This article presents the analysis of Digital Private Vault Android application, highlighting some bad practices and vulnerabilities in the product that can be exploited to completely subvert the purpose of the vault, finally exposing the secrets stored inside it.
In this video, we dive into OSINT and GeoGuessr-like CTFs solving every OSINT challenge from the UMDCTF 2023. During the process, I show you how to solve all the challenges while sharing some basic techniques to identify publicly available information and basic advice for GeoGuessr-like challenges.
This blog post presents a detailed analysis of two successful account takeover scenarios resulting from vulnerabilities in a forgot password implementation. I explore techniques involving anti-tampering token prediction and time-based/sandwich attacks.
In this post, we explore different ways to create a fully working environment for Android Penetration Testing and we create our setup using the SDK provided by Google (without installing Visual Studio). Then, we set up the environment to allow communication between Android Virtual Devices and any other VMs. Finally, we explore how to import custom user certificates to intercept HTTPS requests on any version of Android.
HackTheBox "WAFfle-y_Order" wirteup is now available!
hxp 2022 "valentine" wirteup is now available!
Improved skills: Wordlist customization Python coding CVE Research Manual Exploitation Configuration file review Used tools: nmap gobuster cewl Burp Suite crackstation.net...
HackTheBox "Noter" wirteup is now available!
HackTheBox "AdmirerToo" wirteup is now available!
Armageddon is a Easy difficulty Linux box based on a Drupal application vulnerable to Drupalgeddon2 (CVE-2018-7600)