- Видео 106
- Просмотров 592 101
CorSecure
США
Добавлен 22 фев 2022
I work in application security with a focus on mobile security. I also enjoy tinkering with projects involving hardware hacking, 3D printing, and other random stuff in the tech space. I'm hoping to provide some insight and information related to hacking and security and occasionally show off some cool projects I am working on.
Game Hacking with Frida!
In this video I walk through one of my favorite challenges from the TryHackMe Advent of Cyber 2024. This challenge involves hacking a game using Frida.
You can access this challenge, as well as all of the other challenges from the Advent of Cyber event here:
tryhackme.com/r/room/adventofcyber2024
You can access this challenge, as well as all of the other challenges from the Advent of Cyber event here:
tryhackme.com/r/room/adventofcyber2024
Просмотров: 1 083
Видео
What Is The OWASP Mobile Top 10?
Просмотров 43521 день назад
When pentesting or hacking mobile applications, it can sometimes be difficult to know what you should spend your time on. Fortunately, OWASP puts out a top 10 list every few years with the top 10 most important categories for vulnerabilities that we should be paying attention to. In this video, I go over all 10 categories of the OWASP Mobile Top 10 and go over some examples of the types of vuln...
2024 Holiday Hacking Challenges!
Просмотров 233Месяц назад
Every year during the holiday season you can find some holiday themed hacking challenges. In this video I highlight 2 of my favorites: Advent of Cyber from TryHackMe! - tryhackme.com/r/christmas Holiday Hack Challenge from SANS - www.sans.org/mlp/holiday-hack-challenge-2024/ If you have some free time this December, both of these challenges are great ways to learn some hacking skills and maybe ...
9 (+2) Tools For Mobile Hacking
Просмотров 1,3 тыс.2 месяца назад
Swapping from web application pentesting to mobile application pentesting requires you to learn a lot of new tools and techniques. In this video, I cover some of the most important tools to learn how to use if you are a beginner trying to learn how to hack mobile applications. This includes tools for Android and iOS hacking, as well as tools that apply to both platforms. Links to all of the too...
Create Custom Frida Scripts For Android
Просмотров 1,5 тыс.3 месяца назад
In this video, I show you how to use JADX to inspect the source code of an Android application and then use that source code to create a custom Frida script. As an example, I use this method to bypass an emulation detection check in the AndroGoat application. Use my referral link to sign up for TryHackMe: tryhackme.com/signup?referrer=63901cae2f79f1005e1300dd Use my affiliate link to sign up fo...
Hack Android Apps With Drozer [UPDATED 2024]
Просмотров 4 тыс.4 месяца назад
Drozer can be used to interact with the internal components of an Android app, including Activities, Services, Content Providers, and Broadcast Receivers. In this video, I show you how to install and setup Drozer and walkthrough exploiting an unprotected activity in an Android app. You can download Drozer here: github.com/WithSecureLabs/drozer Use my referral link to sign up for TryHackMe: tryh...
Web Cache Deception Attacks! | New From BlackHat 2024!
Просмотров 1,7 тыс.5 месяцев назад
PortSwigger just recently released some new research at BlackHat about Web Cache Deception Attacks. They also added a whole new section to the Web Security Academy and some new labs. In this video, I'm going to solve the first lab from this brand new section. If you want to try the lab yourself, you can check it out here: portswigger.net/web-security/web-cache-deception/lab-wcd-exploiting-path-...
Learn How To Be A Hacker
Просмотров 1,3 тыс.5 месяцев назад
I have nearly 10 years of experience as a penetration tester, and I often get asked how someone can learn how to be a hacker. In this video, I cover 5 different online resources that you can use to learn the skills needed to become a hacker. Links to all 5 resources below: 1. Try Hack Me (tryhackme.com/signup?referrer=63901cae2f79f1005e1300dd)* 2. Hack The Box (hacktheboxltd.sjv.io/VmGgeE) 3. P...
Web Shells & Directory Traversal
Просмотров 2575 месяцев назад
In this video, I solve another lab from the PortSwigger Web Security Academy. This lab involves chaining together a file upload vulnerability and a directory traversal in order to bypass some protections that are in place on the web server.
