Just rediscovered this Smali bind shell I wrote a while back. Useful for niche scenarios like minimal exploit PoCs (i.e., overwriting DEX files for arbitrary execution). IIRC it compiles to a few hundred bytes.
https://t.co/yRLeaop1E3
#android#mobilesecurity
@Muntrive @FirewallFiasco @Hacker0x01 One-click ATO is absolutely a vulnerability, and often considered high-severity. Anyone saying otherwise is objectively incorrect.
Consider also that many XSS and CSRF attacks require a click, and they don't always guarantee something as impactful as ATO.
@vasyaqwee@tdinh_me VS Code: right-click -> "format document," and when you copy/paste from it, it retains your (theme-specific) syntax highlighting
@MishaalRahman Actually, I've seen quite a few devices with security policies that let you install/sideload apps, but not enable developer options - this would still be a use-case for Termux
We've just updated our URL Validation Bypass Cheat Sheet with a new IP address obfuscator by @e1abrador, and new payloads by @SeanPesce and @t0xodile. Check out the full details at: https://t.co/vX3DHRg9Zr
Arc browser (on Android, at least) seems to block ads and annoyances by injecting a <style> element on every page you visit - it applies this style by using a giant list of more than 12,000 CSS selectors for common nuisance DOM elements