Research
Mobile
- Mobile Lab
Tearing the APK apart: the static pass that finds a critical before you set a proxy
The APK on your disk is your target's source code, config, and secrets in one zip. One curl against a Firebase URL you grep out of strings.xml can be a world-readable database — the whole report, before you intercept a single request. Here's the static pass that finds it.
- Mobile Lab
SSL pinning bypass with Frida on Android: the layer-by-layer field guide
A field guide for authorized Android SSL pinning bypass with Frida: proxy-ignore, user vs system CA trust, Android 14 Conscrypt APEX, OkHttp, TrustManager, native BoringSSL, Flutter, and why universal scripts fail.