Главная
Study mode:
on
1
Intro
2
Outline
3
Check /assets and /res/raw
4
Little things left in assets :
5
External Storage: Google Advice
6
External Storage Code Example
7
Installing Packages
8
Detecting reads/writes to external storage
9
Obfuscation
10
If it looks like a duck
11
Identifying crypto
12
Easy way to get decrypted values
13
Webview options
14
Javascript interfaces
15
Quick mitm proxy setup for mobile
16
What is a service
17
How one activity starts another
18
Starting a service
19
Broadcast Receiver #1
20
Dozer Tutorial
21
Intent receivers Fail example
22
Intent receiver fail
23
Abusing exported activities CVE-2013-6271
24
Abusing Services
25
Stop the service :
26
Splitting the parameter
27
Changing system properties :
Description:
Explore advanced Android bug bounty techniques in this 51-minute conference talk from Bugcrowd's LevelUp 2017. Dive into commonly overlooked mobile vulnerability areas, including the Android Inter Process Communication (IPC) model and how implementation flaws can lead to code execution on non-rooted devices. Learn how to leverage web application hacking skills in mobile bug bounties, focusing on embedded JavaScript, JavaScript-enabled activities, and authentication/authorization techniques. Discover insights on external storage vulnerabilities, package installation, obfuscation, crypto identification, WebView options, JavaScript interfaces, MITM proxy setup for mobile, services, activities, broadcast receivers, and exploiting exported components. Gain practical knowledge through examples, including the CVE-2013-6271 vulnerability, and learn how to identify and exploit various Android security weaknesses to enhance your bug bounty skills.

Advanced Android Bug Bounty Skills - Ben Actis, Bugcrowd's LevelUp 2017

Bugcrowd
Add to list
0:00 / 0:00