Kal – Medium

Published in Mobis3c

·Apr 8

Exploiting Android’s Task Hijacking

Introduction In 2015, at USENIX, task hijacking and its impact on Android were first presented. It’s an attack in which a malicious app takes over the vulnerable app’s “back stack,” and whenever the user tries to access the vulnerable app, he’ll be met by the malicious app’s activity instead. Tasks…

Android Security

4 min read

Published in Mobis3c

·Jul 20, 2021

Deep Link Exploitation: Introduction & Open/unvalidated Redirection

What is a Deep Link? A deep link is a link that takes you to a specific content. Most web links are deep links. Ex: Link & Deep Link

Deep Link Android

6 min read

Deep Link Exploitation: Introduction & Open/unvalidated Redirection

Published in Mobis3c

·Apr 4, 2021

Exploiting Android WebView Vulnerabilities

What is WebView? The WebView class is an extension of Android's View class that allows you to display web pages as a part of your activity layout. It does not include any features of a fully developed web browser, such as navigation controls or an address bar. …

Android Security

6 min read

Exploiting Android WebView Vulnerabilities

Published in Mobis3c

·Mar 26, 2021

Exploiting Apps vulnerable to Janus (CVE-2017–13156)

CVE-2017–13156 A serious vulnerability in Android allows attackers to inject a DEX file into an APK file without affecting the signatures. (i.e. modify the code in applications without affecting their signatures.) This can be exploited due to the problem, that a Android Package file can be a valid APK file and…

Android Security

7 min read

Exploiting Apps vulnerable to Janus (CVE-2017–13156)

Published in Mobis3c

·Feb 12, 2021

Insecure Data Storage: Insecure Logging & Storage

Before we get started, make sure you have genymotion setup ready. if not follow this guide to setup & configure the genymotion in Linux. PID Cat Process ID (PID) Cat is a logcat script which only shows log entries for processes from a specific application package. Installing PID Cat: #Download pidcat &…

Android Security

5 min read

Insecure Data Storage: Insecure Logging & Storage

Published in WebAppS3c

·Feb 6, 2021

Web Cache Poisoning

Web Cache If a server had to send a new response to every single HTTP request separately, this would likely overload the server, resulting in latency issues and a poor user experience, especially during busy periods. Caching is primarily a means of reducing such issues. The cache sits between the server and…

Web Cache

6 min read

Published in Mobis3c

·Feb 4, 2021

Setting up an Android Pentesting Environment

Android pentesting requires a dedicated environment which provides access to a rooted android device and let us see how to setup easily by using free tools. Android Virtual Device We will be using AVD which is the default emulator provided by the android studio. …

Android Security

5 min read

Setting up an Android Pentesting Environment

Published in Mobis3c

·Feb 4, 2021

Insecure Data Storage: Clear Text Storage of Sensitive Information (Hard-coded strings, credentials, tokens & keys)

Before we get started, we need to have the apk which can be extracted from the device by installing the application through the play store or by downloading the apk from online sources. For practical, we will be looking for hardcoded google api key. Now, let’s start analyzing the application…

Mobile Security

3 min read

Insecure Data Storage: Clear Text Storage of Sensitive Information (Hard-coded strings…

Published in Mobis3c

·Feb 1, 2021

Introduction to Android Security

Overview of Android Architecture Android is an open source, Linux-based software stack created for a wide array of devices and form factors. The following diagram shows the major components of the Android platform.

Security

6 min read

Published in WebAppS3c

·Jan 21, 2021

Security Assertion Markup Language (SAML)

SAML is an open standard that allows identity providers (IdP) to pass authorization credentials to service providers (SP). Which means that you can use one set of credentials to log into many different websites. …

Saml

3 min read