Android – Mikołaj Kurcin

Use Frida to controll Unity app (IL2CPP)

March 15, 2021March 15, 2021Mikołaj Kurcin

In applications, changing variables or forcing execution methods during runtime can be really useful to bypass some security or even to write hacks. On Android, we can change binary libraries…Continue readingUse Frida to controll Unity app (IL2CPP)

Intercept non-HTTP communication via BurpSuite

February 18, 2021February 18, 2021Mikołaj Kurcin

Burp Suite doesn’t intercept non HTTP/WebSocket communication, however some apps use, for example, plain TCP connection. I wrote a simple python server and client that exchanged messages via the mentioned…Continue readingIntercept non-HTTP communication via BurpSuite

Fooling app with MockServer (HTTPS)

January 12, 2021January 13, 2021Mikołaj Kurcin

Sometimes the app’s communication is written in a way that cannot be intercepted by Burp Suite, OWASP ZAP, etc. but it’s still HTTPS communication. For example, I wrote an app…Continue readingFooling app with MockServer (HTTPS)

Hack any (not encrypted) communication

January 3, 2021January 3, 2021Mikołaj Kurcin

Modifying data transferred and received is one of the simplest ways to hack an app. For example, I created one that communicates with a server via sockets and they can…Continue readingHack any (not encrypted) communication

Configure Android to intercept basic https requests for apps

November 8, 2020December 7, 2020Mikołaj Kurcin

HTTPS is basically HTTP over TLS (also called SSL) and HTTP is easy to intercept. In this case, only encryption is our problem. Fortunately for us, this is designed to…Continue readingConfigure Android to intercept basic https requests for apps