Practical Mobile App Attacks By Example
summary
Live demos show a netcat + yes DoS via endless stream that crashes apps, plaintext SD storage leaking identities (one case risks death), XSS from concatenating unencoded SD text, CSS copy‑paste payloads that trigger path traversal overwrites, RTL URL spoofing, custom URL handlers that quit apps, update checks over HTTP that trigger premium dialers, hardcoded XOR/AES keys discoverable with a Python snippet, and a SQLi that loads an extension to get code execution (SQLi → load .so → RCE).
AI-written summary · about
chapters (12)
- 0:00Start
- 1:41Denial of Service Attacks
- 5:59Copy Paste Text
- 8:02Spoofing Attacks
- 8:58Custom Url Handlers
- 10:49Update Text
- 11:41User Dialog for Warnings
- 14:33Clear Text Http Communication
- 21:22Crypt Messenger
- 23:21Mandated Application in South Korea
- 27:59Code Execution
- 31:06Api Attacks
related talks
42mModern web application bugs
47mLive Hacking: Breaking into Your Web App
50mModern WebApp Vulnerabilities
41mJust Another Live Hacking - How Insecure Is Secure Enough?
07m"The significance of mobile exploit applications"
01h 02mLive Hacking: Breaking into your Web App
41mLive Hacking: Breaking into Your Web App
32mHack Your Own App: Getting Started with Mobile Penetration Testing