brooooo i'm literally just looking at this chall rn, was going to make a video 😂 this looks too good though, i think i'll just watch your video instead 😁
@0xbro
2 жыл бұрын
ahaha oooops, I hope I didn't spoil too much :P
@_CryptoCat
2 жыл бұрын
@@0xbro Nah it was excellent, nice work!
@ancestrall794
9 күн бұрын
Awesome video bro
@alexn9411
Жыл бұрын
the best video! keep do it!! great!
@0xbro
Жыл бұрын
🙏🙏🙏
@joaojunqueira4445
Жыл бұрын
Great and well explained, i love it! Greetings from Brasil!
@BastelPichi
Жыл бұрын
Great tutorial, helped me alot "using" an api (im not supposed to lol). Keep making those great videos!
@0xbro
Жыл бұрын
Very glad it helped you!
@angryman9333
Жыл бұрын
Keep at it man.
@AvinashKumar-fe8xb
2 жыл бұрын
Great work :) subscribed!
@0xbro
2 жыл бұрын
Thank you so much!
@agentbayabas
2 жыл бұрын
thank you for this video
@0xbro
2 жыл бұрын
Thanks to you for being here!
@sudosu403
2 жыл бұрын
Great content! Subbed.
@0xbro
2 жыл бұрын
Thank you so much, really!
@mkowalski997
2 жыл бұрын
Great video, good explaned.
@0xbro
2 жыл бұрын
Thanks!
@kachraseth7746
2 жыл бұрын
Great content !
@0xbro
2 жыл бұрын
Thank you so much!
@_techwaves
2 жыл бұрын
Is this really rated easy ? Looks very complicated to me lol Great video btw 🔥
@0xbro
2 жыл бұрын
Thank you very very much! Hope it was useful for you! 🙏🏼
@aat2312
2 жыл бұрын
Frida is not able to spawn the target application, I tried the exact same steps, rooted avd, the app i am testing is built with flutter. Can u help?
@0xbro
2 жыл бұрын
Is frida-server running? Are you able to list processes and pids?
@aat2312
2 жыл бұрын
@@0xbro yes it is
@0xbro
2 жыл бұрын
@@aat2312 Alright, did you tried starting other apps outside from the one you are interested? Furthermore, is your app a beta/test application or is it a production/corporate one? I known that some mitigation in real-life application consists into inspecting device processes searching for "frida" and preventing the application from starting, so are you able to decompile the application and search for this kind of behavior?
@aat2312
2 жыл бұрын
@@0xbro No other apps are spawned by frida, I tried with calculator as well. when i give the command to spawn the app, the emulator will go black for 2 secs and go to the lock screen
@mukto2004
Жыл бұрын
loved your explaination
@0xbro
Жыл бұрын
❤🔥
@esadecimale
2 жыл бұрын
This video = 🔥
@0xbro
2 жыл бұрын
🙏🏻🙏🏻🙏🏻
@kietpoki3
Жыл бұрын
great explaining
@0xbro
Жыл бұрын
Thanks!! 🙏🏼
@flaviogjoni5747
Жыл бұрын
I was looking for cryptocat's video but apparently I found something better ahaha loved your explaination, solo un po' strano sentire l'accento italiano :D
@0xbro
Жыл бұрын
Non garantisco il miglioramento del mio accento però ahah 🤌
@ca7986
2 жыл бұрын
Amazing video
@0xbro
2 жыл бұрын
Thank you very much!
@cavalfou
Жыл бұрын
Great. In theory, client-side, is it ALWAYS POSSIBLE to intercept packet of our own machine ? Does an encryption technique exist to prevent that ? SSL Pinning is pretty much pointless, except for the little obfuscation ?
@0xbro
Жыл бұрын
Well, SSL Pinning is not related to obfuscation but is the technique that prevents us from using our self-signed certificate to decrypt HTTPS requests. Having said that, I think that yes, it's almost always possible to intercept our packets, but reality is that it depends on how much time we have to try do bypass mitigations implemented within the app. A highly obfuscated APK, implementing SSL pinning, which avoid execution on rooted devices and which can run only on Android 10 or later, probably it can be bypassed taking a long time and effort, but most of the time you don't have the material time to get through all these protections, especially during pentest activities.
@MultiFRAFER
2 жыл бұрын
Figo gg farai altri video su frida tools
@0xbro
2 жыл бұрын
Credo di sì perchè Frida è davvero un tool molto potente che può tornare utile in diverse occasioni. Al momento però non lo so ancora usare benissimo, perciò prima devo addentrarmi un po' di più nel suo utilizzo. Comunque in linea di massima sì, conto di farci su qualche altro video in futuro :)
@valish_
Жыл бұрын
As a Android Dev, How can i avoid this bypass technique for secure my app?
@0xbro
Жыл бұрын
Nice question! The short answer is: you can't. You can highly increase the time and effort an attacker can spend on trying to bypass your implementations, but at the end of the day it's a "cat and mouse game". You can check if a device is rooted, runs a frida-server, is virtualized, etc. but attackers can always try to hook Android API calls or patch the application. The best way to protect an APK is to make sure the application code and back-end code are both secure. Then you can implement all kinds of device/certificate checks and obfuscate the code, but this is only to make attackers' life harder, "security-through-obscurity" should never be considered a security protection.
@SumanRoy.official
Жыл бұрын
Question - I was working with an app lately and my phone is not rooted. I wanted to intercept those http calls, however tried using Frida, and the only problem I am having that Frida gets stuck while it spawns the app. That's it, it stays stuck at "Spawning" and does not go thru. Any solutions?
@0xbro
Жыл бұрын
It never happened to me so I don't really known, I'm sorry :(
@user-fl7jx8tb8e
Жыл бұрын
hi which application do u use to launch a rooted virtual device?
@chsjsiwixhsiwidjjcksis5649
2 жыл бұрын
can we patch smali to bypass certificate pinning ?
@0xbro
2 жыл бұрын
depending on how certificate pinning is implemented, yes it might be possible to bypass it even by editing the smali code. For example, if the application implements a specific functionality that returns a different value based on the comparison of the two certificates, you could force it to always return 1, even if the two certificates are different. This is just an extremely simple case, but it is to make you understand that it is feasible this way as well, although it is certainly more complex as a bypass technique :)
@Heart0rHead
Жыл бұрын
What if the app detects frida server running and just crashes at startup?
@0xbro
Жыл бұрын
Good question! I think the possibilities are two: the first one, which is maybe unrealistic, is to try to hook before anything else the function responsible to check if Frida is in place. The second one is to decompile and patch the APK trying to remove that function. You can also try to decompile and reverse the logic behind the function, maybe they are implementing a weak check that can be bypassed easily.
@Heart0rHead
Жыл бұрын
@@0xbro I have already tried the fork of Frida that randomises all processes names and file locations of Frida but it didn't work also.
@sema8125
Жыл бұрын
Hi bro, Which emulator you use and which version of Xposed. Im trying to install Xposed but failed. Pls help
@0xbro
Жыл бұрын
Hey mate! I'm using Genymotion and I installed Xposed version 3.1.5 on an Android 6.0
@adnanjayafar
11 ай бұрын
I cant setup proxy on the device. HELP
@masterfan0
2 жыл бұрын
I've sent you an email. Looking forward for the answer
Пікірлер: 57