mirror of
https://github.com/stulle123/kakaotalk_analysis.git
synced 2025-02-06 15:05:47 +00:00
795 B
795 B
Kakaotalk 10.3.7 Analysis
Setup
See here.
Recon
See here.
Findings
TO-DOs
- Find a proxy Activity to start
MyProfileSettingsActivity
-> steal token - Find a
setResult()
call to accesscontent://com.kakao.talk.FileProvider
- Test Secret Chat interception with
mitmproxy
script- Use value from
pt
field to compute the nonce - Does a warning pop up?
- What about the master secret?
- Use value from
- Test CFB bit flipping
- Create a
Plus Friend
orKakao Business
page or anOpen Chat Room
to deliver malicious JS - Connect with Sergey Toshin
- Check out https://github.com/oversecured/ovaa
- I can load URLs in
CommerceShopperWebViewActivity
andKGPopupActivity
-> check for vulns