Elix

Computer Geek | Offensive Security | Mobile Security | Reverse Engineering

[Tur.js @Tur24Tur]

Finally, with @hw16, we managed to bypass the @Cloudflare mTLS protection after around 5 days of work. I'd like to share a few golden tips for bug bounty hunters who might face something similar in the future. But first, here's a quick summary:

The target was a banking app with multiple security layers:
• Heavy Frida detection mechanisms
• Strong root detection
• Google SafetyNet/Play Integrity checks
• Runtime hooking detection
• APK tampering protection (crashed immediately if repackaged/modified)

At first, @fridadotre was detected and crashed the app on my device but strangely worked on another device even though both had the same Android version, root method, Frida server version, and architecture. After investigation, we discovered the app had anti-hooking detection that triggered when using aggressive Frida hooks on sensitive KeyStore operations.

The Solution:
We wrote a minimal Frida script that:
1. Passively monitored certificate operations without modifying behavior

2. Intercepted KeyManagerFactory.init() - the exact moment when mTLS certificates are loaded

3. Extracted the X.509 client certificate and RSA private key (4096-bit)

4. Encoded them using Android's Base64 encoder

5. Formatted as PEM files ready for use

Found the mTLS certificate with a unique UUID-based alias in the Android KeyStore. The certificate was being dynamically loaded during the SSL handshake initialization

Extracted Files:

• client_cert.pem → Client certificate (valid for 2 years)
• client_key.pem → RSA private key (PKCS#8 format)

We then created a PKCS#12 bundle using OpenSSL to combine the certificate and key into a single file, which could be imported into various tools and browsers for testing or @Burp_Suite

Key Takeaway:

When facing anti-tampering mechanisms, be surgical hook only what you need, when you need it. Aggressive hooking triggers detection; passive monitoring flies under the radar.

This was an awesome challenge and my first time encountering such strong ssl Pinning defenses

Attached some image from the mobile api and frida output the certificates

#bugbountytips #frida #Magisk #mtls

[Nicolas Krassas @Dinosn]

Agent Skill (Claude Code + OpenCode) for operating https://t.co/Ychy12N4Gj — Android ARM64 dynamic instrumentation: hook native/Java, patch memory, trace syscalls, bypass SSL pinning/root detection; port Frida & GameGuardian scripts to renef Lua. https://t.co/9RazpLzduX

[Md Ismail Šojal 🕷️ @0x0SojalSec]

Holy moly iOS 27 jailbreak, 🔥

iOS 27 Jailbreak Progress – Clean Package Manager, Zsh Shell & Installed Tweaks on Real Device.

[砍砍.ᐟ @Lakr233]

Jailbroken @ iOS 18.?.?-26.0.1 ( public exp + ppl 0 day from @pattern_F_ ). full phkrw + ppl bypass.

[JS0N Haddix @Jhaddix]

This is the clearest graphic I could make on Prompt Injection.

1. Yes it's a vulnerability
2. It is the superset
3. No this does not illustrate ALL risks, just some

[Mobile Hacker @androidmalware2]

Deep dive into Android Pentesting

Covered everything from static & dynamic analysis, Frida, Drozer, SSL pinning bypass, deep links, broadcast receivers, ADB, and more.
If you're into mobile security, this one's packed with real-world scenarios & tools
https://t.co/FGoBd8kuSd

[Frida @fridadotre]

Frida 17.4 introduces Simmy, a new backend for Apple’s Simulators on macOS.

Spawn, attach, and instrument apps — just like on a real device.

[Mobile Hacker @androidmalware2]

New Web-to-App Tracking

A novel tracking method by Meta and Yandex affecting Android users

How: Apps can quietly open local connections on your phone. Browsers can talk to them—without asking you—letting companies like Meta and Yandex link your web activity to your app identity

[Intigriti @intigriti]

Testing for file upload vulnerabilities? 🧐

Check out Malicious PDF Generator, an open-source toolkit to help you generate tens of malicious PDF files designed to exploit various vulnerabilities and insecure features found in PDF readers! 🤠

🔗 https://t.co/2rGxRmfyAx

[Elix @Elix_13]

I just published "Evasión de detección de Jailbreak en iOS usando Ghidra" [ES]
https://t.co/1pEyVEgyUz

[C4r10s G4rc1a @charaleez_mc]

#unc0ver v10.0. is NOW OUT with iOS 11-18.1.1 support for all iPhones. https://t.co/QNhm9ryHyU

[Elix @Elix_13]

CAPenX (Certified AppSec Pentesting eXpert) done! :3

[Elix @Elix_13]

Just solved : Web - Serveur/GraphQL - Injection challenge on Root-Me :þ

https://t.co/960362qBFw

@rootme_org

#hacking #challenge #WebServeur

[inversecos @inversecos]

Hi beautiful people🌹🖤

Here's the recording of my talk "You can be an iOS hacker: Stack Pivots and JOP/ROPs" I did at @BSidesCbr if you missed it 👉👈

hope you enjoy it as it was really fun talking about a topic I love :D

https://t.co/ZJ97I22NF1

[Elix @Elix_13]

On the road to CAPenX by @TheSecOpsGroup
any tips?

[Elix @Elix_13]

Wow! I have just got my new certificate in Android Application Security - Free Course. See it for yourself! https://t.co/VHi8yaLI3x https://t.co/hBgSN84Xob

[PT SWARM @ptswarm]

🔥 ESET fixed CVE-2024-7400 found by our researcher Dmitriy Zuzlov!

This is an LPE that affects 13 ESET solutions and allows a low-privileged attacker to delete arbitrary files, which can be used to obtain NT AUTHORITY\SYSTEM privileges!

The advisory 👉 https://t.co/V3bcaOmPW7

[xyzeva @xyz3va]

gaining access to anyones browser without them even visiting a website (CVE-2024-45489)

https://t.co/Junay0CCNv

[JS0N Haddix @Jhaddix]

If you are an aspiring mobile hacker, or even a seasoned one, manipulating URL schemes in mobile apps is often something that gets overlooked.

Check out -

https://t.co/GhLavCjG5K

It's got a few good labs for practice!

$ Session Theft
$ Overwriting Files
$ Memory Corruption (ADoS)
$ HTML Injection