Security Researcher // OAuth & OIDC Specialist // Bug Bounty Hunter
Fuzzing for Exposed Origin Hosts
Intro After spending a lot of time staring at this page, I was a little tired of seeing it. Over the past few months, I’ve developed a testing methodology for discovering origin hosts. I originally thought that this methodology was just a WAF bypass. However, in the six months it took me to write this up, I’ve used origin host discovery to find applications with unlisted DNS addresses, to access restricted application paths, and to perform server-side attacks with absolutely no rate limits or content filtering. Since this is a methodology and not a direct vulnerability, the potential uses are limited only by your imagination. ...
Cert unpinning with Frida
This guide will enable you to unpin android applications, and forward traffic to a local proxy (i.e. Burp/Caido/Zap) running on port :8080 on your local machine. References: https://gist.github.com/teknogeek/4dc35fb3801bd7f13e5f0da5b784c725 https://gitlab.com/newbit/rootAVD https://github.com/frida/frida/releases Prerequisites You should be running an emulated device with Play Store enabled. You have a rooted device and adb working. If you do not already, follow instructions on https://gitlab.com/newbit/rootAVD Modern versions of android require you to use the “FAKEBOOTIMG” option with rootAVD. More info can be found at the link above. You may need to do a clean boot during the setup like so: emulator @device_name -no-snapshot-load ...