android-reverse-engineering-skill

Android 리버스 엔지니어링 및 API 추출 — Claude Code 스킬 Android APK/XAPK/JAR/AAR 파일을 디컴파일하고 앱에서 사용하는 HTTP API Retrofit 엔드포인트, OkHttp 호출, 하드코딩된 URL, 인증 패턴를 추출하여 원본 소스 코드 없이도 이를 문서화하고 재현할 수 있는 Claude Code 스킬입니다. 최상의 Kotlin 지원 : 최신 Android 앱은 Kotlin/KMP로 작성되며 R8로 심하게 난독화됩니다. 이 스킬은 R8이 제거할 수 없는 메타데이터에서 원래 Kotlin...

ToolsFx

ToolsFx English|中文 방문자 :eyes: 기능 인코딩 위키 base64 urlBase64 base16/32/36/45/58/62/85/91/92/100 base58check UrlEncode Unicode js hex\x61/js octal\140 binary/octal/decimal/hex custom base serial dict puny code quote printable uuEncode xxEncode escape/escapeAll 자동 디코드크랙...

Android-Security-Masterclass

Android セキュリティ マスタークラス 🛡️📱 公式 OWASP プロジェクト — Android 開発者とペンテスター向けのハンズオン OWASP MASVS/MASTG セキュリティトレーニングラボ — ミラーアーキテクチャ: 脆弱 ↔ セキュア ↔ 攻撃者 📖 概要 Android セキュリティ マスタークラス は、公式 OWASP プロジェクトであり、ミラーアーキテクチャ を採用して設計されています。Android 開発者とセキュリティ研究者に対して、脆弱性が 実際に どのようなものか、そして最新の Android 開発手法を用いて 正確に...

CVE-2026-54148

http4k is a functional toolkit for Kotlin HTTP applications. Prior to 4.51.0.0, 5.42.0.0, and 6.50.0.0, DigestAuthProvider.verify in http4k-security-digest does not compare the uri parameter in an Authorization: Digest response with the actual request URL. An attacker who captures a valid Digest...

CVE-2026-54147

http4k is a functional toolkit for Kotlin HTTP applications. Prior to 4.51.0.0, 5.42.0.0, and 6.50.0.0, DigestAuthProvider.verify in http4k-security-digest ignores its configured algorithm parameter and verifies every Digest response with hardcoded MD5. Deployments configured for SHA-256 therefor...

EUVD-2026-83042

http4k is a functional toolkit for Kotlin HTTP applications. Prior to 4.51.0.0, 5.42.0.0, and 6.50.0.0, DigestAuthProvider.verify in http4k-security-digest ignores its configured algorithm parameter and verifies every Digest response with hardcoded MD5. Deployments configured for SHA-256 therefor...

CVE-2026-54147 http4k: `DigestAuthProvider.verify` ignored configured algorithm and did not bind to request URI

http4k is a functional toolkit for Kotlin HTTP applications. Prior to 4.51.0.0, 5.42.0.0, and 6.50.0.0, DigestAuthProvider.verify in http4k-security-digest ignores its configured algorithm parameter and verifies every Digest response with hardcoded MD5. Deployments configured for SHA-256 therefor...

CVE-2026-54147 http4k: `DigestAuthProvider.verify` ignored configured algorithm and did not bind to request URI

http4k is a functional toolkit for Kotlin HTTP applications. Prior to 4.51.0.0, 5.42.0.0, and 6.50.0.0, DigestAuthProvider.verify in http4k-security-digest ignores its configured algorithm parameter and verifies every Digest response with hardcoded MD5. Deployments configured for SHA-256 therefor...

CVE-2026-54147

http4k-security-digest (a module of the Kotlin HTTP toolkit http4k) contains a bug in DigestAuthProvider.verify where the configured algorithm parameter is silently ignored and every digest response is verified with hardcoded MD5 , regardless of the intended algorithm. Deployments believing they ...

