notes
What I know: how things work, plus the cheat sheets I keep open while working.
Android Debugging notes 4 min 27 Sept 2026 How a crash shows up in logcat and how to isolate it: the ring buffers, priority and tag filters, the clear-reproduce-read sequence, and reading the FATAL EXCEPTION trace down to the line that caused it. Deep Links and URL Schemes on Android notes 3 min 27 Sept 2026 Testing Android deep links: how intent filters declare them, how App Links verify ownership while custom schemes cannot, and how to craft URIs that expose handlers trusting attacker-controlled data. Exported Components and the IPC Attack Surface notes 5 min 27 Sept 2026 How to test an Android app's exported components: enumerate activities, services, broadcast receivers, and content providers from the manifest, then invoke each one with am or drozer and judge whether the functionality behind it should be reachable from outside. Local Storage on Android notes 3 min 27 Sept 2026 Testing Android on-disk storage beyond SharedPreferences: internal files, cache, SQLite and Room databases, and external storage, plus reading the sandbox back with run-as and adb. SharedPreferences on Android notes 3 min 27 Sept 2026 Testing Android SharedPreferences: the plaintext XML backing store, the mode flags, EncryptedSharedPreferences and DataStore, and reading the store back from a device. WebViews in Android Apps notes 4 min 27 Sept 2026 Testing Android WebViews: the JavaScript bridge, what content the WebView loads, file and content access, mixed content and certificate errors, and remote debugging, with the pass and fail conditions for each. DIVA Lab Writeups notes 8 min 27 Sept 2026 Writeups for the DIVA (Damn Insecure and Vulnerable App) Android labs: each solved lab gets a section with the task, the vulnerable code, the exploit, and the finding, covering Insecure Logging, the hardcoded vendor key, the third-party credentials stored plaintext in SharedPreferences, a SQLite database, a temp file, and external storage, a SQL injection, and a WebView loading attacker content with JavaScript enabled. MHL IOTConnect Lab Writeup notes 3 min 27 Sept 2026 Solving the Mobile Hacking Lab IOTConnect challenge: every signup is a guest and guests are locked out of the master switch in the UI, the receiver that actually enforces the PIN is reachable from outside the app, and a broadcast brute force turns on every device. Ansible Foundations notes 3 min 25 Sept 2026 What Ansible is, how playbooks, inventory, and roles fit together, what idempotence and handlers mean, and how check mode makes changes safe to preview. Reverse Shells on Android notes 2 min 21 Sept 2026 Reverse shells on Android: mksh has no /dev/tcp, toybox nc has no -e, so sh is piped between two nc connections, with 10.0.2.2 as the emulator's alias for the host. MHL Cyclic Scanner Lab Writeup notes 5 min 21 Sept 2026 Solving the Mobile Hacking Lab Cyclic Scanner challenge: a foreground service that walks shared storage every six seconds, a sha1sum command built by string concatenation into sh -c, the file name as the injection vector, and an adb quoting mistake that runs the payload as root before the app ever sees it. MHL Strings Lab Writeup notes 5 min 20 Sept 2026 Solving the Mobile Hacking Lab Strings challenge: an exported deep-link activity, a date-stamped preference that no code path writes, AES parameters pulled out of the dex string pool, and a native function that returns a decoy while the flag stays in RAM. Unpacking and Rebuilding with apktool notes 6 min 19 Sept 2026 apktool for Android: decoding an APK into a readable manifest, resources, and smali, patching what you find, rebuilding, signing, and getting the patched build installed. Decompiling with jadx notes 5 min 19 Sept 2026 jadx for Android: turning an APK's bytecode back into readable Java from the CLI and the GUI, searching the tree for secrets and weak crypto, what the error count means, and when to fall back to smali, native tools, or Frida. The OWASP MAS Project notes 2 min 19 Sept 2026 The OWASP Mobile Application Security (MAS) project: what MASVS, MASWE, MASTG, and the MAS Checklist each do, and the testing profiles that set the bar for an assessment. Static and Dynamic Analysis of Mobile Apps notes 3 min 18 Sept 2026 Static and dynamic analysis of mobile apps: what each one covers, where manual code review finds what scanners miss, and why web findings like CSRF and reflected XSS rarely apply to a mobile app. Android Debug Bridge (ADB) notes 4 min 15 Sept 2026 The command reference for adb: connecting, shells, file transfer, package management, starting components, logcat, dumpsys, and the port forwarding that every other tool depends on. Android Lab Setup notes 5 min 15 Sept 2026 Setting up the Android testing lab: Android Studio and the SDK, an emulator you can actually root, a writable system partition, and the physical-device path when the emulator will not do. Dynamic Instrumentation with Frida notes 5 min 15 Sept 2026 Frida for mobile app testing: how injection works, matching frida-server to the device, spawning and attaching, writing hooks to read and rewrite an app's behaviour at runtime, Objection for the common jobs, and Gadget when the device is not rooted. Intercepting Traffic with Burp Suite notes 9 min 15 Sept 2026 Getting a mobile app's HTTPS through Burp: route traffic to the proxy, make the app trust the CA, and defeat certificate pinning. The steps below are the Android procedure; iOS follows the same three-step shape. Automated Analysis with MobSF notes 3 min 15 Sept 2026 MobSF for Android: running it in Docker, the static-analysis report, driving the dynamic analyzer against a rooted VM, the REST API for CI, and where automated triage stops and manual work begins. Android Foundations notes 12 min 14 Sept 2026 How Android is built from the kernel up, the security features that protect it, and the basics of Android apps: the sandbox, the manifest, components, IPC, signing, and publishing. Active Directory Concepts notes 12 min 01 Aug 2026 The terms the Active Directory workflow and its attack notes assume. AD Lateral Movement notes 5 min 01 Aug 2026 Lateral movement reuses a credential (password or NT hash) to run code on another host, no cracking needed. AutoRecon notes 1 min 18 Jul 2026 AutoRecon runs port scans and starts additional enumeration based on the services it finds.