What part need to be done in ZAP after configuration in mobile? - security

What part need to be done in ZAP after configuration in mobile. As I am not able to see anything in ZAP after I did the mobile configuration and opened my application in Mobile device.

Related

How to build web application that run in WeChat in app browsers?

I am trying to build a simple web application, which capture users photo and sent it my custom server there by connected to some other business use-case. My web page uses HTML's file input control to launch native camera or gallery pick up option.
var input = document.createElement('input');
input.setAttribute('accept', 'image/*');
input.setAttribute('capture', 'camera');
input.setAttribute('type', 'file');
input.click();
This web app, I placed in local webserver with a name "PhotoLocker" and testing with url like
https://localhost(ipaddress to access via mobile browser)/PhotoLocker/index.html
This link is working fine both on desktop and mobile chrome browsers and am able to debug any issues. Where as same link, I try to access from WeChat browser (just opening above link from chat window), it is not at all opening my application in WeChat in app browser.
After googling, I found that https URL scheme is not supported by WeChat. is it True? When I paste the same app url as weixin://ipaddress/PhotoLocker/index.html, I am able to see my web app home page but it is not working as expected.
My Question is - how to debug my webpage opened in WeChat browser? Do I need a official WeChat Dev account even to develop and test sample apps?
Additional Info :
I am able to debug webpage from WeChat web devloper tool as mentioned in below link. But, unable to debug mobile wechat page in this tool. It is always opening chrome dev tools.
https://mp.weixin.qq.com/wiki?action=doc&id=mp1455784140&t=0.06697335132505233#1
I am a frontend developer in China, Chinese. Forgive my English for any mistake, misunderstanding I could make. Some links (dev docs mostly) below contain sites complete in Chinese, because I can not find corresponding English ones for now.
how to debug my webpage opened in WeChat browser?
Tencent provide an IDE for developing regular web interface and WeChat-mini-program, with which developer can directly interact with:
JSSDK (basically a special weixin
Object lives only in in-WeChat-browser);
API provided in WeChat-mini-program.
If you download that IDE:
First it will ask you is to use you WeChat to scan the QRCode, then confirm login with your WeChat account;
Next it will show up two square button (image below), left one is for WeChat-mini-program, the right one is for you to testing regular web page.
Click the right blue one, then you can find your way out, it's just something built top on project Blink.
As you can see the part of debugging regular webpage in WeChat IDE is no more than a simulator (in the WeChat-mini-program part, developer can write code directly in it), and in my experience it does have bugs, you will still need to test code in real machine.
For that Tencent provide another tool called vConsole, tutorials here, with it you can do following things directly in in-WeChat-browsers:
View console logs;
View network requests;
View document elements;
View Cookies and localStorages;
Execute JS command manually
and so on
Do I need a official WeChat Dev account even to develop and test sample apps?
Depends.
You may know the Official Account inside WeChat, with webpages directly opened in any context inside in-WeChat-browser, it will have the ability to interact the weixin Object, or have some API like login with WeChat, pay with WeChat Pay:
API like close current in-WeChat-browser, hide-share-button will not required anything special, you don't need to register any Official Account;
But if you want yo do the Pay, Login thing, you need an Official Account and pay for the ability every year (not sure about this outside China).
The localhost problem you faced
I don't have my working machine with me now so I can not test. Regularly I can proxy localhost with Charles then debugging in WeChat, but never do the https, I will try it later.
All the information got regarding how to debug webpage opened in wechat browser redirects to how to see log or ajax/netwrok calls analysis.
Even with WeChat web devloper tool as mentioned in below link, I am unable to debug mobile wechat page in this tool. It is always opening chrome dev tools.
https://mp.weixin.qq.com/wiki?action=doc&id=mp1455784140&t=0.06697335132505233#1.
Hence further analyzed remote mobile webpage debugging and found that there is no way to put break points, watch, expressions and all just like in chrome dev tools is not possible.
As a work around - you are able to debug code, when you simulate page in dev tools but no way to debug webpage in mobile device.
Same webpage when tried to do remote debugging as per WeChat web devloper tool documentation. here we can only see console logs and network calls.

