Categories
Tags
8ksec 8ksec.io aidl android anti-debug anti-frida anti-hook APK broadcast-receiver CC certification config content-provider CTF ctf cybersecurity cybertalents deep-links deeplink dex dexclassloader dylib dynamic-analysis dynamic-loading emulator exam exploitation file-encryption flutter frida ghidra hextree.io hook http-security ios ipc ISC2 jailbreak-detection Kali kiosk-mode logic-bug mobile mobile-exploitation network-interception pentest plugin privacy proxy-detection rce reverse-engineering runtime script smali sql-injection static-analysis swift tls-pinning token-extraction url-parsing url-scheme vulnerability web webview writeup WSL2
61 words
1 minutes
8kSec.io Android Challenges
My n00b Journey Through Android Security Challenges
Welcome to my writeup series for the 8kSec.io Android Application Exploitation Challenges. As a n00bie in Android security, I’m documenting my journey through 11 vulnerable Android applications that cover everything from password managers to privacy tools. Each challenge teaches different exploitation techniques including reverse engineering, dynamic analysis, and vulnerability discovery. Will it be easy? :“D
8kSec.io Android Challenges
Challenge 01: FactsDroid
Bypassing Flutter TLS pinning to intercept and manipulate network traffic in a fact-checking app.
375 words
|
2 minutes
Challenge 02: AndroPseudoProtect
2025-09-15
Exploiting IPC broadcast vulnerabilities to extract security tokens and bypass file encryption protection.
486 words
|
2 minutes
Challenge 03: AndroDialer
Android Deep Link Vulnerability Analysis with hardcoded authentication tokens.
792 words
|
4 minutes
Challenge 04: DroidCave
Android Content Provider SQL Injection Vulnerability Analysis with unprotected database access.
797 words
|
4 minutes
Challenge 05: BorderDroid
Android Kiosk Mode Bypass: Multiple Attack Vectors Against PIN-Protected Lock Screen with HTTP endpoint exploitation and broadcast receiver vulnerabilities.
1731 words
|
9 minutes
Challenge 07: DroidView
Silent Tor bypass and deanonymization in a ‘private’ Android browser via exported AIDL service abuse, dynamic receiver timing, and zero‑click WebView redirection.
1054 words
|
5 minutes
Challenge 08: DroidWars
Arbitrary code execution via unsafe dynamic plugin loading from /sdcard using DexClassLoader; PoC shows static initializer RCE and in-app evidence verification.
1099 words
|
5 minutes