iSECPartners/Introspy-iOS

Missing vulns/signatures

nabla-c0d3 opened this issue · 3 comments

So that I don't forget:

  • Cookie leaking to 3rd party domains through HTTP redirections
  • HTTPS to HTTP redirection
  • DP APIs with UnlessOpen attribute
  • Null IV
  • Bad RNG
  • App screenshot when backgrounding

"""Cookie leaking to 3rd party domains through HTTP redirections"""

Can we actually do this? We only have support to match to static values... not to other values in the dict. We'd have to change the way the Filter classes work yes?