Logic vulnerability-token bypass

No echo on the front end

• See if there is a pattern, if it can be blasted, generally not

There is an echo on the front end

• Take Pikachu as an example

• Check the front-end source code and find that the token exists

• Capture

• Add the location of the blast

• The thread must be set to 1, because if multithreading means multiple package tokens, it will not be allowed

• Click on always at that location

• Add the found token in the grep position in the options and add the token

• 1 position to do a few

• Select this for the token position

• Start blasting, you can see that the token is different every time you blast