Bypass Instagram and Threads SSL pinning on Android
You can download already patched APKs for none-rooted devices, patch APK using Python noscript yourself, or download Frida bypass noscript for rooted Android
https://github.com/Eltion/Instagram-SSL-Pinning-Bypass
You can download already patched APKs for none-rooted devices, patch APK using Python noscript yourself, or download Frida bypass noscript for rooted Android
https://github.com/Eltion/Instagram-SSL-Pinning-Bypass
GitHub
GitHub - Eltion/Instagram-SSL-Pinning-Bypass: Bypass Instagram SSL pinning on Android devices.
Bypass Instagram SSL pinning on Android devices. Contribute to Eltion/Instagram-SSL-Pinning-Bypass development by creating an account on GitHub.
👍16❤6👏1
Reverse Engineering Android game Coin Hunt World and its communication protocol to cheat the app. Bug reported and fixed
https://research.nccgroup.com/2023/05/31/reverse-engineering-coin-hunt-worlds-binary-protocol/
https://research.nccgroup.com/2023/05/31/reverse-engineering-coin-hunt-worlds-binary-protocol/
👍7❤1
In details slides explaining exploitation of binder kernel use-after-free (UAF) vulnerability in the Android kernel (CVE-2022-20421) to achieves full kernel R/W
Affected devices: devices running Kernel version 5.4.x and 5.10.x
Slides: https://0xkol.github.io/assets/files/OffensiveCon23_Racing_Against_the_Lock__Exploiting_Spinlock_UAF_in_the_Android_Kernel.pdf
Research: https://0xkol.github.io/assets/files/Racing_Against_the_Lock__Exploiting_Spinlock_UAF_in_the_Android_Kernel.pdf
PoC: https://github.com/0xkol/badspin
Affected devices: devices running Kernel version 5.4.x and 5.10.x
Slides: https://0xkol.github.io/assets/files/OffensiveCon23_Racing_Against_the_Lock__Exploiting_Spinlock_UAF_in_the_Android_Kernel.pdf
Research: https://0xkol.github.io/assets/files/Racing_Against_the_Lock__Exploiting_Spinlock_UAF_in_the_Android_Kernel.pdf
PoC: https://github.com/0xkol/badspin
🔥9👍3
Tutorial on how to build NetHunter image for OnePlus 7 Pro
Kali NetHunter supports 89 Android models, however, offers to download up to 32 precompiled images.
Because of that, for 57 devices, users must manually build an installation image
https://www.mobile-hacker.com/2023/07/24/nethunter-hacker-iii-how-to-build-kali-nethunter-for-oneplus-7-pro/
Kali NetHunter supports 89 Android models, however, offers to download up to 32 precompiled images.
Because of that, for 57 devices, users must manually build an installation image
https://www.mobile-hacker.com/2023/07/24/nethunter-hacker-iii-how-to-build-kali-nethunter-for-oneplus-7-pro/
Mobile Hacker
NetHunter Hacker III: How to build Kali NetHunter for OnePlus 7 Pro Mobile Hacker
In previous posts we went through installation process of rootless and rooted NetHunter on OnePlus 7 device, using already pre-compiled image from Kali website. Since the OnePlus 7 is a preferred high-end device by NetHunter, its image is already compiled…
👍13❤6😱4🤔1
Writing your first Frida noscript for Android
https://labs.cognisys.group/posts/Writing-your-first-Frida-noscript-for-Android/
https://labs.cognisys.group/posts/Writing-your-first-Frida-noscript-for-Android/
Cognisys Group Labs
Writing your first Frida noscript for Android
Overview
👍9🙏1
Recent leaked source code of Android banking Trojan Hook
Leak contains build panel & APK source code.
Hook can VNC into victim device and using accessibility services automatically extract seed phrases from cryptocurrency wallets.
https://github.com/0xperator/hookbot_source
Leak contains build panel & APK source code.
Hook can VNC into victim device and using accessibility services automatically extract seed phrases from cryptocurrency wallets.
https://github.com/0xperator/hookbot_source
GitHub
GitHub - 0xperator/hookbot_source: This repository contains a few leaked files of HookBot.
