Hack Your Way Out

  step 1: git clone https://github.com/dwisiswant0/apkleaks.git    step 2:  cd apkleaks/ step 3:  apt install python3-pyaxmlparser step 4:  sudo apt install jadx step 5:  python3  apkleaks.py  -f   ~/Downloads/<app-to-test-android.apk >  

Start by defining a clear objective, such as exploiting a remote code execution (RCE) vulnerability or bypassing authentication on your target. Then, consider how you can achieve this goal using various attack vectors like XSS, SSRF, or others - these are simply tools to help you reach your objective. Use the target as how a normal user would, while browsing keep these questions in mind: 1)How does the app pass data? 2)How/where does the app talk about users? 3)Does the app have multi-tenancy or user levels? 4)Does the app have a unique threat model? 5)Has there been past security research & vulnerabilities? 6)How does the app handle XSS, CSRF, and code injection?

   File and Binary Loading r2 <binary> : Open a binary file. r2 -d <binary> : Open a binary in debugging mode. aaa This is a shortcut for “analyze all." This command analyses our binary and looks for executable sections and looks for calls. when it finds a call, it looks for the destination of the call. afl Display all the functions in the code. V By pressing the capital letter V, show us all the different types of views the assembly view, graph views and the debugging view. Press the letter ‘p’ to navigate between the views. pdf : Print the disassembled function where the current seek is. pdr : Print function recursively (entire call graph). af <address> : Analyze a specific function at <address> . Navigation s <address> : Seek to a specific address. s - or s + : Move backward or forward. s entry0 : Seek to the program's entry point. s sym.main : Seek to the main function (if symbols are present) Disassembly and Debugging pd 10 : Disassemble 10...

  Switch lines Step 1 : Position the cursor on the line you want to move. Step 2 : Type dd to cut the entire line. Step 3 : Move the cursor to the desired position. Step 4 : Type p to paste the line below the current line, or type P to paste the line above the current line. Example: To move line 2 to line 4: Navigate to line 2. Type dd (line is cut). Navigate to line 4. Type p (line is pasted below line 4). Save the file Step 1 :press "esc" Step 2 : Type " :w"  ,to write changes. Step 3 : Type " :wq" , to write and quit. Undo Step 1 :press "esc" Step 2 : Type " :u" Open a Terminal Inside Vim Enter Command Mode: Press Esc to ensure you're in normal mode. Open the Terminal: Type the following command and press Enter : ":term" To write press "i" When done type "exit"  press enter Then press "esc" to close the buffer.

1. Click esc to see main menu  2. Skip "install  software" step & install the rest then come back to main menu 3. Select the install software step. It will work 

  Roll back to the older vertion or, consider creating a virtual environment with an older Python version: curl https://pyenv.run | bash vim ~/.bashrc export PYENV_ROOT="$HOME/.pyenv" export PATH="$PYENV_ROOT/bin:$PATH" eval "$(pyenv init --path)" eval "$(pyenv init -)" source ~/.bashrc pyenv install 3.8.10 pyenv virtualenv 3.8.10 xsstrike-env pyenv activate xsstrike-env After this you may run into an error: ModuleNotFoundError: No module named 'requests' Just run this command: pip install requests Now the tool will be working just fine. If it helped consider subscribing to my YouTube channel:  https://www.youtube.com/channel/UCR9txckubHGilBvNGvud_dg I create contents about bug boundy and reverse engineering.

The uninstall script is in the folder " /opt/zapproxy/ " cd /opt/zapproxy/ sudo ./uninstall

API Analysis Reverse Engineering an API Detailed video in my YouTube If there is no documentation we will have to reverse-engineer the API based on our interactions. Mapping an API with several endpoints and a few methods can quickly become a large attack surface. To manage this process, build the requests under a collection to hack the API thoroughly. Postman can help you keep track of all of these requests. Postman Create a Workspace to save your collections. Use the Capture Requests button, found at the bottom right of the Postman window and select Enable proxy. Add your target URL to the “URL must contain” field, and click the Start Capture button. Use FoxyProxy to route the traffic through Postman. Now browse the website as intended, go through all the functionalities like creating an account, adding a profile photo, changing email, uploading a video and so on. Now go to the requests section of the postman and select all the API requests like the ones that are / api/, /v1/, etc..,...