objection

📱objection - Runtime Mobile Exploration objection is a runtime mobile exploration toolkit, powered by Frida, built to help you assess the security posture of your mobile applications, without needing a jailbreak. Supports both iOS and Android. Inspect and interact with container file systems...

objection

📱objection - ランタイムモバイル探索 objection は、Frida を搭載したランタイムモバイル探索ツールキットであり、脱獄を必要とせずにモバイルアプリケーションのセキュリティ状況を評価するために構築されました。 iOS と Android の両方をサポートします。 コンテナファイルシステムの検査と操作。 SSL ピンバイパス。 キーチェーンのダンプ。 ダンプやパッチなどのメモリ関連タスクを実行。 ヒープ上のオブジェクトの探索と操作。 さらに多くの機能... スクリーンショットはwikiでご覧いただけます。 installation インストールは pip3 insta...

Apepe

📲 Apepe 📲 APKファイルからアプリの情報を列挙する 🕵️ Apepeとは？ 🕵️ Apepe は、AndroidアプリのAPKファイルから情報を取得するためのプロジェクトです。コンテンツの抽出、アプリ設定の取得、検出された言語に基づくSSLピンバイパスの提案、AndroidManifest.xml・JSON・DEXファイルからのディープリンクの抽出などに使用できます。 ⚡ はじめに Apepeのインストールと使用方法の簡単なガイドです。 1. git clone https://github.com/oppsec/Apepe.git 2. pip install -r...

frida

frida This repository contains various Frida scripts for Android application penetration testing. I created this project to demonstrate the capabilities of the Frida dynamic-analysis framework. You can read my "Introduction to Frida" blog post on Medium, where I'm explaining how to use Frida with...

MobileApp-Pentest-Cheatsheet

移动应用渗透测试速查表 此移动应用渗透测试速查表旨在提供针对特定移动应用渗透测试主题和检查清单的高价值信息简明集合，并映射 OWASP Mobile Risk Top 10 以进行渗透测试。 移动应用安全测试发行版 一体化移动安全框架 Android 应用渗透测试 逆向工程与静态分析 动态与运行时分析 网络分析与服务端测试 绕过 Root 检测与 SSL 证书固定 安全库 iOS 应用渗透测试 在 iDevice 上访问文件系统 逆向工程与静态分析 动态与运行时分析 网络分析与服务端测试 绕过 Root 检测与 SSL 证书固定 安全库 移动渗透测试实验室 贡献 许可证...

ssl-kill-switch3

SSL Kill Switch 3 下一代 iOS 插件 SSLKillSwitch https://github.com/nabla-c0d3/ssl-kill-switch2，功能更多！ 新功能？ 已修复 Fishhook 支持（iOS 15+，ARM64/ARM64e），让你可以在非越狱时代进行 hook 已修复 Rootless 支持（iOS 15+，ARM64/ARM64e），rootless 快乐 : 新增 Hook SecIsInternalRelease，以便可以设置 AppleServerAuthenticationNoPinning 参见...

frida-ssl-bypass

🔓 Frida SSL Pinning Bypass 适用于 Android 的通用 SSL/TLS 证书固定绕过工具 作者：Danieldev （GitHub: @danieldev23 | Telegram: @zadevz） 一套全面的 Frida 工具包，可绕过任何 Android 应用 的 SSL 固定——覆盖 Java 层和 Native 层，从标准的 OkHttp 固定到 Facebook 自定义的 proxygen native 实现。 ✨ 功能特性 功能| 状态 ---|--- Java TrustManager / SSLContext| ✅...

SUSE SLED15 / SLES15 Security Update : curl (SUSE-SU-2026:4048-1)

The remote SUSE Linux SLED15 / SLEDSAP15 / SLES15 / SLESSAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:4048-1 advisory. - CVE-2026-13608: flow in OpenLDAP SASL negotiation can cause an authentication bypass bsc1277476. -...

CVE-2026-81871

A flaw was found in OpenTelemetry-Go, specifically within its gRPC log exporter. This vulnerability allows a network attacker to bypass the intended private Certificate Authority CA pinning and mutual Transport Layer Security TLS configurations. The issue arises because the environment-only TLS...

