Forwarded from Android Security & Malware
A step-by-step guide to writing an iOS kernel exploit
https://alfiecg.uk/2024/09/24/Kernel-exploit.html
https://alfiecg.uk/2024/09/24/Kernel-exploit.html
Alfie CG
A step-by-step guide to writing an iOS kernel exploit
Introduction Memory management in XNU Page tables Physical use-after-free Exploitation strategy Heap spray Kernel memory read/write Conclusion Bonus: arm64e, PPL and SPTM
Breaking through the cage: Get Android Universal Root by B-PUAF
https://powerofcommunity.net/poc2024/Hanqin%20Ling%20&%20Yutao%20Lu,%20Breaking%20through%20the%20cage%20-%20Get%20Android%20Universal%20Root%20by%20B-PUAF.pdf
https://powerofcommunity.net/poc2024/Hanqin%20Ling%20&%20Yutao%20Lu,%20Breaking%20through%20the%20cage%20-%20Get%20Android%20Universal%20Root%20by%20B-PUAF.pdf
Forwarded from Android Security & Malware
GPUAF - Two ways of Rooting All Qualcomm based Android phones
https://powerofcommunity.net/poc2024/Pan%20Zhenpeng%20&%20Jheng%20Bing%20Jhong,%20GPUAF%20-%20Two%20ways%20of%20rooting%20All%20Qualcomm%20based%20Android%20phones.pdf
https://powerofcommunity.net/poc2024/Pan%20Zhenpeng%20&%20Jheng%20Bing%20Jhong,%20GPUAF%20-%20Two%20ways%20of%20rooting%20All%20Qualcomm%20based%20Android%20phones.pdf
https://www.youtube.com/watch?v=YeyK5pPxD5c
https://www.nohat.it/slides/2024/mao.pdf
https://github.com/HexHive/scudo-exploitation
https://www.nohat.it/slides/2024/mao.pdf
https://github.com/HexHive/scudo-exploitation
YouTube
No Hat 2024 - Philipp Mao - Exploiting Android's Hardened Memory Allocator
EXPLOITING ANDROID'S HARDENED MEMORY ALLOCATOR
Most memory corruptions occur on the heap. To harden userspace applications and prevent heap-based exploitation, Google has developed Scudo. Since Android 11, Scudo has replaced jemalloc as the default heap…
Most memory corruptions occur on the heap. To harden userspace applications and prevent heap-based exploitation, Google has developed Scudo. Since Android 11, Scudo has replaced jemalloc as the default heap…
🔥2
This Video Can Exploit Your iPhone (CVE-2025-31200)
https://youtu.be/nTO3TRBW00E
https://youtu.be/nTO3TRBW00E
YouTube
This Video Can Exploit Your iPhone (CVE-2025-31200 #1)
Are you a security researcher or reverse engineer?
For 50% off IDA Products use promo code BILLY50, https://hex-rays.com/pricing *
For 30% off IDA Training use promo code BILLY30, https://hex-rays.com/training **
*License discounts are only valid for individuals…
For 50% off IDA Products use promo code BILLY50, https://hex-rays.com/pricing *
For 30% off IDA Training use promo code BILLY30, https://hex-rays.com/training **
*License discounts are only valid for individuals…
😁1
Pwning S24, Pwn2own Ireland 2024
https://youtu.be/LAIr2laU-So
https://youtu.be/LAIr2laU-So
YouTube
OffensiveCon25 - Ken Gannon- Chainspotting 2: The Unofficial Sequel to the 2018 Talk “Chainspotting”
👍1
Forwarded from Android Security & Malware
Vulnerabilities Found in Preinstalled apps on Android Smartphones
3rd party app installed on a device could misuse vulnerabilities to:
✅perform factory reset of device
✅exfiltrate PIN code
✅inject an arbitrary intent with system-level privileges
https://www.mobile-hacker.com/2025/06/02/security-issues-found-in-android-smartphones/
3rd party app installed on a device could misuse vulnerabilities to:
✅perform factory reset of device
✅exfiltrate PIN code
✅inject an arbitrary intent with system-level privileges
https://www.mobile-hacker.com/2025/06/02/security-issues-found-in-android-smartphones/
Mobile Hacker
Security Issues Found in preinstalled apps on Android Smartphones - Mobile Hacker
Security researchers have uncovered several critical vulnerabilities in applications preloaded on Ulefone and Krüger&Matz Android smartphones. These flaws, reported by CERT Polska and discovered by Szymon Chadam, expose users to significant risks, including…
FreeTechMods
This Video Can Exploit Your iPhone (CVE-2025-31200) https://youtu.be/nTO3TRBW00E
Corrupting IOS Heap Memory With a Malicious Audio Stream
(CVE-2025-31200) https://youtu.be/RWjpM0zDJVA
(CVE-2025-31200) https://youtu.be/RWjpM0zDJVA
YouTube
This Video Can Exploit Your iPhone (pt. 2) The Memory Corruption Primitive
Are you a security researcher or reverse engineer?
