WooYun.org

http://ebooking.elong.com/ebkauth/forgotpwd

输入任意用户名，拦截数据包

经测试，验证码可重复利用，根据返回数据包可判断用户是否存在
获取到大量用户名，包括管理员用户
admin
admin1
yangjie
zhoumin
yangmin
zhangxiufang
yangmei
lixiumei
limei
zhangfengying
zhangwei
liuhuan
lixiang
wanglili
wangting
yangxue
yangliu
liwei
wangyang
zhangchunmei
liying
liying
zhangrui
wanglong
lifeng
huangmin
lijianhua
liyang
liyang
liyang
liubing
wanglu
lilin
lilin
liqin
wangchao
zhangbin
zhangfei
chenhao
yangwei
liuxia
wangrong
liujing
wangtao
wangjianhua
zhangxiumei
wangdong
zhangna
liumei
wangguixiang
wangjuan
zhangxiulan
wangqin
zhangying
zhangying
zhangying
zhouli
zhangning
yangling
chenchen
yangbo
chenlin
chenlin
yangyang
yangyang
lixue
wangyu
wanghao
zhangjian
zhangjian
wangwei
liuqin
lixin
lixin
chenying
lichao
liqian
yangfang
chenqiang
wangqiang
wangxu
zhangfeng
liting
wanglihua
xuwei
yangjuan
wangzhiqiang
liuchang
zhangbo
zhangbo
yangjun
liutao
lihao
zhanghongmei
wanggang
zhoujie
chenfang
chenyong
yangping
lilei
zhangxiuying
chenjun
chenjun
chenbo
lixiuyun
zhaomin
zhangpeng
sunwei
yangfan
liqiang
zhangxu
wangdan
chenlei
liujianjun
liuli
liuli
chenfei
yangming
chenming
zhanghui
zhanghui
wangmin
liuna
lijing
lijing
liuchao
zhangjun
zhangjun
lixiufang
chenxin
liuyun
lihaiyan
wangpeng
wangshuying
lipeng
lijian
lijian
zhangliang
zhangxiurong
chenjie
chenjie
yangli
liukai
wangping
wangping
wangping
lidongmei
liuhao
zhangqiang
liubin
litao
zhoujing
wangxin
wangxin
lifang
wangcheng
zhanghao
yanghong
yanglin
liuxin
liufei
wanghuan
wangying
wangying
wangying
wangjing
wangjing
lixiuzhen
zhaoyong
chenlong
lifei
wangjun
wangjun
wangyong
gaofeng
chengang
lihui
lihui
chenling
zhouyong
liyan
liyan
liyan
zhangli
zhangli
zhangli
chenmei
liwen
liuling
liuqiang
zhaowei
zhanglei
zhanglei
lihongmei
liudan
zhangqin
huangyong
zhangxin
liuhong
zhangjianguo
wangjie
wangbin
wangbin
wangjian
wangjian
lijia
lilong
liuhui
liuhui
lixiuying
liubo
lichunmei
liuyan
liuyan
huangwei
liujun
liujun
liyun
chenxiuying
zhangjing
zhangjing
lijianjun
libing
wangfang
liuwei
wangli
limin
zhangyong
lijie
lijun
lixia
liujie
liufang
liping
liling
lidan
liping
chenwei
lihong
zhangling
libin
zhangyu
wangkai
wangbo
wangli
zhangjuan
wangxue
wanghua
chentao
wangna
zhangting
chenhong
zhanglin
liyumei
wangmei
wangqian
zhaojing
chenchao
chenliang
yanghua
zhanglong
wangrui
chenhui
liuting
liuming
zhanghaiyan
yanglei
chenyun
zhangyu
lijie
wangbo
libin
liufeng
lixiuhua
liuyuhua
zhaoli
zhanglin
zhangxiuhua
zhaojun
yangbin
zhangnan
liuyu
wangli
zhangfan
zhangyu
xujing
zhangwen
利用任意存在用户名（这里使用yangjie做测试），修改返回数据包中的手机号码，我改成我自己的号码了

然后选择获取验证码

这里要说一下，截取获取验证码的数据包可以看到，直接含手机号，估计只要修改这里的手机号就可以了，而且这里的号码直接显示我的号码，应该是从页面获取来的

验证码直接发到我手机了，然后就进入密码重置页面了，直接输入新密码修改成功（密码改为wooyun123）

就只测试了这个账号，其他账号木有改动
（审核大大辛苦了，求帮忙打码）