DEV Community

Discussion on: Hacking BeReal - A practical lesson on “Man in the Middle” attacks

 
xmdb profile image
Matt

That way doesn't work for me. It keeps re-requesting a new upload (POST)

Thread Thread
 
ozcap profile image
Oscar

But either way those requests should also be paused, no?

Thread Thread
 
xmdb profile image
Matt

Yes they are paused but the photo does not go through on the client and it is probably expecting different upload IDs

Thread Thread
 
xmdb profile image
Matt

Image description
Here you can see the modified PUT request returns a success but the client requests to start another 3 uploads, 2 of them being the one just returned as a success.

Thread Thread
 
ozcap profile image
Oscar

That PUT request looks ok to me actually. Looks like a decent amount of data was sent and it was a 200 status. If you close and open the app now, is your custom RealMoji there?

Thread Thread
 
xmdb profile image
Matt

Nope. I’m trying to send a BeReal photo though, but you said it acts relatively the same. If I close and open the app, it just tries to upload again.

Thread Thread
 
ozcap profile image
Oscar

Ah but if you post a normal BeReal then you upload two pictures (front and back) so the app is making two consecutive requests followed by a bereal API request to say where the photos are stored. Have a play around with sending a RealMoji and see if you can get that to work!

Thread Thread
 
xmdb profile image
Matt

Ah yeah, a RealMoji worked with the script. However both manually and automatically I can't upload a fake normal BeReal. What am I getting wrong?