Security update for curl

This update for curl fixes the following issues: CVE-2026-13608: flow in OpenLDAP SASL negotiation can cause an authentication bypass bsc1277476. CVE-2026-80229: premature free can lead to OpenSSL provider use-after-free bsc1277479. CVE-2026-80230: OpenSSL pinning bypass can allow unauthenticated...

SUSE-SU-2026:4048-1 Security update for curl

This update for curl fixes the following issues: - CVE-2026-13608: flow in OpenLDAP SASL negotiation can cause an authentication bypass bsc1277476. - CVE-2026-80229: premature free can lead to OpenSSL provider use-after-free bsc1277479. - CVE-2026-80230: OpenSSL pinning bypass can allow...

ALPINE-CVE-2026-80230

When CURLOPTPINNEDPUBLICKEY is configured alongside options that disable standard peer verification CURLOPTSSLVERIFYPEER = 0 and CURLOPTSSLVERIFYHOST = 0, libcurl fails to enforce public key pinning on connections established without a presented server certificate. Bypassing the pinning check und...

AZL-99770 CVE-2026-80230 affecting package curl 8.11.1-11

When CURLOPTPINNEDPUBLICKEY is configured alongside options that disable standard peer verification CURLOPTSSLVERIFYPEER = 0 and CURLOPTSSLVERIFYHOST = 0, libcurl fails to enforce public key pinning on connections established without a presented server certificate. Bypassing the pinning check und...

AZL-99873 CVE-2026-80230 affecting package tensorflow 2.16.1-11

When CURLOPTPINNEDPUBLICKEY is configured alongside options that disable standard peer verification CURLOPTSSLVERIFYPEER = 0 and CURLOPTSSLVERIFYHOST = 0, libcurl fails to enforce public key pinning on connections established without a presented server certificate. Bypassing the pinning check und...

CVE-2026-80230

The libcurl library contains a vulnerability where it fails to enforce public key pinning when CURLOPT_PINNEDPUBLICKEY is used in conjunction with options that disable standard peer verification (CURLOPT_SSL_VERIFYPEER = 0 and CURLOPT_SSL_VERIFYHOST = 0). Under these specific conditions, libcurl ...

CVE-2026-80230 OpenSSL pinning bypass

When CURLOPTPINNEDPUBLICKEY is configured alongside options that disable standard peer verification CURLOPTSSLVERIFYPEER = 0 and CURLOPTSSLVERIFYHOST = 0, libcurl fails to enforce public key pinning on connections established without a presented server certificate. Bypassing the pinning check und...

CVE-2026-80230 OpenSSL pinning bypass

When CURLOPTPINNEDPUBLICKEY is configured alongside options that disable standard peer verification CURLOPTSSLVERIFYPEER = 0 and CURLOPTSSLVERIFYHOST = 0, libcurl fails to enforce public key pinning on connections established without a presented server certificate. Bypassing the pinning check und...

CVE-2026-80230 OpenSSL pinning bypass

When CURLOPTPINNEDPUBLICKEY is configured alongside options that disable standard peer verification CURLOPTSSLVERIFYPEER = 0 and CURLOPTSSLVERIFYHOST = 0, libcurl fails to enforce public key pinning on connections established without a presented server certificate. Bypassing the pinning check und...

SUSE-SU-2026:23638-1 Security update for curl

This update for curl fixes the following issues: - CVE-2026-5773: wrong reuse of SMB connection bsc1262633. - CVE-2026-7168: cross-proxy Digest auth state leak bsc1263440. - CVE-2026-8926: password leak with netrc and user in URL bsc1268412. - CVE-2026-13608: OpenLDAP SASL authentication bypass...

SUSE-SU-2026:23521-1 Security update for curl

This update for curl fixes the following issues: - CVE-2026-13608: flow in OpenLDAP SASL negotiation can cause an authentication bypass bsc1277476. - CVE-2026-80229: premature free can lead to OpenSSL provider use-after-free bsc1277479. - CVE-2026-80230: OpenSSL pinning bypass can allow...