embarrassed, it was rare to say.

"You talk to him first, if you can't agree, I'll go out again, there must be a transition, understand?" Zhang Peiyong looked at Zhao Xiaohui and reminded.

"Okay! Brother Yong, what are your expectations for bargaining?" Zhao Xiaohui nodded and asked.

"Of course, the less the better. A loophole is two or three thousand, and a serious one is less than ten thousand. Try it and see if you can talk about it." Zhang Peiyong replied.

"Brother Yong, this is too little! Can he agree?" Zhao Xiaohui scratched his head, feeling that this task was very difficult.

"Do your best! Such a large expenditure will definitely be deducted from the project bonus. For everyone's bonus, please work hard! I can't talk about it, I will talk about it again." Zhang Peiyong encouraged.

After such a big pot was smashed down, Zhao Xiaohui was instantly smashed, confused, and walked out of the conference room for some reason.