URI Spoofing in Facebook Messenger for iOS and Android

This repository demonstrates a proof-of-concept exploit for RTLO (Right-To-Left Override) injection URI spoofing vulnerabilities affecting several popular messaging applications, including WhatsApp, iMessage, Instagram, Facebook Messenger, and Signal. The exploit targets CVE-2020-20093, CVE-2020-20094, CVE-2020-20095, and CVE-2020-20096, and is effective against specific versions of these apps on both iOS and Android platforms. The repository contains two main exploit files: - 'exploit.sh': A Bash script that generates spoofed URLs by combining a legitimate-looking prefix (https://legit.okay/files) with a set of attacker-controlled domains, inserting the Unicode RTLO character to reverse the display order of the URL. The output is a set of links that, when pasted into a vulnerable messaging app, appear to be legitimate but actually direct the user to a malicious site. - 'poc.py': A Python script that takes a legitimate website and an attacker website as arguments, and outputs a single spoofed link using the RTLO technique. This script allows for custom input and demonstrates the same vulnerability in a more flexible way. The exploit does not deliver a payload in the traditional sense (e.g., shellcode or remote code execution), but rather manipulates the visual representation of links to facilitate phishing or social engineering attacks. The endpoints involved are attacker-controlled domains and a legitimate-looking URL prefix. The exploit is a proof-of-concept and requires the attacker to send the crafted link to a victim via a vulnerable messaging app.