点击上方蓝字关注我们
概述
功能
研究人员最初注意到在使用Outlook邮件客户端时，页面上有多个显示与该联系人相关的其他信息的标签。其中的一个标签是该联系人的LinkedIn个人资料，里面包含了联系人的公司名称、职务、过去的经历和位置等。看到这些，研究人员开始好奇邮件客户端是如何找到这些个人资料的？
研究人员通过查看HTTP请求，注意到Outlook客户端在显示个人的详细信息时，将通过WebSocket交换数据。请求或响应的消息采用一种不常见的格式进行编码，如下图所示：
该请求是通过WebSocket向https://sfnam.loki.delve.office.com发出的。通过查看启动通信的JavaScript代码，可以找到负责上述编码格式的代码。Chrome中的“网络”标签将显示用于启动给定WebSocket通信的JavaScript文件和源代码，如下图所示：
查看Chrome突出显示的源代码，研究人员发现该代码可以处理新的请求和响应。在以下的代码片段的onMessage回调处理程序中，我们可以看到，接收到的消息将转换为UInt8数组，并使用inflateRaw方法从Pako模块解压缩。Pako是一个支持LZip压缩算法的库。InflateRaw()函数使用LZip压缩，不包含文件名和修改日期的元数据标头。
}, e.prototype.onMessage = function (e) {var t = this;this.inflateData(e.data, function (n) {try {t.setServerPingTimerIfEnabled();var r = JSON.parse(n), o = k()(r.Key, 10);if (-1 === o) return;if (r.Headers = r.Headers && q(r.Headers), o in t.activeRequestsMap) {var i = t.activeRequestsMap[o];i && (clearTimeout(i.timeout), setTimeout(function () {return i.onSuccess(r, e.timeStamp)}, 0)), delete t.activeRequestsMap[o]} else t.logError("WebSocket-onMessage-UnableToFindResponseKey", {Key: o.toString()})} catch (e) {t.logError("WebSocket-onMessage-ReceiveFailure", {Exception: e.message})}})}, e.prototype.inflateData = function (e, t) {return G(this, void 0, void 0, function () {var n, r, o;return W(this, function (i) {switch (i.label) {case 0:return this.compressionDisabled ? (t(e), [3, 4]) : [3, 1];case 1:return i.trys.push([1, 3, , 4]), [4, this.getPako()];case 2:return n = i.sent(), r = n.inflateRaw(new Uint8Array(e), {to: "string"}), t(r), [3, 4];case 3:return o = i.sent(), this.logError("WebSocket-inflateData-PakoInflateFailure", {Exception: o}), t(""), [3, 4];case 4:return [2]}})})
知道编码格式后，研究人员创建了一个简单的ZAP插件，如果请求和响应的消息与LZip或GZip格式匹配，ZAP将自动对其进行解码，如下图所示：
{"Key": "15","Url": "https://sfnam.loki.delve.office.com/api/v1/linkedin/profiles/full?PersonaDisplayName=Peter%20Gibbons&ExternalPageInstance=332c2687-71f7-49df-8b7c-b2402ccbf473&UserLocale=en-US&OlsPersonaId=&AadObjectId=&Smtp=kmitnick%40mitnicksecurity.com&UserPrincipalName=&PersonaType=User&RootCorrelationId=2933990e-0cc2-4406-8103-0cba160e7047&CorrelationId=2933990e-0cc2-4406-8103-0cba160e7047&ClientCorrelationId=0d3bf626-18d0-46bf-8ce4-667b7bb485b4","Verb": "GET","Headers": {"Accept": "text/plain, application/json, text/json","X-ClientType": "OwaMail","X-ClientFeature": "LivePersonaCard","X-LPCVersion": "1.20201124.2.1","authorization": "Bearer EwAYA9[...]","X-HostAppCapabilities": "{}"}
{"Key": "4","StatusCode": 200,"ReasonPhrase": "OK","Headers": {"X-WebSocketCorrelationId": "9cb14592-5728-******","Cache-Control": "no-store","Server": "Microsoft-HTTPAPI/2.0","X-BEServer": "_Loki_10716","X-DataCenter": "PROD_NORTHCENTRALUS","X-ServerVersion": "0.20201202.4.1","X-Content-Type-Options": "nosniff","X-TokenTtl": "86390","X-InboundDuration": "14","X-CorrelationId": "9cb14592-5728-47c5- ******,"Access-Control-Allow-Origin": "https://sfnam.loki.delve.office.com","Access-Control-Allow-Credentials": "true","Access-Control-Expose-Headers": "X-ServerVersion,X-InboundDuration,X-BEServer,X-TokenTtl,X-SocialDistance,X-CorrelationId,X-DataCenter,x-azure-ref,Retry-After","Date": "Mon, 07 Dec 2020 16:26:01 GMT"},"Body": "<<JSON escaped string>>"}
{"resultTemplate":"ExactMatch","bound":true,"bindUrl":"https://login.live.com/accountbind.srf?provider=linkedin.com&redirect_uri=https://loki.delve.office.com/linkedInAuthRedirect.aspx&client_id=000000004C1E916B&dualbind=1&mkt=en-US&external_app=Owa&dualbindmobile=True","persons":[{"id":"urn:li:person:DgEN90FFXdpXh-OCiFTGl3l0pTo6d4ub6h19lWlc7mE","displayName":"Kevin Mitnick","headline":"The World's Most Famous Hacker | CEO | Author | Professional Speaker","companyName":"Mitnick Security Consulting","location":"Henderson, Nevada, United States","photoUrl":"https://media.licdn.com/dms/image/C4E03AQEKmI4XcvU8nQ/profile-displayphoto-shrink_800_800/0?e=1613001600&v=beta&t=o8EaQb4TeZn9JhUOTJJOS3PA9uzaewnHWO7n7nJNDfw","linkedInUrl":"https://www.linkedin.com/in/kevinmitnick",//... JSON messages also include schools, work experience, company details,}
总结
END
本文始发于微信公众号（SecTr安全团队）：通过电子邮件地址即可以找到你的LinkedIn个人资料
免责声明:文章中涉及的程序(方法)可能带有攻击性，仅供安全研究与教学之用，读者将其信息做其他用途，由读者承担全部法律及连带责任，本站不承担任何法律及连带责任；如有问题可邮件联系(建议使用企业邮箱或有效邮箱,避免邮件被拦截，联系方式见首页)，望知悉。
- 左青龙
- 微信扫一扫
-
- 右白虎
- 微信扫一扫
-
评论