This repository contains a few leaked files of HookBot. - 0xperator/hookbot_source
👍16❤1👎1
A guide that provides practical knowledge for understanding Android Smali code
Includes video demo and APK challenge
https://www.linkedin.com/pulse/android-static-analysis-fundamentals-smali-code-introduction
Includes video demo and APK challenge
https://www.linkedin.com/pulse/android-static-analysis-fundamentals-smali-code-introduction
Linkedin
Android Static Analysis Fundamentals: Smali Code Introduction and Modifications
TL;DR: Discover the power of Smali code, a vital skill for Android app analysis and reverse engineering apps. Unveil an app’s inner workings and spot security vulnerabilities with ease.
👍13❤2🔥1
Investigating SMS phishing text messages from scratch
https://blog.bushidotoken.net/2023/07/investigating-sms-phishing-text.html
https://blog.bushidotoken.net/2023/07/investigating-sms-phishing-text.html
blog.bushidotoken.net
Investigating SMS phishing text messages from scratch
CTI, threat intelligence, OSINT, malware, APT, threat hunting, threat analysis, CTF, cybersecurity, security
👍10❤2🔥2
Mobile App Pentesting: AndroGOAT
Walk-through popular vulnerabilities such as Unprotected Android Components, Insecure data storage, SQL injection, XSS, file access via WebView, keyboard leaks, insecure logging, etc. https://infosecwriteups.com/mobile-pentesting-androgoat-assessment-walkthrough-1a63a7edc677
Walk-through popular vulnerabilities such as Unprotected Android Components, Insecure data storage, SQL injection, XSS, file access via WebView, keyboard leaks, insecure logging, etc. https://infosecwriteups.com/mobile-pentesting-androgoat-assessment-walkthrough-1a63a7edc677
Medium
Mobile App Pentesting: AndroGOAT Assessment Walkthrough
Have you ever wondered about the vulnerabilities hidden beneath the surface of your favorite mobile apps? I certainly did, which is why I…
👍18❤1
NetHunter Hacker IV: Introduction to NetHunter system
In the blog you find out how to setup custom NetHunter commands, Kali services, install additional metapackages and wireless firmware for NetHunter
https://www.mobile-hacker.com/2023/07/27/nethunter-hacker-iv-introduction-to-nethunter-system/
In the blog you find out how to setup custom NetHunter commands, Kali services, install additional metapackages and wireless firmware for NetHunter
https://www.mobile-hacker.com/2023/07/27/nethunter-hacker-iv-introduction-to-nethunter-system/
Mobile Hacker
NetHunter Hacker IV: Introduction to NetHunter system Mobile Hacker
In previous posts we went through installation of NetHunter on almost any non-rooted and supported rooted Android device. If your device is among NetHunter supported smartphones, however, a prebuild image is not available on the NetHunter website; I explained…
👍23❤6👏2🥰1
Related CherryBlos and FakeTrade Android Malware Involved in Scam Campaigns
https://www.trendmicro.com/en_us/research/23/g/cherryblos-and-faketrade-android-malware-involved-in-scam-campai.html
https://www.trendmicro.com/en_us/research/23/g/cherryblos-and-faketrade-android-malware-involved-in-scam-campai.html
Trend Micro
Related CherryBlos and FakeTrade Android Malware Involved in Scam Campaigns
Trend Micro’s Mobile Application Reputation Service (MARS) team discovered two new related Android malware families involved in cryptocurrency-mining and financially-motivated scam campaigns targeting Android users.
👍12🔥1🤔1
Analysis of Coper Android banking trojan dropper discovered on Google Play as "PDF ProView FManager"
https://medium.com/@themalwarebug/analysis-of-undetected-dropper-on-playstore-20bd6f064440
https://medium.com/@themalwarebug/analysis-of-undetected-dropper-on-playstore-20bd6f064440
Medium
Analysis of undetected dropper on Playstore aka Coper
Hello everyone,I hope all are doing well.
First of all thank you everyone for huge support given for the writeup on Joker malware.If you…
First of all thank you everyone for huge support given for the writeup on Joker malware.If you…
👍11❤4🤔1
APT Bahamut Targets Individuals with Android Malware Using Spear Messaging
https://www.cyfirma.com/outofband/apt-bahamut-targets-individuals-with-android-malware-using-spear-messaging/
https://www.cyfirma.com/outofband/apt-bahamut-targets-individuals-with-android-malware-using-spear-messaging/
CYFIRMA
APT Bahamut Targets Individuals with Android Malware Using Spear Messaging - CYFIRMA
EXECUTIVE SUMMARY The team at CYFIRMA recently obtained advanced Android malware targeting individuals in the South Asia region. The suspicious...
