Pedro Oliveira

Android Lead Developer and Security Enthusiast📱🔍

[Pedro Oliveira @kanytu]

Checkout my new writeup on how could a website steal all your Firefox cookies remotely 📱🐛.

CVE-2020-15647: Arbitrary local file access in Firefox for Android

#MobileSecurity #AndroidSecurity #Android #BugBounty

https://t.co/8vuuSulfED

[Pedro Oliveira @kanytu]

@madona_syombua o/

[Pedro Oliveira @kanytu]

@hulkvision Great job. 👏🏼

[Pedro Oliveira @kanytu]

@0xhunster @thaivd98 @GoogleVRP I'm not sure, but that's unlikely.

[Pedro Oliveira @kanytu]

Thank you @GoogleVRP for the awesome gift! #BugBounty

[Pedro Oliveira @kanytu]

@0xhunster @thaivd98 @GoogleVRP https://t.co/Q1wwQwwkXI

[Pedro Oliveira @kanytu]

@thaivd98 @GoogleVRP Top researcher for the Google Play Vulnerability Reward program :)

[Pedro Oliveira @kanytu]

Thank you, @ShawnJamesMusic, for spending 2,723 minutes with me this year on @Spotify. You are my #1. #SpotifyWrapped https://t.co/u4u9xG8IGj

[Pedro Oliveira @kanytu]

@tbbhunter If I remember correctly, if you register a package name, you can't unregister it. So in this scenario, the company in question wont be able to use the package name they wanted in the first place. I don't think that's a good ideia.

[Yekki @Yekki_1]

As a pentester, for me this is one of the most disappointing sights when on a test. I know others would get excited, but for me, it shows a lack of fundamental understanding that we really need to try and teach.

[Pedro Oliveira @kanytu]

@dirtycoder0124 @Bugcrowd @Hacker0x01 @mobilesecurity_ @_bagipro Some programs accept that as data exfiltration meaning an attacker can read potentially danger info from the victim but that requires physical access to the device. Example: https://t.co/6VuZ9FRAaw

[publiclyDisclosed @disclosedh1]

https://t.co/pkOyhwSTRP disclosed a bug submitted by @kanytu: https://t.co/OyokHEGY9N - Bounty: $1,000 #hackerone #bugbounty

[Pedro Oliveira @kanytu]

I wrote a new write-up disclosing a Brave for Android vulnerability that would allow a malicious web page to steal your cookies.

https://t.co/rw98CVux10

#MobileSecurity #infosec #BugBounty #Android

[publiclyDisclosed @disclosedh1]

https://t.co/pkOyhwSTRP disclosed a bug submitted by @kanytu: https://t.co/LNsjqA1vaW - Bounty: $1,000 #hackerone #bugbounty

[Pedro Oliveira @kanytu]

@B3nac Content providers are awesome 😎 real fun to exploit those!

[Pedro Oliveira @kanytu]

I've been reporting security issues in Android applications for the past year 📱🔒.
I've finally reached top 50 in Google's Hall of Fame.
https://t.co/cuj7iVJJMK

[publiclyDisclosed @disclosedh1]

https://t.co/pkOyhwSTRP disclosed a bug submitted by @kanytu: https://t.co/yR9M9Rf6vZ - Bounty: $1,000 #hackerone #bugbounty

[Pedro Oliveira @kanytu]

@Hack_All_Things If mobile apps are in scope, I'm interested. kanytu @ hackerone

[Pedro Oliveira @kanytu]

@GazTheJourno I can help I guess. Pm me

[Bug Bounty Reports Explained @gregxsunday]

I needed one more week of a break but the newest video is out! This time it's out of the box vulnerability in mobile Firefox by @kanytu that allowed reading local files of a victim that visited the website. It was awarded $5,000. Enjooy!
https://t.co/LMfEZNub94

[Pedro Oliveira @kanytu]

@ShawnJamesMusic Last concert was Royal Blood, Campo Pequeno 2017