8kSec

Offensive Security Training. OnDemand Mobile Security & AI Security Courses - Linkedin: @8ksec

[8kSec @8kSec]

NEW BLOG ALERT! The final part of the Android SELinux Internals series is now out on https://t.co/SLcSiO8byM. This one covers the Treble policy split, a sesearch audit workflow, how kCFI/PAC/MTE/SCS stack up against exploit primitives, and what changed in Android 16.

[8kSec @8kSec]

A technical breakdown of three attack scenarios: chaining Android deep links with WebView misconfigurations, insufficient URL validation, bypassable host checks, and file:// URI exploitation to exfiltrate app data: https://t.co/4DMYPXrH5Y 
Each one includes a working PoC against InsecureShop.
More Android app attack-surface deep dives on @8kSec

[8kSec @8kSec]

Our blog uses Frida to intercept plaintext messages from Signal and Telegram on iOS, two very different hooking challenges. Signal's Objective-C, so you hook TSIncomingMessage directly. Telegram's Swift, so you parse registers and heap structures: https://t.co/qb7Av3VZ9J 

E2E encryption doesn't protect messages once they're decrypted on the device.

Stay updated with @8kSec for more blogs like this

[8kSec @8kSec]

Learn how to read and analyze iOS kernel panic logs, extracting them, reading the panic string, calculating real addresses from the kernelcache slide, and symbolicating the backtrace: https://t.co/UUcdfLFgzn 

The example panic ties to a PUAF primitive, showing how one crash log can point you to an exploitation-related condition.

Follow @8kSec for more iOS kernel research

[8kSec @8kSec]

Here's our blog that details the mechanics of hacking a real Android game from the Play Store, extracting its compiled code, finding the function that handles money pickups, and hooking it at runtime to change the value on the fly: https://t.co/WBJQgTDSpC 

No permanent modifications to the game needed, one script, and every coin pickup is worth more.

Keep learning with @8kSec. Follow us for more security resources!

[8kSec @8kSec]

Learn how to use Frida to bypass an iOS app's encrypted database, not by breaking the encryption, but by intercepting the passphrase at runtime and querying the unlocked database directly from a script: https://t.co/LMZA6f0dtO��

Follow @8kSec for more hands-on security content

[8kSec @8kSec]

Check out the Android Activity lifecycle from the AOSP source, what the framework actually does behind each callback, how it enforces super calls, and the security implications at each stage: https://t.co/PvpT51fFex 

Covers FLAG_SECURE, sensitive data cleanup in onPause(), task affinity restrictions on Android 11+, and more.

Understanding how activities manage state and focus is foundational for exploiting Android app vulnerabilities. Practice Android app exploitation hands-on in our free Android Application Exploitation Challenges: https://t.co/5t1MUYZMWv 

Follow @8kSec for more mobile security research

[8kSec @8kSec]

Learn to extract and read iOS sandbox profiles, the SBPL rules embedded in Sandbox.kext that control what every app and daemon can actually do: https://t.co/IEEfuiivdA 

Covers using Sandblaster to dump profiles from the kernelcache, then breaks down WebKit's WebContent sandbox to show what granular Mach IPC, syscall, and MIG restrictions look like. 

Follow @8kSec for more practical security content

[8kSec @8kSec]

@tonygo_ Congratulations on the result, @tonygo_ 🎉

[8kSec @8kSec]

@0xor0ne Nice to see the series getting another share, @0xor0ne. Always appreciated. 🙌

[8kSec @8kSec]

@tonygo_ Wishing you the very best for your CISR results.🤞

[8kSec @8kSec]

@0xor0ne Thank you for sharing the series, @0xor0ne. We really appreciate it and hope others find it useful too. 🙌

[8kSec @8kSec]

@erengsec @credly Congratulations, @erengsec! Glad to have been part of your learning journey. 👏

[8kSec @8kSec]

@0xor0ne Thanks for sharing this @0xor0ne! Always great to see our resources being shared with the community.

