Publications

Pentest Reports

7ASecurity is a Cure53 partner since 2011, the following list links to public Cure53 pentest reports in which 7ASecurity participated. Please note all those reports were proudly published upon explicit request by the project maintainers, or the party that sponsored the penetration test in coordination with the project maintainer.

• Analysis-Report "Study the Great Nation" Android App (OTF) 09.2019
• Analysis-Report Chinese Police App "BXAQ" (OTF) 03.2019
• Pentest-Report Exodus iOS Mobile App 03.2019
• Analysis-Report Chinese Police App "IJOP" (HRW) 12.2018
• Pentest-Report Open Policy Agent(CNCF) 08.2018
• Pentest-Report imToken Wallet 05.2018
• Pentest-Report Gravitational Teleport 05.2018
• Pentest-Report Whistler (BAM) 02.2018
• Pentest-Report Psiphon 07.2017
• Pentest-Report Briar Project App & Protocol (OTF) 03.2017
• Pentest-Report Padlock (OTF) 04.2016
• Pentest-Report Peerio (OTF) 09.2015
• Pentest-Report SmartSheriff 2 (OTF) 10.2015
• Pentest-Report OpenKeychain (OTF) 08.2015
• Pentest-Report SmartSheriff (OTF) 07.2015
• Pentest-Report F-Droid / Bazaar (RFA) 01.2015
• Pentest-Report Onion Browser (RFA) 04.2014
• Pentest-Report Globaleaks (RFA) 06.2013

Tools

OWASP OWTF, an OWASP flagship project, was originally developed by 7ASecurity and is now maintained by a worldwide team of volunteers. Download, Contribute

Presentations

• Coming soon: Sexy Mobile App Attacks by Example
• Chinese Police and CloudPets (blog, slides, video1, interview, video2 soon)
• Pwning Mobile Apps Without Root or Jailbreak (slides)
• Smart Sheriff, Dumb Idea, the wild west of government assisted parenting (slides, video)
• XXE Exposed: SQLi, XSS, XXE and XEE against Web Services (slides, demo)
• OWASP OWTF - Summer Storm - OWASP AppSec EU (slides, video)
• Pentesting like a grandmaster (slides, interview)
• VSA: The Virtual Scripted Attacker (slides)
• Workshop: Introducing OWASP OWTF (slides)
• Legal and efficient web app testing without permission (slides, video)
• Offensive (Web, etc) Testing Framework: My gift for the community (slides)
• Silent web app testing by example (slides)
• Web app testing without attack traffic (slides)