Burp Suite and Frida on an Android Emulator
Просмотров 12 тыс.6 месяцев назад
Burp Suite and Frida on an Android Emulator
Installing (AND ROOTING) Android Emulator [2024 UPDATE]
Просмотров 31 тыс.6 месяцев назад
Installing (AND ROOTING) Android Emulator [2024 UPDATE]
More Android Hacking | Databases, SQL Injection, and Binary Patching
Просмотров 1,2 тыс.6 месяцев назад
More Android Hacking | Databases, SQL Injection, and Binary Patching
Bypassing 2FA | Web Security Academy
Просмотров 8358 месяцев назад
Bypassing 2FA | Web Security Academy
Hack Android With Burp Suite (THE EASY WAY!)
Просмотров 9 тыс.8 месяцев назад
Hack Android With Burp Suite (THE EASY WAY!)
Hacking AI Chatbots | Web Security Academy
Просмотров 9899 месяцев назад
Hacking AI Chatbots | Web Security Academy
Stealing Passwords With GraphQL | Web Security Academy
Просмотров 4499 месяцев назад
Stealing Passwords With GraphQL | Web Security Academy
Extract and Reverse Engineer iPhone Apps
Просмотров 11 тыс.9 месяцев назад
Extract and Reverse Engineer iPhone Apps
Building a DIY Security Camera System | #PiDay
Просмотров 68210 месяцев назад
Building a DIY Security Camera System | #PiDay
Cracking An UnCrackable iPhone App
Просмотров 1,3 тыс.10 месяцев назад
Cracking An UnCrackable iPhone App
Access Private Posts With GraphQL | Web Security Academy
Просмотров 30110 месяцев назад
Access Private Posts With GraphQL | Web Security Academy
Sideload And Re-Sign Untrusted iPhone Apps
Просмотров 12 тыс.11 месяцев назад
Sideload And Re-Sign Untrusted iPhone Apps
Intercept Traffic and Bypass SSL Pinning on iPhone
Просмотров 11 тыс.Год назад
Intercept Traffic and Bypass SSL Pinning on iPhone
SANS Holiday Hack Challenge 2023 | Win a FREE SANS training course!
Просмотров 648Год назад
SANS Holiday Hack Challenge 2023 | Win a FREE SANS training course!
Thank you man you are the best it really helped me understand it i think you are the only person on youtube that could show me it like that really appreciate it
I am trying to install a burp certificate for Burp. I tried exporting and then regenerating the certificate, but I still could not find the certificate. Please help me
i click on magisk hide option i got error failed to hide magisk
I think Is pretty useless because u Need inject Objection agent and when u uninstall and reinstall u lose data
You don't have to inject the agent. You can just install the frida server on the device without uninstalling the app.
@CorSecure Yes but you Need to root the phone. So, root phone or inject agent
True. Anytime I report this type of vulnerability I always make it clear that the likelihood of exploitation is fairly low. Most user's would never be affected by this. It could still be a big problem if the user was already using a rooted/jailbroken device or if the user was a high value target and an attacker found a way to get a patched version of the app on their device (via phishing or some other attack vector). It is not likely to affect most users, but it is still a valuable thing to report when assessing the security of an application.
👍👍👍👍👍👍👍👍
Great tutorial, many thanks
Hi, i am using pi 0 w with P4wnp1. When i run the script it goes in running state but not getting executed. Please, please provide me a solution
Nice video, straight and to the point. Very well done!
Hello CorSecure, Could you please provide some guidance or create a video on how to launch an application that checks if a device is running on an Android emulator? I'm trying to run TikTok, but it just crashes at the loading screen logo.
