its Exist Person | Blog

Web Exploitation for Mobile: API Hacking, IDOR & JWT Attacks By Security Research Team | Intermediate TL;DR: Mobile apps communicate exclusively through APIs, making them highly susceptible to web-level attacks. We cover IDOR, JWT manipulation, mass assignment, GraphQL introspection, and rate-limiting bypasses. #blog 1. IDOR (Insecure Direct Object Reference) GET /api/v1/users/profile?user_id=12345 HTTP/1.1 Authorization: Bearer eyJhbGciOiJIUzI1NiIs... # Attacker modifies: GET /api/v1/users/profile?user_id=12346 HTTP/1.1 # If server returns user 12346's data without checking ownership: IDOR! 2. JWT Attacks Attack Method alg=none Change alg to none , remove signature Weak HMAC secret hashcat -m 16500 jwt.txt rockyou.txt JWK injection Insert jwk header with attacker's public key KID injection Set kid: ../../dev/null to bypass verification 3. GraphQL Introspection query { __schema { types { name fields { name } } } } 4. Rate Limiting & OTP Brutefo...

Mobile Malware Analysis: Dropper, Injection & C2 Beaconing By Security Research Team | Intermediate/Advanced TL;DR: We analyze real-world Android malware stages: the DexClassLoader dropper, native library injection, obfuscation techniques, and C2 communication. Includes IoCs and detection rules. Stage 1: The Dropper Most Android malware begins as a seemingly benign app on third-party stores. The dropper's job is to evade Google Play Protect while fetching the real payload. DexClassLoader loader = new DexClassLoader( encryptedDexPath, context.getCacheDir(), null, context.getClassLoader()); Class<?> payloadClass = loader.loadClass("com.evil.Payload"); Method main = payloadClass.getMethod("run", Context.class); main.invoke(null, context); Stage 2: Native Library Injection void hook_function(void* target, void* replacement) { uint32_t trampoline[] = { 0x58000050, // LDR X16, [PC, #8] 0xD61F0200, // BR X16 ...

iOS Security Architecture: Secure Enclave, Codesign & Jailbreak Techniques By Security Research Team | Advanced Level TL;DR: iOS employs a hardware-backed security chain from the Secure Enclave to app-level sandbox. We examine each layer, known bypasses, and modern jailbreak approaches including PAC bypass and tfp0. 1. The Boot Chain & SEP Every iPhone boots through a verified chain : Boot ROM (hardcoded, read-only) → LLB → iBoot → XNU kernel. Each stage verifies the next with Apple's root CA certificates. The Secure Enclave Processor (SEP) is a separate ARM Cortex-A7 coprocessor with its own boot ROM, firmware, and RAM — inaccessible to the application processor. Historical Exploit: The limera1n exploit targeted a bug in the Boot ROM's USB stack (DFU mode). Since the Boot ROM is read-only, Apple could never patch it — a permanent jailbreak for A4 devices. 2. Code Signing & AMFI Apple Mobile File Integrity (AMFI) is a kernel exten...

Android Security Architecture: A Deep Dive into the Linux Kernel & SELinux By Security Research Team | Advanced Level TL;DR: Android's security model rests on four pillars: Linux kernel isolation, SELinux mandatory access control, application sandboxing, and the permission system. This post breaks down each layer with real exploitation scenarios. 1. The Linux Kernel Layer Every Android app runs as a separate Linux user. When you install an app, the system assigns it a unique User ID (UID). This means app A cannot read app B's files because they run under different UIDs — standard Linux file permissions in action. $ ps -A | grep app_ u0_a123 1234 567 com.whatsapp u0_a456 7890 111 com.facebook.katana The kernel also enforces capabilities . Apps run with CAP_NET_ADMIN stripped, preventing raw socket creation on non-rooted devices. This blocks packet injection from user-space apps. Exploit Scenario: CVE-2016-5195 (Dirty COW) allowed a local app to ga...

Web Exploitation for Mobile: API Hacking, IDOR & JWT Attacks By Security Research Team | Intermediate TL;DR: #app Mobile apps communicate exclusively through APIs, making them highly susceptible to web-level attacks. We cover IDOR, JWT manipulation, mass assignment, GraphQL introspection, and rate-limiting bypasses. 1. IDOR (Insecure Direct Object Reference) The #1 vulnerability in mobile APIs. The app sends a user ID or resource ID in the request, and the server fails to verify ownership. GET /api/v1/users/profile?user_id=12345 HTTP/1.1 Authorization: Bearer eyJhbGciOiJIUzI1NiIs... # Attacker modifies: GET /api/v1/users/profile?user_id=12346 HTTP/1.1 # If server returns user 12346's data without checking JWT ownership: IDOR! 2. JWT Attacks Attack Method alg=none Change alg to none , remove signature Weak HMAC secret hashcat -m 16500 jwt.txt rockyou.txt JWK injection Insert jwk header with attacker's public key KID injection Set kid: ../../dev/null to by...

