- https://sushi2k.gitbooks.io/the-owasp-mobile-security-testing-guide
- https://web.securityinnovation.com/hubfs/iOS%20Hacking%20Guide.pdf
- Disable ssl pinning - https://github.com/intrepidusgroup/trustme
- Disable ssl pinning - https://github.com/nabla-c0d3/ssl-kill-switch2
- Inject own code in 3rd party IPA - https://github.com/Naituw/IPAPatch
- Check for intents,
<service>withandroid:exported="true",<receiver> - Local unencrypted shared data
- HTTP != HTTPS
- protocol handles != intents.
- https://hackerone.com/reports/289000 - smthn with broadcaster AFAIR
- https://hackerone.com/reports/192886 - Broadcast Receiver instead of Local Broadcast Manager
- https://hackerone.com/reports/56002 - broadcast is not protected by permission
- https://hackerone.com/reports/328486 - webview in Zomato
- https://hackerone.com/reports/189793 - note that it's possible to use
adb shell && am start ... - https://hackerone.com/reports/272044 -
ComponentName component = intent.getComponent();to find an intent handler - https://hackerone.com/reports/283063 - inject html/js with intent for image loading
- https://hackerone.com/reports/283058 - open arbitrary urls in webview
- https://hackerone.com/reports/161710 - steal local files from the app. Hmm,
intent.setType("application/pdf"); - https://hackerone.com/reports/200427 - send intent to Slack -> Slack executes limited number of commands
- https://hackerone.com/reports/288955 - theft local file = theft token = acc takeover
- https://hackerone.com/reports/272044 - access to
android:exported="false"providers - https://hackerone.com/reports/258460 - sending intent to
android:exported="true"service leads to local files reading.
- https://hackerone.com/reports/202425 - 2FA bypass with bruteforce
- https://hackerone.com/reports/205000 - (same researcher as the report above). No pass, only 2FA. bypass 2FA = account takeover
- https://hackerone.com/reports/149598 - Gitlab. Bruteforce 2FA in 4days for 1 acc.
- https://hackerone.com/reports/57918 - SQLite with no pass on SD
- https://hackerone.com/reports/44727 - SQLite db stores plaintext pass/username for domains
- https://hackerone.com/reports/176065 - HTML Injection in BatterySaveArticleRenderer WebView