Bug 曝光台 Toutiao RESTful API Bug | 今日头条 RESTful API Bug

LawisChen · 2020年05月17日 · 2 次阅读

Recently, we found RESTful API bugs in some popular mobile applications by a fuzzing test tool:

Toutiao - version: 7.4.8


近期,我们利用某模糊测试工具发现了几家大厂 App 接口存在如下 bug:

今日头条 - 版本: 7.4.8

Appendix 附录

  • Bug ID 8

    {
      "appName": "Toutiao",
      "method": "GET",
      "url": "https://is3-ipv6.snssdk.com/user/tab/tabs/v3",
      "status_code": 502,
      "request": {
        "_rticket": "1575307536768",
        "ab_feature": "102751,94570",
        "ab_group": "94570,102751",
        "ab_version": "668779,1251922,662099,668774,1304783,1304884,1315993,765196,1323358,857803,1284627,679100,660830,1054755,1230782,1243993,1244004,1313655,1103040,662176,649428,801968,707372,1316094,661906,668775,1247777,1322510,1323207,1312038,1190522,1157750,1324291,661781,1211757",
        "ac": "wifi",
        "aid": "13",
        "app_name": "news_article",
        "cdid": "29f42862-af0f-4626-aeef-2bd3c990300b",
        "channel": "huawei",
        "detail": "my_tabs",
        "device_brand": "Huawei",
        "device_id": "35638971776",
        "device_platform": "android",
        "device_type": "HUAWEI MT7-CL00",
        "dpi": "440",
        "iid": "94239627587",
        "language": "zh",
        "mac_address": "94:FE:22:4E:65:68",
        "manifest_version_code": "7501",
        "oaid": "d5fbf4f3-eb39-520e-eefa-ffffff6770a4",
        "openudid": "c0e788be0c011908",
        "os_api": "23",
        "os_version": "6.0",
        "plugin": "18762",
        "profile_style_version": 12,
        "resolution": "1080*1821",
        "rom_version": "emotionui_4.0.1_mt7-cl00c92b577",
        "ssmix": "a",
        "update_version_code": "75017",
        "uuid": "a00000559ae7fa",
        "version_code": "750",
        "version_name": "7.5.0"
      },
      "response_data": "502 Bad Gateway"
    }
    
  • Bug ID 9

    {
      "appName": "Toutiao",
      "method": "GET",
      "url": "https://is3-ipv6.snssdk.com/user/tab/tabs/v3",
      "status_code": 504,
      "request": {
        "_rticket": "1575307536768",
        "ab_feature": "102751,94570",
        "ab_group": "94570,102751",
        "ab_version": "668779,1251922,662099,668774,1304783,1304884,1315993,765196,1323358,857803,1284627,679100,660830,1054755,1230782,1243993,1244004,1313655,1103040,662176,649428,801968,707372,1316094,661906,668775,1247777,1322510,1323207,1312038,1190522,1157750,1324291,661781,1211757",
        "ac": "wifi",
        "aid": "13",
        "app_name": "news_article",
        "cdid": "29f42862-af0f-4626-aeef-2bd3c990300b",
        "channel": "huawei",
        "detail": "Þ\xad",
        "device_brand": "Huawei",
        "device_id": "35638971776",
        "device_platform": "android",
        "device_type": "HUAWEI MT7-CL00",
        "dpi": "440",
        "iid": "94239627587",
        "language": "zh",
        "mac_address": "94:FE:22:4E:65:68",
        "manifest_version_code": "7501",
        "oaid": "d5fbf4f3-eb39-520e-eefa-ffffff6770a4",
        "openudid": "c0e788be0c011908",
        "os_api": "23",
        "os_version": "6.0",
        "plugin": "18762",
        "profile_style_version": "1",
        "resolution": "1080*1821",
        "rom_version": "emotionui_4.0.1_mt7-cl00c92b577",
        "ssmix": "a",
        "update_version_code": "75017",
        "uuid": "a00000559ae7fa",
        "version_code": "750",
        "version_name": "7.5.0"
      },
      "response_data": "504 Gateway Time-out"
    }
    
暂无回复。
需要 登录 后方可回复, 如果你还没有账号请点击这里 注册