🔥8👍4🤡2❤1
NetHunter Hacker V: How to use MAC Changer, KeX and setup USB Arsenal
https://www.mobile-hacker.com/2023/08/01/nethunter-hacker-v-how-to-use-mac-changer-kex-and-setup-usb-arsenal/
https://www.mobile-hacker.com/2023/08/01/nethunter-hacker-v-how-to-use-mac-changer-kex-and-setup-usb-arsenal/
Mobile Hacker
NetHunter Hacker V: How to use MAC Changer, KeX and setup USB Arsenal Mobile Hacker
Welcome to a next blog that focuses on NetHunter tools. In a previous post, I introduced the NetHunter apps that are preinstalled, and a few tools that are available in the NetHunter application. I hope that through this article, you will gain a deeper understanding…
👍13👏3
Android SpyNote continues to attack financial institutions distributing via fake SMS messages
https://www.cleafy.com/cleafy-labs/spynote-continues-to-attack-financial-institutions
https://www.cleafy.com/cleafy-labs/spynote-continues-to-attack-financial-institutions
Cleafy
SpyNote continues to attack financial institutions | Cleafy Labs
Discovered at the end of 2022, SpyNote is now executing an extensive campaign against multiple European customers of different banks. Read the technical analysis to know all his functionalities and how to prevent it.
👍10🤔1
Advanced Frida Usage Part 4 – Sniffing location data from locations in iOS
https://8ksec.io/advanced-frida-usage-part-4-sniffing-location-data-from-locationd-in-ios/
https://8ksec.io/advanced-frida-usage-part-4-sniffing-location-data-from-locationd-in-ios/
8kSec - 8kSec is a cybersecurity research & training company. We provide high-quality training & consulting services.
Advanced Frida Usage Part 4 – Sniffing Location Data From Locationd In OS
In Part 4, Learn the intricate process of sniffing and manipulating location data on iOS using Frida. Read more to learn
👍9
How to attack (and secure) an Android app: An introduction
Presentation: https://www.droidcon.com/2023/07/31/how-to-attack-and-secure-an-android-app-an-introduction/
CTF apk: https://github.com/badolphi/droidcon-berlin
Slides: https://github.com/badolphi/droidcon-berlin/blob/main/Presentation.pdf
Presentation: https://www.droidcon.com/2023/07/31/how-to-attack-and-secure-an-android-app-an-introduction/
CTF apk: https://github.com/badolphi/droidcon-berlin
Slides: https://github.com/badolphi/droidcon-berlin/blob/main/Presentation.pdf
droidcon
How to attack (and secure) an Android app: an introduction
Android applications can be attacked in a multitude of ways. This workshop will give an introduction to some of the most popular attacks. It will explain how the attacks work in theory, demonstrate how they can be done in practice, with which tools, and discuss…
👍13❤5
Interesting network traffic interception method. Should work for Xamarin and Dart made apps.
Smartphone (OpenVPN) -> VPN server -redirection-> BurpSuite
https://bhavukjain.com/blog/2023/02/19/capturing-requests-non-proxy-aware-application
Smartphone (OpenVPN) -> VPN server -redirection-> BurpSuite
https://bhavukjain.com/blog/2023/02/19/capturing-requests-non-proxy-aware-application
Bhavukjain
Capturing HTTP Requests from a non-proxy-aware Mobile Application | bhavukjain1
UPDATE - This post has been updated to include a stable set of NAT rules for iptables. Mobile applications are becoming increasingly…
👍11❤1⚡1
Finding backup vulnerabilities in Android apps
✅android:allowBackup="true"
https://medium.com/@vishwaraj101/finding-backup-vulnerabilities-in-android-apps-6b87330f97b3
✅android:allowBackup="true"
https://medium.com/@vishwaraj101/finding-backup-vulnerabilities-in-android-apps-6b87330f97b3
Medium
Finding backup vulnerabilities in android apps
Hi everyone this post is just an elaboration of the 10th point that I made it in my previous post which is being often missed by…
👍13❤4🤔2
Extracting User Locations by Analyzing SMS Timings
https://arxiv.org/abs/2306.07695
https://arxiv.org/abs/2306.07695
🔥12👍2