For 50% off IDA Products use promo code BILLY50, https://hex-rays.com/pricing *
For 30% off IDA Training use promo code BILLY30, https://hex-rays.com/training **
*License discounts are only valid for individuals…
For 50% off IDA Products use promo code BILLY50, https://hex-rays.com/pricing *
For 30% off IDA Training use promo code BILLY30, https://hex-rays.com/training **
*License discounts are only valid for individuals…
Samsung S24 Exploit Chain Pwn2Own 2024 Walkthrough
https://medium.com/@happyjester80/samsung-s24-exploit-chain-pwn2own-2024-walkthrough-c7a3da9a7a26
https://medium.com/@happyjester80/samsung-s24-exploit-chain-pwn2own-2024-walkthrough-c7a3da9a7a26
Medium
Samsung S24 Exploit Chain Pwn2Own 2024 Walkthrough
بِسْمِ اللَّـهِ الرَّحْمَـٰنِ الرَّحِيمِ
Practical guide to fuzzing the Binder kernel driver using the Linux Kernel Library (LKL)
https://androidoffsec.withgoogle.com/posts/binder-fuzzing/
https://androidoffsec.withgoogle.com/posts/binder-fuzzing/
Withgoogle
Binder Fuzzing - Android Offensive Security Blog
In our previous blog posts, we explored Android Binder’s intricacies, from exploiting a vulnerability (CVE-2023-20938) for kernel code execution to examining its inner workings. In this post, we shift our focus to finding vulnerabilities in the Binder kernel…
What a ride guys. It's been a while now😂😂, since I gave back to the community. I'll be sharing some of the free internet tricks that we used to use pre-2020. I bet some of them still work.
URL Manipulation for Zero-Rated Hosts
This method used to exploit ISP's zero-rated hosts (e.g., safaricom.zerod.live) by appending the real destination site to the URL in formats like freehost.anysite.com, freehost/anysite.com, or freehost@anysite.com. The ISP's proxy would see the request starting with the free host, allow it without charging data. The appended site would load inside the free connection (used to work best on old WAP browsers or Opera Mini).
This method used to exploit ISP's zero-rated hosts (e.g., safaricom.zerod.live) by appending the real destination site to the URL in formats like freehost.anysite.com, freehost/anysite.com, or freehost@anysite.com. The ISP's proxy would see the request starting with the free host, allow it without charging data. The appended site would load inside the free connection (used to work best on old WAP browsers or Opera Mini).
Forwarded from Android Security & Malware
Careless Whisper: Exploiting Silent Delivery Receipts to Monitor Users on Mobile Instant Messengers
PoC: https://github.com/Cfomodz/whatsmap
Paper: https://arxiv.org/html/2411.11194v4
PoC: https://github.com/Cfomodz/whatsmap
Paper: https://arxiv.org/html/2411.11194v4
GitHub
GitHub - Cfomodz/whatsmap: Maps WhatsApp via API
Maps WhatsApp via API. Contribute to Cfomodz/whatsmap development by creating an account on GitHub.
❤1