WebRTC Streaming between PC and Mobile Client

I would like to implement peer to peer communication between mobile device (iOS & Android) AND Windows PC, I would like Mobile app will stream camera output to PC(no audio will require), and on PC user will able to capture screenshot from running steam. Below is possibility I am thinking.
Option 1 : Develop a Web based application which will run in Google Chrome or Firefox browser on Windows PC, and also will develop mobile client app which will run on Android and iOS devices, and using WebRTC it will steam mobile camera output to website which will be running in PC’s Chrome or Safari browser, and User will able to capture screenshot from running steam and that will be saved on user’s computer. Drawback of this solution is that I have to develop Website so will have not user’s computer file storage, as standalone desktop application is more preferable because desktop application will able to easily access user’s computer file system
Option 2: Develop 3 applications
one Standalone desktop application which will have all features which require to access computer’s local file system.
Develop a small web site which will have just a single screen, it will use for display mobile camera steam, and user will capture output from that page, will develop a kind of watchdog service in desktop app, which will grab latest captured screen from Chrome or Firefox browser.
3rd app would be mobile client which will be running on mobile which will stream camera output to PC using WebRTC. Drawback of this solution is that this solution would be not real-time, because user have to use two separate interface for Screen capture have to use PC Chrome or Firefox browser, and after screen capture have to move back to PC application.
My understanding is that It’s not possible to have Server less solution for WebRTC, Signaling server will require, I found some of open source WebRTC servers i.e. Easyrtc, signalmaster which I have to use and have to configure in own environment.
As this is my first WebRTC based project, so would like to know your opinion about Solution which i am thinking, is it right or is there any better way to achieve it.
Thanks
Suresh
Hi suresh IOS not support WebRTC,But its possible in android
My option is Node-webkit(desktop app using HTML 5,Javascript,css3,Nodejs,NPM)
https://github.com/rogerwang/node-webkit/wiki
mobile app(intel xdk ) but ios not support WebRTC
http://xdk-software.intel.com/
You could use Twilio Video to do this.
You can build multi-party video calling into both web and native applications with the SDKs for:
JavaScript
iOS
Android
https://www.twilio.com/docs/api/video
You will also find the server-side starter apps in various languages you need to get started quickly.
In my preferred language example Python, a small Flask app handles token creation to handle user access for video conversations in app.py and the basic WebRTC functions can be found in quickstart.js.
Note: I work for Twilio.

Native Mobile App Secure Bridge to Hosted Content

I would greatly appreciate some help with the following problem.
I am attempting to build an app with HTML/CSS/JQM that I plan to wrap with PhoneGap to package as a native app for deployment on Android & iOS Platforms.
The app will be basically a form for users to input information which upon submit will be posted to an email using PHP on our web server. It is of the utmost importance that the information is encrypted between the user device and our web server.
I have planned to do this by having a single terms & conditions page packaged with the native app, with the 'accept' button loading the 'form' page on the web server.
I would like to make it impossible to access the hosted 'form' page via a web browser (i.e. the only way to access the page is via the native app).
What I would like to do is to have the native app automatically log in to the web server, so that the user does not have to go through a registration process.
I have considered using Wordpress, Drupal or Joomla as a solution but as there will only ever be a single html page, jquery, jqm and php form submission scripts on the server - this seems overcomplicated.
It is very important that the hosted files are unable to be hacked as the user information being submitted is of a sensitive nature (e.g. financial information). Also the connection between the native app and the host server must be SSL.
Would a .htaccess / .htpasswd restriction be the best way to go about this?
Any advice would be greatly appreciated, thanks.

Embedded bookmark in J2ME app

Does anyone know if this is possible in J2ME;
I want to have an app that simply launches a browser when opened and directs the browser to a specific web page.
If so, is it widely supported.
You can use javax.microedition.midlet.MIDlet.platformRequest() to launch the browser on almost all phones that support JavaME. This article tells more about invoking platform services such as browser.

Redirecting for mobile web browsers

Is there a way to redirect for mobile web pages; and what is the best layout for mobile browsers? I currently have my pages set to relative sizing via percentages.
Take a look at WURFL. It will give you information on mobile device's capabilities that you will be able to use to render your mobile pages accordingly.
It has binging for a lot of server side languages, including, but not limited to, PHP, ASP.NET and Java.
You will configure your web application to include information about the device for each request. You will use that information to render mobile web pages.
You can also use Categorizr. It's been tested against data in WURFL and can detect mobile devices, tablets, smartTVS, and desktops.

Resources