banner
肥皂的小屋

肥皂的小屋

github
steam
bilibili
douban
tg_channel
HomeArchivesPortfoliosNftAboutShotrs

漏洞挖掘

cover
cover
cover
cover
cover

记一次打偏的spring boot接口信息泄露导致AWS s3 bucket接管

挖某 SRC 的资产中发现某三级子域名历史解析的 IP 为 Amazon 服务器，发现该 IP 存在 springboot 接口泄露 通过解析拿到星号加密的 AWS_SECRET_ACCESS_KEY 的明文并成功访问容器资源 但是明知道打偏还是硬着头皮提交漏洞然后被忽略的苦逼…
SRC
Ownership of this blog data is guaranteed by blockchain and smart contracts to the creator alone.