NegativeWibes

Hey Guys  today we explore Web view in  android application and   how their misconfiguration leads to Cross site scripting , open redirection , html injection in application. WHAT IS Web View? Android Web View is used to display web page in android. The web page can be loaded from same application or URL. It is used to display online content in android activity. Android Web View uses webkit engine to display web page.The android.webkit.WebView is the subclass of Absolute Layout class.  Web Views are used in android applications to load content and HTML pages within the application.      For example: Improper Implementation of Web view   1. Loading Clear Text content  If a Web View load url that is on http(Clear text communication)  then it would be open to various forms of attack such as MiTM.                               ...

DESCRIPTION : AS you know already that what is passcode protection and why it is applied ? And how it is bypassed normally ? If you don’t know please read my previous blog:   https://negativewives.blogspot.com/2020/04/passcode-protection-bypass-by-brute.html                                                                                When any passcode protection is implemented first check any activity is exported or not ? Here we  only talking the scenario where no activity is exported in application   PROCEDURE : Open Application after implementing passcode protection. You see that passcode activity is launched first Go to AndroidMainfest.xml file and check launch mode of passcode activity . Question Arises in your mind   - ...

In android You know that every GUI interface is an  separate activity. An activity represents a single screen with a user interface just like window or frame of Java. In An application there are many activities depend on application functionalities. Let's take a example : An application that have   three modules login , register and   dashboard . For that there are there are three different activities for all these modules. What is export Means Here? In Android Application there is an attribute android: exported =true or false . This attribute is used in android   to provide an access to   other third party application to start their service , activities   and receive broadcast   messages. Like for an Example : If an application    have broadcast receiver to receive any events or message , if in that application exported attribute is set to true then this    broadcast message   can also receive by other thi...

As you know that every chat application send push notification to user’s device when a message arrive. Push Notification: Push notification is a message pushed from a software application to the user’s device. Push notification originates from the server and they only reach users who have installed the application. Push notifications  are messages that pops up on a user's mobile device in a heads-up manner are called  push notifications .  Push notifications  help in delivering timely & relevant information to users even if the user is not active on the website or  app DESCRIPTION : Most of the chat application have chat delete functionality, in which a user can delete the message for everyone. In this case, message are no longer for both user. But due to some loop holes in message deletion functionality like Message still shown on push notification after deleting the message from application. PROCEDURE : 1.     Se...

First We discuss about what is passcode and Why it is Implemented in  Mobile Applications. PASSCODE Implemented in Mobile Application to protect Applications from an Unauthorized Access.like for example your cliq or any application account is logged in mobile phone .any your friend ask you to give phone , your friend try to open cliq application to see your message, but your friend cant open the application without entering passcode . he have to enter passcode for open, so it is an extra layer security in  applications. Passcode protection implemented in Android Application is an extra layer security to protect an unauthorized access. How Passcode Protection is bypassed by Bruteforcing? You know that passcode protection or pin protection in mobile applications have some attempt to enter passcode , if you enter  wrong passcode more than 5 times or 10 times based on application security , User logged out automatically and redirected to login page.but due to some ...

                      Lets first disccuss about the what is Web Cache and why it used? Web cache: A Web cache (or HTTP cache) is an information technology for the temporary storage (caching) of Web documents, such as Web pages, images, and other types of Web multimedia, to reduce server lag. WHY IT IS USED? When you visit a website, you don’t just need to retrieve the content of the page you’re seeing — you also need a bunch of resources such as JavaScript files, stylesheets, and fonts and so on, which your browser downloads in addition to the content of the page. Browser caching allows your browser to store these files for a while, so it doesn’t need to retrieve them every time you visit the site. The first time you visit this site (WinningWP.com), for example, you’ll receive a bunch of resources that your browser will immediately cache. This first will likely take a few seconds to completely download...

Hey Guyes today i found a vulnerability of  user information leakage due to improper auth token implementation in application. DESCRIPTION: some applications  mask user informaion like mail id , phone no , adhar card, pain card or any personal information of use for  user privacy. but due to some loop holes an attacker can see masked user information. LETS CONTINUE HOW I FOUND :- ➤ 1.       Login in application 2.        Click on deals and capture that request in burpsuite 3.       Send that request in repeater tab check response 4.        Now logout account check response same response appeared. 5.    I tried to check with old auth token then also same response received Phone number and mails are not showing in response⦽ 1.       I tried to bruteforce deals id 2.    ...