CVE-2026-54148 http4k: `DigestAuthProvider.verify` did not bind to request URI

http4k is a functional toolkit for Kotlin HTTP applications. Prior to 4.51.0.0, 5.42.0.0, and 6.50.0.0, DigestAuthProvider.verify in http4k-security-digest does not compare the uri parameter in an Authorization: Digest response with the actual request URL. An attacker who captures a valid Digest...

CVE-2026-54148 http4k: `DigestAuthProvider.verify` did not bind to request URI

http4k is a functional toolkit for Kotlin HTTP applications. Prior to 4.51.0.0, 5.42.0.0, and 6.50.0.0, DigestAuthProvider.verify in http4k-security-digest does not compare the uri parameter in an Authorization: Digest response with the actual request URL. An attacker who captures a valid Digest...

CVE-2026-63126: Integer Overflow or Wraparound

Wire provides gRPC and protocol buffers for Android, Kotlin, Swift, and Java. Prior to 6.4.5 and 7.0.0-alpha04, Wire protobuf readers do not consistently validate attacker-controlled lengths against the current logical message boundary before advancing cursors, pointers, limits, slices, or...

CVE-2026-57042

In multiple functions of DreamPickerReceiver.kt, there is a possible permission bypass due to a confused deputy. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation...

CVE-2026-53659

A flaw was found in http4k, a functional toolkit for Kotlin HTTP applications. The ServerFilters.GZip and RequestFilters.GunZip functions, along with underlying Gzip request-body decompression, do not limit the decompressed size of incoming data. An unauthenticated client can exploit this by...

CVE-2026-53659

http4k is a functional toolkit for Kotlin HTTP applications. Prior to 4.51.0.0, 5.42.0.0, and 6.49.0.0, ServerFilters.GZip, RequestFilters.GunZip, and the underlying Gzip request-body decompression functions impose no limit on decompressed size. An unauthenticated client can send a small...

JetBrains TeamCity < 2025.11.6 / 2026.1.x < 2026.1.2 Code Execution (CVE-2026-65906)

The version of JetBrains TeamCity installed on the remote host is prior to 2025.11.6, or version 2026.1 up to but not including 2026.1.2. It is, therefore, affected by a vulnerability: - In JetBrains TeamCity before 2026.1.2, 2025.11.6 code execution via Kotlin DSL sandbox escape was possible...

CVE-2026-53937

MCP Kotlin SDK is the Kotlin Multiplatform software development kit for the Model Context Protocol. In versions 0.7.0 through 0.12.0, ReadBuffer.append in kotlin-sdk-core/src/commonMain/kotlin/io/modelcontextprotocol/kotlin/sdk/shared/ReadBuffer.kt writes every chunk of bytes received from the...

CVE-2026-53937: Uncontrolled Resource Consumption

MCP Kotlin SDK is the Kotlin Multiplatform software development kit for the Model Context Protocol. In versions 0.7.0 through 0.12.0, ReadBuffer.append in kotlin-sdk-core/src/commonMain/kotlin/io/modelcontextprotocol/kotlin/sdk/shared/ReadBuffer.kt writes every chunk of bytes received from the...

CVE-2026-53937 MCP Kotlin SDK's unbounded line buffer in StdioServerTransport/StdioClientTransport leads to memory exhaustion (DoS)

MCP Kotlin SDK is the Kotlin Multiplatform software development kit for the Model Context Protocol. In versions 0.7.0 through 0.12.0, ReadBuffer.append in kotlin-sdk-core/src/commonMain/kotlin/io/modelcontextprotocol/kotlin/sdk/shared/ReadBuffer.kt writes every chunk of bytes received from the...

CVE-2026-53937 MCP Kotlin SDK's unbounded line buffer in StdioServerTransport/StdioClientTransport leads to memory exhaustion (DoS)

MCP Kotlin SDK is the Kotlin Multiplatform software development kit for the Model Context Protocol. In versions 0.7.0 through 0.12.0, ReadBuffer.append in kotlin-sdk-core/src/commonMain/kotlin/io/modelcontextprotocol/kotlin/sdk/shared/ReadBuffer.kt writes every chunk of bytes received from the...