Network Attacks on Mobile: MITM, SSL Pinning Bypass & Traffic Interception By Security Research Team | Practical Guide TL;DR: Mobile apps are particularly vulnerable to MITM attacks because they operate on untrusted networks. This post covers ARP spoofing, DNS poisoning, SSL pinning bypass with Frida/objection, and traffic analysis with Burp Suite & Wireshark. 1. ARP Spoofing & DNS Poisoning On a local Wi-Fi network, the attacker uses ARP spoofing to associate their MAC address with the gateway's IP. Tools like bettercap and arpspoof make this trivial: # ARP spoof the target and gateway bettercap -eval "set arp.spoof.targets 192.168.1.105; arp.spoof on" echo 1 > /proc/sys/net/ipv4/ip_forward 2. SSL Pinning Bypass Apps implement certificate pinning to lock connections to their specific server certificate. Bypass with Frida : # Universal SSL pinning bypass frida -U -f com.target.app --no-pause -e 'setTimeout(function(){ Java.perform(...

Mobile Malware Analysis: Dropper, Injection & C2 Beaconing By Security Research Team | Intermediate/Advanced TL;DR: We analyze real-world Android malware stages: the DexClassLoader dropper, native library injection, obfuscation techniques, and Command & Control (C2) communication. Includes IoCs and detection rules. Stage 1: The Dropper Most Android malware begins as a seemingly benign app on third-party stores. The dropper's job is to evade Google Play Protect while fetching the real payload. DexClassLoader loader = new DexClassLoader( encryptedDexPath, context.getCacheDir().getAbsolutePath(), null, context.getClassLoader() ); Class<?> payloadClass = loader.loadClass("com.evil.Payload"); Method main = payloadClass.getMethod("run", Context.class); main.invoke(null, context); Stage 2: Native Library Injection Advanced malware loads native .so libraries via System.loadLibrary() . Native code is harder to decompile and can ...

iOS Security Architecture: Secure Enclave, Codesign & Jailbreak Techniques By Security Research Team | Advanced Level TL;DR: iOS employs a hardware-backed security chain from the Secure Enclave to app-level sandbox. We examine each layer, known bypasses, and modern jailbreak approaches including PAC bypass and tfp0. 1. The Boot Chain & SEP Every iPhone boots through a verified chain : Boot ROM (hardcoded, read-only) → LLB → iBoot → XNU kernel. Each stage verifies the next with Apple's root CA certificates. The Secure Enclave Processor (SEP) is a separate ARM Cortex-A7 coprocessor with its own boot ROM, firmware, and RAM — inaccessible to the application processor. Historical Exploit: The limera1n exploit targeted a bug in the Boot ROM's USB stack (DFU mode). Since the Boot ROM is read-only, Apple could never patch it — a permanent jailbreak for A4 devices. 2. Code Signing & AMFI Apple Mobile File Integrity (AMFI) is a kernel extensio...

Android Security Architecture: A Deep Dive into the Linux Kernel & SELinux By Security Research Team | Advanced Level TL;DR: Android's security model rests on four pillars: Linux kernel isolation, SELinux mandatory access control, application sandboxing, and the permission system. This post breaks down each layer with real exploitation scenarios. 1. The Linux Kernel Layer Every Android app runs as a separate Linux user. When you install an app, the system assigns it a unique User ID (UID). This means app A cannot read app B's files because they run under different UIDs — standard Linux file permissions in action. $ ps -A | grep app_ u0_a123 1234 567 com.whatsapp u0_a456 7890 111 com.facebook.katana The kernel also enforces capabilities . Apps run with CAP_NET_ADMIN stripped, preventing raw socket creation on non-rooted devices. This blocks packet injection from user-space apps. Exploit Scenario: CVE-2016-5195 (Dirty COW) allowed a local app to gai...

مقدمة يُعدّ الأمن السيبراني من أسرع المجالات التقنية نمواً في العالم، إذ تشير التقارير إلى أن الطلب على المختصين في هذا المجال يفوق العرض بفارق كبير. إذا كنت تفكر في دخول هذا المجال، فهذا المقال سيضع بين يديك خارطة طريق واضحة وعملية. 1. ابدأ بالأساسيات قبل الغوص في أدوات الاختراق والتحليل، عليك بناء قاعدة صلبة في المجالات التالية: شبكات الحاسوب: افهم كيف تعمل بروتوكولات TCP/IP و DNS و HTTP و TLS. أنظمة التشغيل: تعلّم Linux بعمق. البرمجة: Python أولاً لكتابة السكريبتات. خلاصة ابدأ بخطوة واحدة اليوم.#ameer #blog

This is a test post created via the Blogger API #project .

 # How We Built a Real-Time Warehouse Dashboard A small distribution company needed to stop losing track of inventory across three locations. They were using spreadsheets, WhatsApp messages, and paper logs. We replaced that with a real-time warehouse dashboard that runs on phones, tablets, and desktops. ## The Problem The team had three big pain points: 1. Stock levels were always out of date. #blog 2. Orders were picked from the wrong location. 3. Managers had no visibility into daily throughput. Every mistake meant delayed shipments, unhappy customers, and overtime costs. ## Our Approach We kept the design simple and focused on what warehouse staff actually need: scan, confirm, move on. ### Core Features The dashboard gives each role exactly what it needs: - **Receivers** scan incoming pallets and assign bin locations. - **Pickers** get optimized pick lists with barcode verification. - **Managers** see live stock levels, low-stock alerts, and daily movement charts. ### Tech Stack...