Aditya Srivastava

Security Researcher
Helping people to be safe 🤠

[JS0N Haddix @Jhaddix]

Giveaway time!

Up for grabs is 3 free tickets to our “Attacking AI” live course!

Repost and like to enter!

https://t.co/cp2y6DDxqp

[JS0N Haddix @Jhaddix]

Next hacker summer camp giveaway!

3 seats to our “The Bug Hunters Methodology” course!

Like and share to be entered!

https://t.co/9QffdliW7l

[Aditya Srivastava @0xLegendKiller]

@BugBountyDEFCON Let me in 💀
Don't have them on X 😅, so tagging my fav creator friends ❤️
@_JohnHammond @NahamSec @_zSecurity_

[Bug Bounty Village @BugBountyDEFCON]

IT'S GIVEAWAY SEASON!

We will pick 6 winners to win one of the following:

1x Annual VIP Hack The Box Licence
5x Pentesterlab 3 Month Licences

To enter:
1️⃣ Follow us @BugBountyDefcon
2️⃣ Like this post ❤️
3️⃣ Tag 3 hacker friends in the comments
4️⃣ Retweet this post 🔁

Giveaway open until Thursday May 14th!

GOOD LUCK!

[Aditya Srivastava @0xLegendKiller]

@getpeid @grok @grok let's have a deal, let me win and we enjoy this together

[Aditya Srivastava @0xLegendKiller]

@TheSecOpsGroup Unprotected Metadata (No android:protectionLevel)

Impact: Custom permissions or metadata without protectionLevel are accessible to any app, potentially allowing malicious apps to interact in unintended ways.

Risk: Privilege escalation or unauthorized functionality access.

[Aditya Srivastava @0xLegendKiller]

@TheSecOpsGroup Here's my view:
android:allowBackup="true"
Impact: Allows attackers with physical access or root access to back up app data (using tools like adb backup), potentially leading to credential or sensitive data exposure.
Risk: Data leakage or unauthorized access to user data.

[Aditya Srivastava @0xLegendKiller]

@TheSecOpsGroup Hardcoded OAuth Credentials in <meta-data> Tags

Impact: Sensitive API keys or OAuth tokens are exposed in the manifest, making them trivially accessible to attackers via static analysis.

Risk: Unauthorized API access or impersonation, leading to misuse or data compromise.

[Aditya Srivastava @0xLegendKiller]

@TheSecOpsGroup android:usesCleartextTraffic="true"

Impact: Permits HTTP (unencrypted) communication, making app traffic vulnerable to interception or manipulation via MITM (Man-In-The-Middle) attacks.

Risk: Data confidentiality breach and potential regulatory non-compliance.

[Aditya Srivastava @0xLegendKiller]

@TheSecOpsGroup android:debuggable="true" in Production

Impact: Enables debugging on production builds, allowing attackers to attach debuggers and inspect app behavior or bypass controls.

Risk: Compromised app integrity, logic bypass, or information disclosure.

[DEF CON Delhi Group @dc_9111]

We are thrilled to announce Kaushik Pal as our speaker for the DEF CON Delhi 0x07 Conference!
He will be presenting his talk on the topic "Hunting Threat Actors: Leveraging IoT Search Engines for Infrastructure Analysis".

Stay Tuned!
Happy Hacking! ❤

#dc_9111 #defcon #infosec

[Aditya Srivastava @0xLegendKiller]

@dc_9111 Let's go 😁

[Aditya Srivastava @0xLegendKiller]

@dc_9111 @offsectraining Let's go

[DEF CON Delhi Group @dc_9111]

The registrations for DEF CON Delhi Group CTF (prelims) | 0x07 are LIVE NOW! 🔥
Date: October 13th, 2024 (Sunday)
Prizes powered by: @offsectraining

Register here: https://t.co/CREW92u0vf

#dc_9111 #defcon #cybersecurity #infosec #defcon #badgelife #india #delhi #bugbounty #ctf

[Aditya Srivastava @0xLegendKiller]

@dc_9111 @TELUS @defcon @DotSlashTX #hype0x07

[DEF CON Delhi Group @dc_9111]

[SPONSOR]

We are thrilled to welcome @TELUS Digital India as a Silver Sponsor for the DEF CON Delhi 0x07 Conference! 🔥

Stay Tuned!
Happy Hacking! <3

@defcon
@DotSlashTX
#dc_9111 #defcon #cybersecurity #infosec #defcon #badgelife #programmer #india #delhi #bugbounty

[Aditya Srivastava @0xLegendKiller]

@dc_9111 #hype0x07

[DEF CON Delhi Group @dc_9111]

[REGISTRATIONS OPEN]

We are so excited to announce that the registrations for the DEF CON Delhi 0x07 Conference is LIVE!
Link to the registrations: https://t.co/yXixkHXU58

#cybersecurity #hacking #delhi #event #infosec #dc_9111 #defcondelhigroup #bugbounty #conference #hype0x07

[DEF CON Delhi Group @dc_9111]

[SPONSOR]

We are thrilled to welcome @cloudsek as a Gold Sponsor for the DEF CON Delhi 0x07 Conference! 🔥

Stay Tuned!
Happy Hacking! <3

@defcon
@dotslashtx
@defcongroups
#dc_9111 #defcon #cybersecurity #infosec #defcon #badgelife #programmer #india #delhi #bugbounty

[Aditya Srivastava @0xLegendKiller]

@dc_9111 @cloudsek @defcon @DotSlashTX @defcongroups Let's go 🙂