๐จ๐จOur newest blog on Android SELinux Internals Part III is out! Read it here: https://t.co/w9m3Qp5S1H. In this one, we look at Six kernel-level techniques to disable SELinux. Five real exploit chains, and we talk about which vendor protections actually work and which don't. #MobileSecurity #AndroidSecurity #InfoSec #Cybersecurity
โ๏ธ SUMMER SALE at 8kSec Academy is live! 25% off every on-demand course through June 30:
โ https://t.co/lWUydt18A4
Five tracks, five certifications:
๐ฃ๐ฟ๐ฎ๐ฐ๐๐ถ๐ฐ๐ฎ๐น ๐๐ ๐ฆ๐ฒ๐ฐ๐๐ฟ๐ถ๐๐ (CAISR) โ prompt injection, MCP exploitation, offensive AI agents
๐ ๐ผ๐ฏ๐ถ๐น๐ฒ ๐๐ฝ๐ฝ ๐๐ ๐ฝ๐น๐ผ๐ถ๐๐ฎ๐๐ถ๐ผ๐ป (CMSE) โ iOS/Android/Flutter RE, Frida, IPC
๐ ๐ผ๐ฏ๐ถ๐น๐ฒ ๐ฅ๐ฒ๐๐ฒ๐ฟ๐๐ถ๐ป๐ด & ๐๐ ๐ฝ๐น๐ผ๐ถ๐๐ฎ๐๐ถ๐ผ๐ป (OMSE) โ ARM64, kernel mitigations, AFL++ fuzzing
๐ถ๐ข๐ฆ ๐๐ป๐๐ฒ๐ฟ๐ป๐ฎ๐น๐ (CISR) โ mach_msg2/XPC, jailbreak internals
๐๐ป๐ฑ๐ฟ๐ผ๐ถ๐ฑ ๐๐ป๐๐ฒ๐ฟ๐ป๐ฎ๐น๐ (CASR) โ Binder IPC, SELinux, Mali GPU
Every course now ships with module glossaries, hands-on homework, and a full mock exam, giving you a structured path to the certification.
25% off through June 30, EST.
Code: SUMMER25
Free, hands-on AI/LLM exploitation labs. Prompt injection, MCP path traversal, adversarial ML, data poisoning, model-file RCE. Each one of this is a purpose-built vulnerable AI app, and not a jailbreak-the-chatbot demo: https://t.co/MlSZw6uKii
Follow @8kSec for more AI security training
Off-by-one writes and pointer overwrite tricks like this are a core ARM64 binary exploitation primitive. Practice building these exploits yourself in our free ARM Exploitation Challenges: https://t.co/Sw1iMBc0Oy
Think about a loop that has i <= 16 instead of i < 16. That one-character bug writes one byte past the buffer, and straight onto a nearby pointer. This walkthrough turns that single byte into arbitrary code execution on ARM64: https://t.co/aDZ1Jeogop
Follow @8kSec for more ARM64 exploitation
Bypassing SSL pinning and intercepting app traffic is a core mobile pentest skill. Our Practical Mobile Application Exploitation course covers Frida instrumentation, runtime manipulation, and traffic interception on real iOS and Android apps, leading to the CMSE certification.
https://t.co/BBv0tfKHWa
Everyone says to add SSL pinning to your mobile apps. This blog argues on reasons to remove it: https://t.co/I5KceSHEjs
A revoked or renewed cert bricks your app until users force-update, and Frida drops the pin in minutes anyway. The real fix moves the decision server-side.
Follow @8kSec for more practical security content
Twelve free iOS application exploitation labs. Frida detection, runtime swizzling, GPS spoofing, SSL bypass. Built like real hardened apps, not toy CTFs: https://t.co/lfjlvRHmVM
Follow @8kSec for more mobile pentest training
Our Practical Mobile Application Exploitation course (CMSE certification) covers the full app-side attack surface. This includes deep link exploitation, IPC, WebViews, Frida-driven runtime analysis, and more:
https://t.co/n5WRBcePIM
Turning a stock Android 15 emulator into a rooted, Frida-ready pentest target. No physical device, no jailbroken loaner. Read the full blog: https://t.co/mH4koxdAwb
Follow @8kSec for more mobile pentest tooling.
This blog walks through an integer overflow on ARM64 where the bounds check is correct, the strcpy is correct, and its still exploitable!
The overflow happens because of a type cast between validation and copy logic.
Full walkthrough in the post: https://t.co/tCoqZl2rJD
Follow @8kSec for more hands-on security content
Want to go even deeper into Mobile OS internals? Our Offensive Android Internals course covers Android internals, kernel security, SELinux, exploitation, and real-world offensive research techniques in depth. Check it out: https://t.co/XUJW6792Bt
๐จ๐จOur newest blog on Android SELinux Internals Part III is out! Read it here: https://t.co/w9m3Qp5S1H. In this one, we look at Six kernel-level techniques to disable SELinux. Five real exploit chains, and we talk about which vendor protections actually work and which don't. #MobileSecurity #AndroidSecurity #InfoSec #Cybersecurity
11 free hands-on Android exploitation labs. Each is a vulnerable APK with a real-world attack class.
Labs include:
โ Bypass kiosk-mode without the wipe
โ Reverse a Flutter password vault statically
โ Make unauthorized calls without permissions
Plus 7 more.
https://t.co/5t1MUYZMWv
Follow @8kSec for more such resources.
Chaining info leaks with memory corruption is core to bypassing modern ARM64 mitigations. We cover ARM64 exploitation end-to-end, ASLR/NX bypasses, ROP, heap and stack corruption in our Offensive Mobile Reversing and Exploitation course.
https://t.co/Z2ZC3t1HgH
This blog walks through bypassing ASLR and NX on ARM64 with two bugs that only work together. One leaks a memory address. The other turns that address into a shell. Either alone is harmless.
Full walkthrough: https://t.co/ugyuDVasqM
Follow @8kSec for more practical security content
Patch-diffing CVE-2024-23265 in the AppleDiskImages2 KEXT, the entire iOS kernel fix is one added equality check:
https://t.co/r9gvxluiPV
The methodology covers every function in the KEXT. ipsw pulls kernelcaches from iOS 17.3.1 and 17.4, ipsw's symbolicator names the functions, a Ghidra script dumps every decompiled function, and Meld diffs the pair. One function comes back changed.
Before: it returned -1 as if it were a valid pointer.
After: one added clause if (lVar4 != 0 && lVar4 != -1). Reachable from userland via IOUserClient::externalMethod.
Follow @8kSec for more such iOS kernel research.
Kernel patch diffing, pulling kernelcaches from IPSWs, decompiling KEXTs, and reading bug-fix diffs to understand iOS internals is a workflow we teach end-to-end in our Offensive iOS Internals course. Check out the syllabus here
https://t.co/3AyTjQgihn