??????????2??????о?????Appscan?????????????????????????????????衣????????????????????????
????1.Appscan??????????
??????1??.?????????????http://g2.mail.10086ts.cn/serviceapi/CommonRequest.ashx???
???????http://g2.mail.10086ts.cn/serviceapi/CommonRequest.ashx?sid=>"'><script>alert(1292)</script>&r=>"'><script>alert(1292)</script>&mobile=>"'><script>alert(1292)</script>&reqtype=>"'><script>window.location="http://www.baidu.com";</script>
??????2??.?????????????????
???????磺http://g2.mail.10086ts.cn/addr/apiserver/?????????????????????????Web?????????ó????г???
??????3??.web??ó????????й?
????????????js????к??г????????????;CookieUtils.js
??????4??.SQL ??
???????????????????????????????????????????QQ????????????????????????????????“????”??????
????2.APPSCAN???????
????(1) .?????web?У????????????赽???????飬?????????????С?????????????????????????????????????????м???g0.mail.10086ts.cn.
????wap???????????????????????????????????????????URL
????(2).????У??????????????????????跽??????????????С?
?????????????е????????????????login  expert???С?????????????AppScan?????????????????????Щ??????????????
????3.???????????????
??????1??.????????????????????????н?????????????????????????????????????????????????????????????????????????
??????2??.Appscan?????????????????????????????????????????????
??????3??.??????ζ?Appscan????????о??????????????????????????????????????????????????????????????????????????????????????????????????????????????????????磺sql???.?????XSS?????????????????????????????????????????????????????????????????????????????????????????????????????蹤???????裬?????????棬?????????????e???????Ч??????
??????4??.??蹤????????????????????????????????????????????????????????????????????Appcan??????????????????????ο????????????????????
???????????????????????????Σ??????°??????????????????????