[8kSec @8kSec]

Our blog walks through compiling the Dopamine jailbreak from source, so you can set breakpoints, inspect memory, and trace the exploit logic step-by-step yourself: https://t.co/qvwPAWuH18 

Covers the full setup, the real build errors you'll hit, and fixes for each.

Follow @8kSec for more iOS internals research

[8kSec @8kSec]

@0xbind3r @L0rd5ud0 Congratulations on earning the OMSE certification, @0xbind3r and all the best for what comes next! 🙌

[8kSec @8kSec]

This deep dive breaks down CVE-2023-26083, where the Mali GPU driver serialized raw kernel pointers into a timeline stream ring buffer that unprivileged apps could acquire via ioctl and read using normal read operations. KASLR bypass primitive with user-space code: https://t.co/a16BQJM11S

Remained exploitable on Pixel 8 months after the announced patch.

For researchers interested in topics like this, and our Offensive Android Internals course goes deeper into Android kernel internals, Mali GPU research, DAC/CAP/RKP/MTE, native fuzzing with Frida and AFL++, leads to the CASR certification. https://t.co/saSYpY3Svg

Follow @8kSec for more Android kernel research

[8kSec @8kSec]

Learn mobile app exploitation from the people who wrote the vulnerable apps the industry trains on. 🔥 Early bird ends Aug 7

📍 Black Hat India 2026 | Oct 27–28, Bengaluru | Practical Mobile Application Exploitation by @8kSec

What's covered across 2 days:
- Reverse engineering iOS + Android binaries and system libraries
- ARM64 instruction set: static + dynamic analysis
- Exploiting IPC, insecure storage, weak cryptography
- Bypassing root/jailbreak detection, SSL pinning, anti-debugging, obfuscation
- Fuzzing native libraries to uncover vulnerabilities
- IDA Pro, Hopper, Ghidra, Frida
- Includes Corellium access and the CMSE certification.

→ https://t.co/PcQ8HVByC8

[8kSec @8kSec]

🚨 New Blog alert! AI-Assisted Fuzzing: Generating libFuzzer Harnesses with a Local LLM
Harness-writing is the friction that kills most fuzzing efforts. In our latest blog, we use a fully offline local LLM (Ollama) to generate libFuzzer harnesses, while libFuzzer + AddressSanitizer do what they do best, which is uncover bugs!
The LLM drafts. The fuzzer finds. The human verifies.
Read the full blog: https://t.co/80U0tbS3Hk 
Keep learning with @8kSec. Follow us for more AI Security content.

[8kSec @8kSec]

With Apple's Memory Integrity Enforcement turned on, a classic iOS memory bug can't fail silently anymore. Write 2,000 bytes into a 16-byte buffer and the app crashes the instant it goes out of bounds, no quiet corruption.
The blog shows how to switch it on in your own app and read the crash it produces: https://t.co/rgN2DULmjD
The honest limit: it catches 93.75% of these bugs, not 100%.
That remaining gap is where exploitation lives: heap overflows and use-after-frees under ARM64 tagged memory are core OS-level iOS work. Our Offensive Mobile Reversing and Exploitation course covers ARM64 binary exploitation and PAC/SPTM/RKP bypasses hands-on: https://t.co/BGduUr6sIY
Follow @8kSec for more iOS memory-protection research.

[8kSec @8kSec]

MTE raises the bar for ARM64 heap exploitation, understanding how tags break overflow and UaF primitives is now part of the exploit development skillset. Our Offensive Mobile Reversing and Exploitation course covers ARM64 binary exploitation end-to-end, from ROP chains through mitigation bypasses, with hands-on labs and the OMSE certification.
https://t.co/BGduUr70yw

[8kSec @8kSec]

This blog covers the defense: ARM's Memory Tagging Extension 4-bit tags on every 16-byte granule that turn heap overflows and UaF into immediate segfaults, at near-zero cost: https://t.co/xJawQuZfF6
Walks through IRG/STG instructions, a working demo, and enabling MTE on Pixel 8.
Follow @8kSec for more ARM64 exploitation