Fake a client camera for a web application in the desktop browser

Question

I'm testing a web application, where I came across a button. This button is supposed to start the client's camera application and then allow the user to upload a photo.

As I am testing from a virtual machine, there is no camera application and therefore the button simply does nothing for me.

After some research, I believe that the web application is built with/on cordova. I do have access to the JavaScript, which I believe, is responsible for the button action - but I can not share the code.

In summary this is what happens:

 var client_camera = navigator.camera;
 client_camera.getPicture(...)

Is there some way to make the browser/web application think that I do have a camera/camera application and thereby enable the upload of such a picture?

edit: Documentation of the discovered function can be found here

Albeit being relevant for a penetration test, I believe you're right. In hindsight, this would be better suited for StackOverflow. — SaAtomic, Jun 20 '17 at 11:48
just call the camera callback directly, mocking an event object w/the props needed for app consumption. — dandavis, Jun 20 '17 at 18:19

score 1 · Answer 1 · answered Jun 20 '17 at 12:08

1

You can't bypass the camera action.

Anyway, navigator is an Object contains the client details (browser, OS & some components like camera, flash, etc.)

All I can suggest here is

Check if there is a camera.

If yes, use it.

If not, add a default file uploader

The code

if(navigator.camera){
  //camera is there add the code to capture from camera
}
else{
  var file=document.createElement('input');
  file.set attribute('type','file');
  //append it to the container div or body
  // assume that you have a div with class container
 document.querySelector('div.container').appendChild(file);

Then you can initiate the upload process while the file is choosen by using a change event Handler on the input element

answered Jun 20 '17 at 12:08

Sagar V

12,158
7
41
68

Thank you for the suggestion. I'm not trying to write an application that handles the scenario, but I'm attempting to spoof a the navigator.camera element on my desktop. – SaAtomic Jun 20 '17 at 12:12
For that , there is no direct way. you may want to use some third party apps. – Sagar V Jun 20 '17 at 12:31
Are you aware of any such third party apps? – SaAtomic Jun 20 '17 at 12:56
cordova is used for mobile. do you want an android application? then this post may help https://android.stackexchange.com/a/124752/209927 @SaAtomic – Sagar V Jun 20 '17 at 12:59
As stated before, I'm trying to spoof the camera on the desktop browser. Firefox on Linux – SaAtomic Jun 20 '17 at 13:00
so. your virtual platform is browser. not an emulator right. Wait let me check it. – Sagar V Jun 20 '17 at 13:01
what did you get while typing `navigator.camera` in the console? – Sagar V Jun 20 '17 at 13:02
`var a = navigator.camera; undefined` – SaAtomic Jun 20 '17 at 13:04
that's it. browsers didn't have the property. `navigator.camera`. It is specifically for mobile devices only when running in cordova. That is the apache cordova will handle the request. – Sagar V Jun 20 '17 at 13:05
Please wait while I try to find a workaround for you. – Sagar V Jun 20 '17 at 13:06

Fake a client camera for a web application in the desktop browser

1 Answers1