Skip to content

Commit

Permalink
small adjustment
Browse files Browse the repository at this point in the history
  • Loading branch information
SirGankalot committed Aug 1, 2024
1 parent 8fbda42 commit 5c7296b
Showing 1 changed file with 10 additions and 10 deletions.
20 changes: 10 additions & 10 deletions documentation/README.md
Original file line number Diff line number Diff line change
Expand Up @@ -36,13 +36,15 @@ The base RSA function uses 2 prime numbers that are connected, called sexy prime

The Backup token is vulnerable as the authlib does not differentiate between 2 algorithms. This makes it possible to not only authenticate/sign with the private key inside the token, but also create a token with the public key that will be handled the same way as the private key token. You can create a fake token via the userlist in which the public keys are listed than you can login in as if you would have the actual private key token.

# Exploits
# Example Exploits

None of the exploits are connected.
All the exploits are also inside the ```checker/src/checker.py``` .
None of the exploits are connected with each other.
All the exploits are also inside the ```checker/src/checker.py```.
The Exploits down below is an example exploit with the real enowars setup from a testrun.
The checker also contains a base version of the exploits.


## Exploit 1
## Example Exploit 1
```bash
#!/usr/bin/env python3

Expand Down Expand Up @@ -151,7 +153,7 @@ for thread in threads:
print(e)
```
## Exploit 2
## Example Exploit 2
As part of this exploit you will be able to see the original c file in the documentation folder that is used as a compiled version inside the service.
Expand Down Expand Up @@ -309,7 +311,7 @@ for thread in threads:
print(e)
```
## Exploit 3
## Example Exploit 3
```bash
#!/usr/bin/env python3

Expand Down Expand Up @@ -381,8 +383,6 @@ The Fixes listed are only part of all possible ways to fix the exploits.
The Checker is a tool that checks the features of the service for its behavior.
For Whatsscam it sends http requests that try out a feature for example if you can text or add a certain person as a friend. It is used to prevent unintentional fixes or that someone turns off the service or any features. It is also used to simulate traffic for testing and to simulate regular traffic as usual for a real service. For details please look into the ```checker/src/checker.py``` for functions or the ```checker/src/checker_util_func.py```.
For Whatsscam it sends http requests that try out a feature for example if you can text or add a certain person as a friend. It is used to prevent unintentional fixes or that someone turns off the service or any features. It is also used to simulate traffic for testing and to simulate regular traffic as usual for a real service. For details about the functions please look into the ```checker/src/checker.py``` or ```checker/src/checker_util_func.py```.
If you wanna start the checker you use ```docker compose up --build``` inside the checker folder.
Than you can use the enochecker to activate the checker via ```enochecker_test -a YOUR_IP -p 19696 -A YOUR_IP``` (checker listens to port 19696).
If you wanna start the checker you use ```docker compose up --build``` inside the ```checker``` folder.

0 comments on commit 5c7296b

Please sign in to comment.