Is it working with the zero 2 w
Hey , first of all awesome video. when i run frida-ps -U or frida-ps -Uia my nox emulator shows android logo then restarts quickly. please help
quick update: tried frida 16.4.3 woking fine now. Currently stuck at magisk i am using nox emulator
/cfr better
Haha! I keep teasing my kid about crap talking and spawn killing etc in games and not clicking links etc, and how one day some1 is going to turn around n hack his arse n get revenge.. Think im gona plant one of these INSIDE his pc n have a lil fun. The amusing part is I can see him and his screen from my pc, while he can't see me n mine.. 😂😂😂
great video
Hey corSecure can u make video on flutter based application to bypass SSL pining
this is great, Thanks
thanks
Subbed! Thanks for posting
Hey CoreSecure, can you provide a practical demo of each OWASP vulnerability you talked about in this video?
Bro can you make an emulator like mumu or memu to not get caught by mobile games? So it's detected as a real phone?
Do you think Termux can do CTF and clear a mission from beetlebug?
hello, great video, but I have some doubts, can we connect?
You can access this challenge, as well as all of the other challenges from the Advent of Cyber event here: tryhackme.com/r/room/adventofcyber2024
its black screen and emulator not launch
This was really helpful. Thanks 🙏🏽
I'll try it right now, hope it work. If yes, god bless you
Really struggled to get this going with other tuts, this is the first video I came across that was simple, worked brilliantly and got the job done, well done
I'm glad it helped!
how to see variables in runtime?
Please boss, will I be able to evade emulator detection with this?
can you make it for ld player please
How to decompile webchromium apk, and how to use those files after decompile can you provide more info we learn from you
Hey buddy... Thanks for the video! I will update my methodology to OWASP 2024 Top 10!
You can find the OWASP Mobile Top 10 list here: owasp.org/www-project-mobile-top-10/
❤
Thanks for yet another helpful video, I did not know you can set the proxy directly in Android Studio. This facilitates setting up the proxy a lot since you do not need to fiddle with the network settings in the device user interface. However in minute 4:05 you set up the proxy to 127.0.0.1:8080 and the proxy status is set to "Proxy is unreachable". I have the same problem when having Burp listening only on the loopback interface and there is no connection possible through the proxy... I think 127.0.0.1 in this case refers to the device itself and not the host on which you are running Burp, right? When setting up Burp to listen on another interface, changing the proxy IP address to an externally reachable IP address the proxy status changes to "Success".
change it to 0.0.0.0 to support all ips available in your device. Or us your local ip (ipconfig check)
What vulnerabilities a sqlite file can have jn apk file ranging from info to critical vulnerabilities
If i want to use the rooted emulator, should i get the rooted one or it's just already rooted from the beginning we install the emulator?
This video and your channel are pure gold. Thanks a lot man! It's easy to get lost and waste so much time on these topics. Keep up the great work
Thanks! I'm glad it was helpful!
nice
Great video super easy to follow
Thank youuuu!!!!!
Have u consider making discord group
thank you sir from Pakistan ❤
Amazing video!!!! Thank you so much!!!
How did you open command prompt?
Finally a simple, straight-forward tutorial. You're massively underrated, thanks so much for the informative video!
I'm glad it was helpful!
can i decrypt an ipa file without a hacked iphone? i got a hacked ios 6 lying around but a modern ios app that i just want to run on my mac with playcover
You need a jailbroken phone in order to extract the IPA file from the device, but once you have the IPA file, you can do everything else without needing a device at all.
@ how do I decrypt an ipa without the device specifically?
you a my hero!
so I have this app which seems to be uncrackable. it detects when frida is attached and instantly closes - it doesn't crash it actually sais in toast message bubble that is has detected an injection. resigning the entire application and it again detects that its not official anymore. there is probably some java/kotlin/assemlby code to patch this but how would you find it? the strings cannot be traced, not obvious method names, probably some obfuscation. so it seems like frida is just for playing around but not usable for real applications.
Every application is different, and the app you're working with may have some sophisticated tampering and anti-reversing protections in place. I can't promise you that Frida will work for every application, but it is for much more than just playing around. I use it with real application every day in my day job.
@CorSecure hey thanks for then explanation! I managed to inject code with the a custom lsposed module - I noticed the app close quicker than Frida patches. So at least in Theory the protection can be patched.
is this also on momentum? \