This topic created in 2596 days ago, the information mentioned may be changed or developed.
邮件主题：big vulnerability on your website - there are x hole
邮件内容：
Hi,I am Independent Security Researcher .Found very big Security Vulnerability (Bug) in your system and it can cause damage your website so may i report here ? i can read all databases,can control and change everything,all your user informations,documents,everything. is there any appreciation reward for valid report/bug ?
Kindly response as soon as possible :)
(i didnt touch or download anything)
Your Databases List;
web application technology: xxx
back-end DBMS: MySQL > xxx
available databases [xx]:
[*] xx
[*] xx
邮件内容：
Hi,I am Independent Security Researcher .Found very big Security Vulnerability (Bug) in your system and it can cause damage your website so may i report here ? i can read all databases,can control and change everything,all your user informations,documents,everything. is there any appreciation reward for valid report/bug ?
Kindly response as soon as possible :)
(i didnt touch or download anything)
Your Databases List;
web application technology: xxx
back-end DBMS: MySQL > xxx
available databases [xx]:
[*] xx
[*] xx
 |
1
xenme Mar 25, 2019 via iPhone
垃圾邮件，删除举报加黑名单
|
 |
2
hlwjia PRO 如果属实，那可以适当报答一下啊
|
 |
3
ioioioioioioi OP @hlwjia 这是勒索，还报答
|
 |
4
winterx Mar 25, 2019
不管是不是勒索，人家已经告诉你 SQL 注入了，你自己检查一下 SQL 日志跟数据库啊
|
|
5
ioioioioioioi OP @winterx 是看 nginx access log 的 request 吧？
|
 |
6
simapple Mar 25, 2019
看邮件描述的是不是真的
|
|
7
ioioioioioioi OP @simapple available databases 是对的
|
 |
8
nosmile Mar 25, 2019
下面数据库是不是你的你不知道吗，如果是真的，你不赶紧修复，修复好了，人家也说了“ is there any appreciation reward ”
|
 |
9
co3site Mar 25, 2019 via Android
只有我觉得这行文读起来想翻译过来的吗？
|
|
10
simapple Mar 25, 2019
@ioioioioioioi 那可能真的有漏洞，有诚意的话回复要一些漏洞细节，确认了给点奖励，或者赶紧自查，找到漏洞修复
|
|
11
ioioioioioioi OP @nosmile 是真的，不然就当垃圾邮件了
|
|
12
ioioioioioioi OP @co3site 可能对方母语不是英语
|
 |
13
lorryo Mar 25, 2019  2
好像是 SQLMAP 跑出的结果，看一下数据库日志吧，赶紧修复吧。
另外人家只是问你有没有漏洞赏金而已，说勒索也太过了吧？ |
 |
14
BCy66drFCvk1Ou87 Mar 25, 2019 via Android
下个 SQL 注入工具自己模拟扫描一下，有可能是很低级别的漏洞。
|
 |
15
javashell Mar 25, 2019 via Android
看样子是注入漏洞，发给你注入后获得你网站数据库的部分库名作为证明，当前紧要的是修复，然后可以参考世纪 佳缘的做法 /手动狗头🐶
|
|
16
hlwjia PRO |
|
17
hlwjia PRO |
Select Language