# Blogs & Writeups

| Title                                                   | Description                                                                                                                                             | Link                                                                                                                          |
| ------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------- | ----------------------------------------------------------------------------------------------------------------------------- |
| OWASP Mobile Top 10 2016                                | Top mobile security risks                                                                                                                               | [OWASP](https://www.owasp.org/index.php/Mobile_Top_10_2016-Top_10)                                                            |
| Mindmap                                                 | A comprehensive Checklist for Android Bug Bounty                                                                                                        | [Checklist](https://xmind.app/m/GkgaYH/)                                                                                      |
| OWASP Mobile Security Testing Guide                     | Comprehensive testing guide                                                                                                                             | [GitHub](https://github.com/OWASP/owasp-mstg)                                                                                 |
| Android Applications Reversing 101                      | Beginner's guide to Android reversing                                                                                                                   | [Blog](https://www.evilsocket.net/2017/04/27/Android-Applications-Reversing-101/)                                             |
| Detect secret leaks in Android apps                     | Online detection tool                                                                                                                                   | [Website](https://android.fallible.co/)                                                                                       |
| Android Security Guidelines                             | Box's security guidelines                                                                                                                               | [Documentation](https://developer.box.com/docs/android-security-guidelines)                                                   |
| Attacking Broadcast Receivers                           | Android security part 18                                                                                                                                | [Blog](https://manifestsecurity.com/android-application-security-part-18/)                                                    |
| Android WebView Vulnerabilities                         | Common WebView issues                                                                                                                                   | [Blog](https://pentestlab.blog/2017/02/12/android-webview-vulnerabilities/)                                                   |
| Android APK Recon Setup                                 | Setup and tips for recon                                                                                                                                | [Blog](https://b3nac.com/posts/2017-11-10-Setup-and-tips-for-Android-APK-recon.html)                                          |
| WebView addJavascriptInterface RCE                      | Remote code execution via WebView                                                                                                                       | [Blog](https://labs.mwrinfosecurity.com/blog/webview-addjavascriptinterface-remote-code-execution/)                           |
| Install PlayStore on Emulator                           | Guide for emulator setup                                                                                                                                | [Medium](https://medium.com/@dai_shi/installing-google-play-services-on-an-android-studio-emulator-fffceb2c28a1)              |
| Android Bug Bounty Tips                                 | Targeting mobile apps                                                                                                                                   | [Medium](https://medium.com/bugbountyhunting/bug-bounty-hunting-tips-2-target-their-mobile-apps-android-edition-f88a9f383fcc) |
| Access to Protected Components                          | Oversecured blog post                                                                                                                                   | [Blog](https://blog.oversecured.com/Android-Access-to-app-protected-components/)                                              |
| Arbitrary Code Execution                                | Via third-party package contexts                                                                                                                        | [Blog](https://blog.oversecured.com/Android-arbitrary-code-execution-via-third-party-package-contexts/)                       |
| Interception of Implicit Intents                        | Android security issue                                                                                                                                  | [Blog](https://blog.oversecured.com/Interception-of-Android-implicit-intents/)                                                |
| Evernote Vulnerabilities                                | Universal XSS and cookie theft                                                                                                                          | [Blog](https://blog.oversecured.com/Evernote-Universal-XSS-theft-of-all-cookies-from-all-sites-and-more/)                     |
| Gaining Access to Content Providers                     | Android security issue                                                                                                                                  | [Blog](https://blog.oversecured.com/Gaining-access-to-arbitrary-Content-Providers/)                                           |
| @vaishalinagori112 on Medium                            | [Link](https://medium.com/@vaishalinagori112)                                                                                                           |                                                                                                                               |
| @prasadraj954 on Medium                                 | [Link](https://medium.com/@prasadraj954)                                                                                                                |                                                                                                                               |
| B3nac’s Android Reports and Resources                   | [Link](https://github.com/B3nac/Android-Reports-and-Resources)                                                                                          |                                                                                                                               |
| Sandeep Wawdane                                         | [Link](https://thecybersandeep.medium.com/)                                                                                                             |                                                                                                                               |
| Oversecured Blog                                        | [Link](https://blog.oversecured.com/)                                                                                                                   |                                                                                                                               |
| CorSecure Blog                                          | [Link](https://corsecure.blog/)                                                                                                                         |                                                                                                                               |
| Frida Official Documentation                            | [Link](https://frida.re/docs/)                                                                                                                          |                                                                                                                               |
| SecurityBreached (Babayaga47)                           | [Link](https://blog.securitybreached.org/author/babayaga47/)                                                                                            |                                                                                                                               |
| DeeSee's Android Security Resources                     | [Link](https://blog.deesee.xyz/android/security/2020/01/13/android-application-hacking-resources.html)                                                  |                                                                                                                               |
| Hacker101: Mobile Crash Course                          | [Link](https://www.hacker101.com/sessions/mobile_crash_course.html)                                                                                     |                                                                                                                               |
| Mobisec Slides                                          | [Link](https://mobisec.reyammer.io/slides)                                                                                                              |                                                                                                                               |
| Bypassing Certificate Pinning (vavkamil)                | [Link](https://vavkamil.cz/2019/09/15/how-to-bypass-android-certificate-pinning-and-intercept-ssl-traffic/)                                             |                                                                                                                               |
| Android Hacking Primer                                  | [Link](https://medium.com/swlh/an-android-hacking-primer-3390fef4e6a0)                                                                                  |                                                                                                                               |
| OWASP Mobile Top Ten 2023 – fi5t                        | [Link](https://fi5t.xyz/posts/owasp-mobile-top-ten-2023/)                                                                                               |                                                                                                                               |
| Android SMS Stealer – Max Kersten                       | [Link](https://maxkersten.nl/binary-analysis-course/malware-analysis/android-sms-stealer/)                                                              |                                                                                                                               |
| Hacking SMS API via Static Analysis – Security Breached | [Link](https://blog.securitybreached.org/2020/02/19/hacking-sms-api-service-provider-of-a-company-android-app-static-security-analysis-bug-bounty-poc/) |                                                                                                                               |
| Bug Bounty Hunting Tips (Mobile Apps – Android Edition) | [Link](https://freedium.cfd/https://medium.com/bugbountyhunting/bug-bounty-hunting-tips-2-target-their-mobile-apps-android-edition-f88a9f383fcc)        |                                                                                                                               |
| Getting Started in Android Pentesting                   | [Link](https://blog.securitybreached.org/2020/03/17/getting-started-in-android-apps-pentesting/)                                                        |                                                                                                                               |
| Exploiting Insecure Firebase DB                         | [Link](https://blog.securitybreached.org/2020/02/04/exploiting-insecure-firebase-database-bugbounty/)                                                   |                                                                                                                               |
| Finding Leaked AWS Creds in Android Apps                | [Link](https://blog.securitybreached.org/2024/06/28/finding-hidden-threats-how-i-found-leaked-aws-credentials-in-an-android-app-api-using-dast/)        |                                                                                                                               |
| 200+ Bounty Payouts: SQLi in Content Providers          | [Link](https://infosecwriteups.com/200-bug-bounty-payouts-exploiting-content-providers-with-sql-injection-abd287179b61)                                 |                                                                                                                               |
| 8 Ways to Bypass SSL Pinning in iOS                     | [Link](https://medium.com/@vaishalinagori112/8-different-ways-to-bypass-ssl-pinning-in-ios-applications-427dfcbe8bf7)                                   |                                                                                                                               |

