Following the frida script published last year by Piergiovanni, we found another way to bypass all SSL certificate checks performed by most applications on Android devices, obviously including SSL pinning.…
*** EDIT (2018-03-12): This script served me very well during these last months and I've finally decided to publish it. It is now included in my Tactical Exploitation Toolkit. As a…
In my recent and somewhat surprising exploration of Windows PowerShell (stay tuned for a longer post on this subject) I have produced a patch for the Invoke-Shellcode cmdlet distributed with the…
Having honed my skills during the X.25 and Phreaking era, I've always been a vocal proponent of a tactical approach to penetration testing that does not focus on exploiting known software…
Hi! Here you can download the slides of my talk presented at HackInBo 2017 Winter Edition named "Advanced mobile penetration testing with Brida". Federico Dotta - Advanced mobile penetration testing…
Recently, we tested a Web application with NTLM authentication. The authentication works correctly with any browser, but failed when inserting Burp Suite in the middle (with NTLM suitably configured). Sniffing with…
In this period, I spend a huge portion of my working time doing penetration test on mobile applications, mainly Android and iOS. I personally consider this kind of test much…
Recently I became one of the authors of one of the most useful (in my opinion) Burp Suite Plugin, Autorize. Autorize is a plugin created by Barak Tawily, that helps to speed up…
