Hacking Modern Desktop apps with XSS and RCE: Free Workshop – Jan 14

Are you the kind of person who enjoys Workshops with practical information that you can immediately apply to your work? “Hacking Modern Desktop apps: Master the Future of Attack Vectors” is a desktop app security course that provides you with case studies from real-world vulnerable applications. Register now to learn techniques to take your desktop …

Get 25% off any 7ASecurity course!

2020 was tough but the New Year Sale is here! 🙂 Missed Blackhat USA, HITB, OWASP Global AppSec, Nullcon. Now is the time to get any 7ASecurity course at a fraction of price. The same material with lifetime access to a training portal. Also, contains step-by-step video recordings, slides and lab exercises, including all future …

Get 40% off any 7ASecurity course!

Our first ever Black Friday Sale, take advantage of this opportunity: This is the same material we teach at Blackhat USA, HITB, OWASP Global AppSec, Nullcon and many other events at a fraction of the price: Get 40% off any self-paced 7ASecurity course! Use code: BFCM40 Offer valid from November 18th until November 30th Some …

Chinese Police and CloudPets slides, video and interview

NOTE: In 2020, a new talk will substantially improve this one to include an interesting third app and better explain the other ones. In late 2019, I had the privilege of giving a talk and an interview at SEC-T and DeepSec about “Chinese Police and CloudPets”. Basically a summary of highlights from 3 different pentest …

Hacking Mandated Apps – Part 8: Password Leak via API! [ MSTG-AUTH-1 ]

Part 1: Intro Part 2: Translating APKs Part 3: What is SSL? [ MSTG‑NETWORK‑1 ] Part 4: How NOT to implement SSL [ MSTG‑NETWORK‑2 ] Part 5: RCE in WebView [ MSTG-PLATFORM-7 ] Part 6: XOR Crypto FAIL [ MSTG-CRYPTO-1 ] Part 7: AES Crypto FAIL [ MSTG-CRYPTO-1 ] The OWASP Mobile Application Security Verification …

Hacking Mandated Apps – Part 7: AES Crypto FAIL [ MSTG-CRYPTO-1 ]

Part 1: Intro Part 2: Translating APKs Part 3: What is SSL? [ MSTG‑NETWORK‑1 ] Part 4: How NOT to implement SSL [ MSTG‑NETWORK‑2 ] Part 5: RCE in WebView [ MSTG-PLATFORM-7 ] Part 6: XOR Crypto FAIL [ MSTG-CRYPTO-1 ] The OWASP Mobile Application Security Verification Standard classifies the flaw explained in this blog …