Skip to content

Latest commit

 

History

History
115 lines (92 loc) · 9.32 KB

README.md

File metadata and controls

115 lines (92 loc) · 9.32 KB
Raw
Android Security Notes

Getting Started? » Buy me a coffee » Wanna Talk?

🚀 Android Security Notes? » Here, You will find important concepts, resources, hand-crafted and self-curated notes written by a kind-hearted fellow. The main purpose of this project is to serve as a First-Aid to newbies (like me) and intermediate peep who perform android security.

🤝 Wanna contribute? » If you see something wrong or incorrectly interpreted then open an issue or send a pull request. We appreciate your contribution and all suggestions/PRs are welcome. You can also ping me on twitter@iamsarvagyaa.

📜 Things to be done! » I started this project from scratch. Steadily, I will update more resources and notes that I've found useful while learning Android Security. The upcoming lineup for this project ...

  • I will add more resources
  • Add conference papers, notes and more
  • Write more blogposts related to android security ...

🗒️ Synopsis

↑ Getting Started

↑ HackerOne Reports

  • Account hijacking possible through ADB backup feature :: #12617
  • Twitter android app Fragment Injection :: #43988
  • Bypass Setup by External Activity Invoke :: #55064
  • Webview Vulnerablity in OwnCloud apk :: #87835
  • No permission set on Activities [Android App] :: #145402
  • Flaw in login with twitter to steal Oauth tokens :: #44492
  • Authentication Failed Mobile version :: #55530
  • Multiple Stored XSS on Sanbox.veris.in through Veris Frontdesk Android App :: #121275
  • Coinbase Android Security Vulnerabilities :: #5786
  • Insecure Data Storage in Vine Android App :: #44727
  • Sending payments via QR code does not require confirmation :: #126784
  • Bypass pin(4 digit passcode on your android app) :: #50884
  • REG: Content provider information leakage :: #146179
  • Shopify android client all API request's response leakage, including access_token, cookie, response header, response body content :: #56002
  • HTML/XSS rendered in Android App of Crashlytics through fabric.io :: #41856
  • ByPassing the email Validation Email on Sign up process in mobile apps :: #57764
  • Insecure Local Data Storage : Application stores data using a binary sqlite database :: #57918
  • Vulnerable to JavaScript injection. (WXS) (Javascript injection)! :: #54631
  • Coinbase Android Application - Bitcoin Wallet Leaks OAuth Response Code :: #5314
  • Reflected XSS in Zomato Mobile - category parameter :: #230119

↑ BugBounty Writeups

↑ CTF Challenge Writeups

↑ Healthy Digests

↑ Vulnerable Applications

  • hpAndro - One of the nice vulnerable android application to practice. Plenty of challenges are there, and most of the challenges are beginner friendly. I recommend everyone to checkout this vulnerable application. This challenge is maintained by hpandro1337, you can also checkout his YouTube Channel : Android AppSec.
  • InjuredAndroid - A vulnerable android application ctf examples based on bug bounty findings, exploitation concepts, and pure creativity. Created and maintained by B3nac.
  • Oversecured Vulnerable Android App - an Android app that aggregates all the platform's known and popular security vulnerabilities. Plenty of vulnerabilities are there to practice our Security skills. Vulnerable Lab maintained by Bagipro.

Wanna Contact with me?

📣 If you enjoyed this project and wanna appreciate me, Buy me a cup of coffee. You can also help via sharing this project among the community to help it grow. You may support me on Buy me a coffee, monetary contributions are always welcome. If you wish to sponsor this project, ping me - iamsarvagyaa[at]gmail.com