Bug hunter and exploiter in web security, *OSX, and mobile applications.https://x64.sh/https://x64.sh/posts/deploy-and-destroy-featuring-certificates/https://x64.sh/posts/deploy-and-destroy-featuring-certificates/Setting up devices for security research deployment often takes longer than the testing itself. Notes and tooling for standing up (and tearing down) an Android AVD each engagement — including installing the Burp CA on Android 14+.Thu, 21 Nov 2024 00:00:00 GMTPentestingMobilehttps://x64.sh/posts/misconfigured-microsoft-content-provider/https://x64.sh/posts/misconfigured-microsoft-content-provider/The misconfigured content provider bug in com.microsoft.launcher is disclosing issues with the proper functioning of this Android launcher application.Sun, 15 Oct 2023 00:00:00 GMTVuln ResearchMobilehttps://x64.sh/posts/servicenow-access-control-admin-takeover/https://x64.sh/posts/servicenow-access-control-admin-takeover/An XHR request to xmlhttp.do with the "ChartDataProcessor" processor in the POST request allows the enumeration of the ServiceNow GQL database, including read access to the `sys_user_session` and `sys_user_token` tables, which provide the necessary information to generate valid `glide_user_activity` and `glide_session_store` cookies, and the X-Usertoken header to allow privilege escalation to any previously authenticated user..Mon, 26 Jun 2023 00:00:00 GMTVuln ResearchWebhttps://x64.sh/posts/jetengine-author-rce/https://x64.sh/posts/jetengine-author-rce/The plugin includes uploaded files without adequately ensuring that they are not executable, leading to a remote code execution vulnerability.Mon, 20 Mar 2023 00:00:00 GMTVuln ResearchWebhttps://x64.sh/posts/switchresx-vulnerability/https://x64.sh/posts/switchresx-vulnerability/SwitchResX installs a privileged helper tool that runs as root but fails to validate incoming XPC connections. This post walks through decompiling the helper and abusing its exported moveFiles method to achieve local privilege escalation.Mon, 31 Oct 2022 00:00:00 GMTVuln ResearchmacOShttps://x64.sh/posts/improper-access-control-factory-camera/https://x64.sh/posts/improper-access-control-factory-camera/ACL issue leading to system privileges.Mon, 01 Nov 2021 00:00:00 GMTVuln ResearchMobilehttps://x64.sh/posts/ntlm-exchange/https://x64.sh/posts/ntlm-exchange/Leaking FQDN information from Microsoft Exchange by parsing the AV_PAIR structures returned in an NTLM challenge over RPC-over-HTTP.Sun, 21 Mar 2021 00:00:00 GMTPentestingWebhttps://x64.sh/posts/xss-encoding-generator/https://x64.sh/posts/xss-encoding-generator/A short Python tool that generates XSS payloads in several encodings — HTML entities, unicode escapes, and URL encoding — to help bypass WAFs during testing.Tue, 19 Jan 2021 00:00:00 GMTToolingWebhttps://x64.sh/posts/enter-the-realm/https://x64.sh/posts/enter-the-realm/Using Frida to hook the RealmConfiguration function on Android, an encrypted Realm database's encryption key can be extracted at runtime. The recovered key lets you decrypt and read the database contents, demonstrated against both a test app and the Element messenger.Mon, 21 Dec 2020 00:00:00 GMTPentestingMobilehttps://x64.sh/posts/badbinder-emulator-root/https://x64.sh/posts/badbinder-emulator-root/During a mobile audit engagement the target application enforced root and emulator detection. This post walks through leveraging the reintroduced BadBinder (CVE-2019-2215) kernel bug to gain temporary root on the Android Studio emulator and bypass those protections.Sat, 08 Aug 2020 00:00:00 GMTPentestingMobilehttps://x64.sh/posts/junos-xss-challenge/https://x64.sh/posts/junos-xss-challenge/Breaking down a neat zero-interaction XSS challenge payload from @junorouse — abusing a URI scheme, a name attribute, onfocus, and a domain + URL-hash bypass to reach execution.Sat, 01 Jun 2019 00:00:00 GMTPentestingWebhttps://x64.sh/posts/frida-and-objection/https://x64.sh/posts/frida-and-objection/Frida is a dynamic instrumentation toolkit that lets you introspect running applications and inject JavaScript to hook functions and APIs. This post covers using Frida on mobile devices along with Objection, a dynamic instrumentation framework built on top of it.Sat, 01 Jun 2019 00:00:00 GMTPentestingMobile