b1ackc4t / 14finger Goto Github PK
View Code? Open in Web Editor NEW功能齐全的Web指纹识别和分享平台,基于vue3+django前后端分离的web架构,并集成了长亭出品的rad爬虫的功能,内置了一万多条互联网开源的指纹信息。
License: GNU General Public License v3.0
功能齐全的Web指纹识别和分享平台,基于vue3+django前后端分离的web架构,并集成了长亭出品的rad爬虫的功能,内置了一万多条互联网开源的指纹信息。
License: GNU General Public License v3.0
2023-08-12T00:57:08.929393Z 0 [ERROR] [MY-010020] [Server] Data Dictionary initialization failed.
2023-08-12T00:57:08.929557Z 0 [ERROR] [MY-010119] [Server] Aborting
2023-08-12T00:57:10.289360Z 0 [System] [MY-010910] [Server] /usr/sbin/mysqld: Shutdown complete (mysqld 8.0.15) MySQL Community Server - GPL.
2023-08-12T00:58:11.338091Z 0 [Warning] [MY-011070] [Server] 'Disabling symbolic links using --skip-symbolic-links (or equivalent) is the default. Consider not using this option as it' is deprecated and will be removed in a future release.
2023-08-12T00:58:11.338509Z 0 [System] [MY-010116] [Server] /usr/sbin/mysqld (mysqld 8.0.15) starting as process 1
2023-08-12T00:58:11.345649Z 0 [Warning] [MY-010159] [Server] Setting lower_case_table_names=2 because file system for /var/lib/mysql/ is case insensitive
2023-08-12T00:58:11.862528Z 1 [ERROR] [MY-011087] [Server] Different lower_case_table_names settings for server ('2') and data dictionary ('0').
2023-08-12T00:58:11.862716Z 0 [ERROR] [MY-010020] [Server] Data Dictionary initialization failed.
2023-08-12T00:58:11.862858Z 0 [ERROR] [MY-010119] [Server] Aborting
2023-08-12T00:58:13.314304Z 0 [System] [MY-010910] [Server] /usr/sbin/mysqld: Shutdown complete (mysqld 8.0.15) MySQL Community Server - GPL.
2023-08-12T00:59:14.264133Z 0 [Warning] [MY-011070] [Server] 'Disabling symbolic links using --skip-symbolic-links (or equivalent) is the default. Consider not using this option as it' is deprecated and will be removed in a future release.
2023-08-12T00:59:14.265313Z 0 [System] [MY-010116] [Server] /usr/sbin/mysqld (mysqld 8.0.15) starting as process 1
2023-08-12T00:59:14.274425Z 0 [Warning] [MY-010159] [Server] Setting lower_case_table_names=2 because file system for /var/lib/mysql/ is case insensitive
2023-08-12T00:59:14.823615Z 1 [ERROR] [MY-011087] [Server] Different lower_case_table_names settings for server ('2') and data dictionary ('0').
2023-08-12T00:59:14.823861Z 0 [ERROR] [MY-010020] [Server] Data Dictionary initialization failed.
2023-08-12T00:59:14.824070Z 0 [ERROR] [MY-010119] [Server] Aborting
2023-08-12T00:59:16.183835Z 0 [System] [MY-010910] [Server] /usr/sbin/mysqld: Shutdown complete (mysqld 8.0.15) MySQL Community Server - GPL.
情况时这样的,登录返回的json为404,然后web界面显示用户名或密码错误:
root@VM-8-2-debian:~/14Finger-docker# cat nginx/html/config.json
{
"BASE_URL_PROD": "http://127.0.0.1:7990",
"BASE_URL_DEV": "http://127.0.0.1:8000"
}
root@VM-8-2-debian:/14Finger-docker# docker ps/14Finger-docker# curl -X POST http://127.0.0.1:7990/api/user/login
CONTAINER ID IMAGE COMMAND CREATED STATUS PORTS NAMES
201c912fcaf9 nginx:1.20.2 "/docker-entrypoint.…" 31 minutes ago Up 2 minutes 0.0.0.0:7990->80/tcp 14finger-docker_nginx_1
43c18f3d0250 14finger-docker_main "sh -c 'uwsgi --ini …" 31 minutes ago Up 2 minutes 8000/tcp 14finger-docker_main_1
6161e917cdff redis:7.0.4 "docker-entrypoint.s…" 31 minutes ago Up 2 minutes 14finger-docker_redis_1
77e41fa5d790 mysql:8.0.15 "docker-entrypoint.s…" 31 minutes ago Up 2 minutes 3306/tcp, 33060/tcp 14finger-docker_db_1
root@VM-8-2-debian:
-H 'User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:122.0) Gecko/20100101 Firefox/122.0'
-H 'Accept: application/json, text/plain, /'
-H 'Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2'
-H 'Accept-Encoding: gzip, deflate'
-H 'Content-Type: application/json'
-H 'Origin: http://127.0.0.1:7990'
-H 'Connection: keep-alive'
-H 'Referer: http://127.0.0.1:7990/login'
-d '{"username":"admin","password":"admin","email":null}'
使用的是新版的release,但是还是存在数据写入的问题
master branch
In the scanning of the fingerprint function, there are commands to inject vulnerabilities, and attackers can achieve RCE on the remote server.
Input validation and cleaning
For more vulnerability details, please refer to the PDF.
14Finger Unauthorized Remote Command Execution Vulnerability.pdf
你好 ubuntu的系统 一键dorker 提示
Step 3/16 : RUN useradd -d /home/test -m test
---> Running in f3889b675fa5
Killed
这个错误要怎么解决
master branch
The first Vulnerability :14Finger User Sensitive Information Leakage Vulnerability
The second vulnerability: 14Finger User privilege escalation vulnerability
The third vulnerability: 14Finger Arbitrary user deletion vulnerability
The fourth vulnerability: 14Finger Arbitrary User Password Reset Vulnerability
14Finger does not strictly verify the identity permission of the current user operation, which causes the user to operate functions beyond the scope of his/her management permission, thus operating some behaviors that the user cannot operate.
For more vulnerability details, please refer to the PDF.
14Finger User Sensitive Information Leakage Vulnerability.pdf
14Finger User privilege escalation vulnerability.pdf
14Finger Arbitrary user deletion vulnerability.pdf
14Finger Arbitrary User Password Reset Vulnerability.pdf
腾讯云vps搭建
admin/admin 登录提示密码错误
无法注册
扫描加载后无反应
A declarative, efficient, and flexible JavaScript library for building user interfaces.
🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
An Open Source Machine Learning Framework for Everyone
The Web framework for perfectionists with deadlines.
A PHP framework for web artisans
Bring data to life with SVG, Canvas and HTML. 📊📈🎉
JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
Some thing interesting about web. New door for the world.
A server is a program made to process requests and deliver data to clients.
Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
Some thing interesting about visualization, use data art
Some thing interesting about game, make everyone happy.
We are working to build community through open source technology. NB: members must have two-factor auth.
Open source projects and samples from Microsoft.
Google ❤️ Open Source for everyone.
Alibaba Open Source for everyone
Data-Driven Documents codes.
China tencent open source team.