Peach App Token Reuse Flaw

Re:Peach App Token Reuse Flaw by nstj on Tuesday January 19, 2016 @01:02AM (#10929098)

So the article title could be changed to "Peach API has replay vulnerability"?

I haven't actually tried this yet but can someone confirm the app has pinning? If so, thoughts on how he sniffed the original traffic and ran the replay?

[ Parent | on HN ]

Re:Peach App Token Reuse Flaw by jorge_leria on Tuesday January 19, 2016 @08:17AM (#10930486)

If you have a jailbroken iOS device you can use SSL Kill Switch [0] to disable certificate pinning and get the traffic with MITMproxy [1] or Charles.

[0] https://github.com/nabla-c0d3/ssl-kill-switch2 [1] http://mitmproxy.org/

[ Parent | on HN ]