Online Securiry Trainings & Application Security Services
Bengaluru, India
Joined December 2015
- Tweets222
- Following3
- Followers462
- Likes40
OpSecX retweeted
I will be releasing the brand new MobSF iOS Dynamic Analyzer powered by Frida and @CorelliumHQ at @BlackHatEvents Arsenal, London UK.
Here is a sneak peak: youtu.be/i-pEascyxc8?si=EBkr…
Catch me live on Thursday, December 7 1.00 PM
OpSecX retweeted
MobSF v3.6.9 is out! 🎉
The latest docker image now supports quick and easy Dynamic Analysis with Android Studio AVD, Genymotion, and Corellium Android VMs.
See the updated docs: mobsf.github.io/docs/#/mobsf…
OpSecX retweeted
Capturing Mobile App Network Traffic with MobSF and Burp.
MobSF takes care of
* Proxy Root CA install
* Generic SSL Pinning/Certificate Transparency bypass
* Generic Root/Debugger check bypass
See Docs: mobsf.github.io/docs/#/mobsf… – at Vancouver, British Columbia
OpSecX retweeted
MobSF v3.5.0 is out 🎉!
Sneak peak of the new MobSF AppSec Scorecard
#mobilesecurity #appsec
OpSecX retweeted
Malware Analysts Rejoice!
Excellent contribution from @quarkengine coming soon to MobSF.
github.com/MobSF/Mobile-Secu…
More power to OpenSource!
cc: @AviyelHq @OpenSecurity_IN
OpSecX retweeted
Releasing mobsfscan, a lightweight MobSF CLI for AppSec CI/CD usecases. It's a static analysis tool that finds insecure code patterns in your Android and iOS source code. Supports Java, Kotlin, Swift, and Objective C. Powered by @semgrep and libsast.
github.com/MobSF/mobsfscan
OpSecX retweeted
MobSF Dynamic Analysis Tutorial
youtu.be/1NIQs82n3nw?t=763
#mobsf #pentest #mobilepentest #mobilesecurity
OpSecX retweeted
MobSF v3.4.3 is out with Android Dynamic Analyzer Improvements. A new TLS/SSL Security tester module is now available.
ALT TLS/SSL Tester MobSF
OpSecX retweeted
[NEW Blog]
Detecting zero days in software supply chain with static and dynamic analysis ajinabraham.com/blog/detecti…
cc:
@r2cdev
OpSecX retweeted
MobSF 3.2.9 is released.
See What's New: mobsf.github.io/Mobile-Secur…
Also now available in pypi: pypi.org/project/mobsf/
A glimpse of new features.
OpSecX retweeted
Bypassing SSL Pinning and Traffic Redirection to Burp Suite using MobSF and Genymotion
justinpineda.com/2020/11/27/…
OpSecX retweeted
Friday Pentest Tip: Got shell, but can't install or download stuff. Abuse pip to download files.
pip download <url>
ls /tmp | grep unpack
cat /tmp/<pip-xxxx-unpack/file_name>
You will see some errors, but the file will be downloaded under /tmp directory.
#pentest #security
ALT Download when curl/wget etc. are not available.
OpSecX retweeted
Friday Pentest Tip: Got shell access and you can compile/download stuff, but can't set execute permission due to blocked chmod or its underlying syscalls.
Try
/lib/x86_64-linux-gnu/ld-2.27.so <ELF binary>
Look for dynamic linker in
/lib/ld-*
/lib/x86_64-linux-gnu/ld-*
ALT PoC for running elf binaries when you cannot set execute permission.
OpSecX retweeted
Friday Pentest Tip: Got access to a privileged container/k8s cluster? Escape to host with nsenter.
nsenter --all --target=1 uname -a
More tools and techniques: github.com/ajinabraham/aws_s…
OpSecX retweeted
Friday Pentest Tip: When you are testing Path Traversal on the latest Nginx versions, instead of ../ try adding forward slashes before your payload.
medium.com/appsflyer/nginx-m…
#websec #appsec #pentest #pathtraversal #owasp
OpSecX retweeted
Here is a great step-by-step guide for adding NodeJsScan (by @ajinabraham) using #Semgrep to your CI pipeline with @gitlab , courtesy of @abhaybhargav 🙏.
abhaybhargav.com/building-a-…
OpSecX retweeted
If you missed our MobSF BlackHat Arsenal Talk, Catch us live tomorrow, 12 PM PDT at @defcon demo labs along with other great open source security tools!
#opensource
OpSecX retweeted
I gave a talk on nodejsscan v4 yesterday. Here is the recording youtu.be/kTjICeZCvS0
Talked about the tool architecture, accurate detections with 70+ semgrep rules, slack and email integrations, devsecops use case etc.
Thanks to @r2cdev for hosting me. – at Montréal, Québec
OpSecX retweeted
Releasing 𝗻𝗼𝗱𝗲𝗷𝘀𝘀𝗰𝗮𝗻 𝘃𝟰 ⚡
Powered by semantic aware semgrep from @r2cdev with over 70+ improved rules. Try now
docker pull opensecurity/nodejsscan:latest
docker run -it -p 9090:9090 opensecurity/nodejsscan:latest
github.com/ajinabraham/nodej…
#appsec #nodejs #devsecops
ALT nodejsscan v4
ALT Slack Alerts from nodejsscan
ALT nodejsscan findings
ALT nodejsscan SAST
OpSecX retweeted
Finally I did it. My new Blog is live. Will try to deliver new stuff on a weekly basis. Let's start with a short howto on dockerized #MobSF and enabling the Dynamic Analyzer dreher.in/posts/2020/may/28/… @OpenSecurity_IN @mobilesecurity_ @g0tmi1k @CyberWarship