Liam Cottle liamcottle

SafetyNet Attestation Bypass

Proof that with a few hours work, you can easily provide aribitrary data to the Google SafetyNet API and receive a valid Attestation signed by attest.android.com.

I've captured the HARDWARE_BACKED flag. Check this comment.

This is only a software backed attestation, as you can see with the evaluationType=BASIC. ~~I don't have any devices that support hardware backed attestations via TEE, however once I do, I'll be taking a look into them 🤠~~

nonce: base64([email protected])
packageName: [email protected]

Disable SSL Pinning on Instagram for Android

Create the file /data/data/com.instagram.android/shared_prefs/devprefs.xml and add the following content. (You will need root access to modify it)

<?xml version='1.0' encoding='utf-8' standalone='yes' ?>
<map>
    <string name="debug_allow_user_certs_ttl">1557909551442:86400000</string>
    <boolean name="debug_allow_user_certs" value="true" />
    <boolean name="debug_disable_liger_fizz" value="true" />

	const axios = require('axios');

	/**
	* PLEX_TOKEN: Your X-Plex-Token
	* PLEX_IDENTIFIER: Your Plex Server Identifier
	* PLEX_SERVER_NAME: Your Plex Server Name
	*/
	const PLEX_TOKEN = '';
	const PLEX_IDENTIFIER = '';
	const PLEX_SERVER_NAME = '';