RE: Wappush Contains Username/Password

Hi Stipe,
 I separated the header from the actually payload of the wappush. I don't know the meaning of all the info there but here what my details:

If I take the full bytecode here:
cc061fae871880757365726e616d6550407373773072642621008db1c39302056a0045c60c0372616e646f6d2e75726c0085030011030007010354657374206d657373616765000101

You can split it into 2 parts since wappush starts with 02056a when in utf-8, (Took http://www.nabble.com/PDU-decoding-t4759916.html as reference)

Header: cc061fae871880757365726e616d6550407373773072642621008db1c393
Payload: 02056a0045c60c0372616e646f6d2e75726c0085030011030007010354657374206d657373616765000101

So if we analyze what's included in the header (converting to ASCII), we can find our username/Password that was transmitted as basic auth :)

Header:
cc061fae871880 (??)
757365726e616d65 (username)
5040737377307264 (P@ssw0rd)
2621008db1c393 (??)

I hope I'm moving in the way you're steering :)

Regards,

-------
Mathieu Bruneau


now, I thought you could "show" that the header is in the byte code here. 
(Without the need that I dig deeper into the WBXML stuff again ;)

Can you show which section is relevant? (yeah, I'm trying to let you show as 
much as possible in order to have it easier for me, shame on me, but this makes 
my time more effective, and a lot of other people will benefit this "stearing" 
approach.

Stipe

-------------------------------------------------------------------
Kölner Landstrasse 419
40589 Düsseldorf, NRW, Germany

tolj.org system architecture      Kannel Software Foundation (KSF)
http://www.tolj.org/              http://www.kannel.org/

mailto:st_{at}_tolj.org           mailto:stolj_{at}_kannel.org
-------------------------------------------------------------------



No virus found in this outgoing message.
Checked by AVG Free Edition. 
Version: 7.5.503 / Virus Database: 269.16.13/1167 - Release Date: 2007-12-03 12:20