KitPloit - PenTest Tools!
Allsafe - Intentionally Vulnerable Android Application

https://1.bp.blogspot.com/-a1eWrvdtZ_U/YO94HY5o7NI/AAAAAAAAjQ8/9yuaKAqM6nI2zyQobqBp_dszsd4Tm1HkQCNcBGAsYHQ/s0/allsafe_1_ic_launcher_round.png Allsafe is an intentionally vulnerable application that contains various vulnerabilities. Unlike other vulnerable Android apps, this one is less like a CTF and more like a real-life application that uses modern libraries and technologies. Additionally, I have included some Frida based challenges for you to explore. Have fun and happy hacking! Useful Frida ScriptsI have my Frida scripts (more like templates) in other repository. I'm sure they might be quite handy for the Frida related tasks. Check it out: https://github.com/t0thkr1s/frida Tasks / Vulnerabilities1. Insecure LoggingSimple information disclosure vulnerability. Use the logcatcommand-line tool to discover sensitive information. Resources & HackerOne Reports:* Logcat Tool
* Coinbase OAuth Response Code Leak 2. Hardcoded CredentialsSome credentials are left in the code. Your task is to reverse engineer the app and find sensitive information. Resources & HackerOne Reports:* Zomato Hardcoded Credentials
* 8x8 Hardcoded Credentials
* Reverb Hardcoded API Secret 3. Root DetectionThis is purely for Frida practice. Make the code believe that you device is not rooted! 4. Arbitrary Code ExecutionLoading modules securely with third-party apps are not easy. Write a PoC application and exploit the vulnerability! Resources & HackerOne Reports:* Arbitrary Code Execution via Third-Party Package Contexts 5. Secure Flag BypassAnother Frida-based task. No real vulnerability here, just have fun bypassing the secure flag! Resources & HackerOne Reports:* Android FLAG_SECURE Reference 6. Certificate Pinning BypassCertificate pinning is implemented using the OkHttp library. You have to bypass it in order to view the traffic with Burp Suite. Resources & HackerOne Reports:* Certificate and Public Key Pinning
* Coinbase Vulnerabilities 7. Insecure Broadcast ReceiverThere's a vulnerable broadcast recevier in the application. Trigger it with the correct data and you're done! Resources & HackerOne Reports:* Android Broadcasts Overview
* ok.ru Broadcast Receiver Exploitation
* Bitwarden Vulnerable Broadcast Receiver 8. Deep Link ExploitationSimilar to the insecure broadcast receiver, you need to provide the right query parameter to complete this task! Resources & HackerOne Reports:* Android Deep Linking
* Grab Insecure Deep Link
* Periscope Deep Link CSRF 9. SQL InjectionJust a regular SQL injection that you'd find in web applications. No need to reverse the code to bypass the login mechanism. Resources & HackerOne Reports:* SQL Injection in Content Provider
Show me how it's done!
# TODO 10. Vulnerable WebViewYou can also complete this task without decompiling the application. Pop an alert dialog and read files! Resources & HackerOne Reports:* ownCloud WebView XSS 11. Smali PatchingIn this task, you have to modify the execution flow of the application by editing the Smali code. Finally, rebuild and sign the APK! Resources & HackerOne Reports:* Uber APK Signer 12. Native LibraryThe application uses a native library that validates the entered password. Reverse engineer the library to find the password then use Frida to hook the native method. Resources & HackerOne Reports:* Ghidra
* Cutter Download Allsafe

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
Este nuevo malware se esconde entre las exclusiones de Windows Defender para evadir la detección.

https://cdn-images-1.medium.com/max/781/0*pAzqlQ3j9AmoR8kK
POR EHACKING

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
Make Your Pc Notify Your Phone Whenever There is Movement Around it

https://cdn-images-1.medium.com/max/2600/0*5qc-p-DwzRSfaBkq
Money-free make your home more secure just using your pc

Continue reading on Dev Genius »

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
how to ransom the devil

churchofsatan.com forgot to pay domain registration. Praise Jesus

submitted by /u/Yahushuah
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
Keylogger

Ok so i was thinking about a potentially good project to start on so i fell down an internet rabbit hole and stumbled upon the idea of making a 2.4 ghz wireless keylogger. I was wondering what some potential issues i might run into on this project. are ive seen a lot of code on other simular projects and it seems like its just a matter of capturing the packets finding a means of decrypting the keypress depending on the keyboard being used and matching these outputs to keys that the program would either write in a terminal text document or both. I mean it might take me a while because my python skills could use some work but i imagine its doable.

submitted by /u/deathreaper1129
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
Review del eCPPTv2 de eLearnSecurity

https://cdn-images-1.medium.com/max/800/1*2T4CXnmbFXR4PX9XpBSAOg.png
El 28 de Enero del 2020 obtuve la certificación eJPT de eLearnSecurity, si no has visto el review dale clic aquí, y al siguiente mes en…

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

PolyBunny Prioritizes Security with $250,000 Bug Bounty
https://medium.com/immunefi/polybunny-prioritizes-security-with-250-000-bug-bounty-80e88837a526?source=rss------bug_bounty-5

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
US charges Chinese security officers in global cyberattack that sought to bolster PRC, state-owned…

https://cdn-images-1.medium.com/max/2000/1*1Oug3upaTV5Qg6EibOrqrQ.png
Four Chinese citizens were indicted in an alleged global cyberattack campaign that victimized dozens of universities, companies, and…

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

PolyBunny, a yield farming aggregator and optimizer on the Polygon network, is joining Immunefi with a $250,000 bug bounty to invite…Continue reading on Immunefi » (https://medium.com/immunefi/polybunny-prioritizes-security-with-250-000-bug-bounty-80e88837a526?source=rss------bug_bounty-5)

___________________________
@hacking_Attack
@Hacking_Video

PolyBunny Prioritizes Security with $250,000 Bug Bounty

PolyBunny, a yield farming aggregator and optimizer on the Polygon network, is joining Immunefi with a $250,000 bug bounty to invite…Continue reading on Immunefi »
Read more...

hacking: security in practice
/r/hacking wiki: Rules, FAQ, and How to Get Started. Read this First.

submitted by /u/misconfig_exe
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
is it possible to get into Ford's SYNC system?

I have some old cars on the property that I have been thinking about messing with. I wanted to know if any of you have ever messed with the OS on a car? Specifically older ford (2000-2010) models that have the SYNC system installed on it?

My main goal is to shut of the "Would you like to run a diagnostic report?" prompt that comes up once a drive lol and a few other annoying voice prompts that they have baked in...it's gotta be an USB port or something somewhere under the infotainment console right?

submitted by /u/LilRee12
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video