.text:00401C00 securinets-friendly Mobile Security

Securinets Friendly

A mobile security CTF authored for a Securinets friendly-format competition.

; writeups

Using Frida to hook an Android activity method and swap its argument at runtime to satisfy a hardcoded string check.

Launching an exported Android activity via adb am start with a custom action and cracking its SHA-256 password check online.

Building a companion Android Studio app to deliver triple-nested Intents that satisfy an unexported activity's chained checks.

Cracking an Android login's SHA-256-hashed password by looking it up on a common-hash reverse-lookup website.

Reading hardcoded Android login credentials straight out of jadx to XOR-decrypt a hidden flag image.

Reversing an XOR-and-bit-rotation password encryption scheme in jadx to derive the correct Android login credentials.

Decoding a Base64 Android login password with CyberChef, then finding the real flag logged as a decoy error in Logcat.

Extracting a double-Base64-encoded flag from strings embedded in an Android app's native .so library.

Reversing a native library's ROT13-plus-triple-DES flag encryption in IDA and writing a Python decrypter for the captured output.dat.

Using Frida to force an Android dice-roll function's return values and win a rigged five-roll challenge.

Digging a Base64-and-ROT6-encoded flag out of an Android app's raw resources using jadx and CyberChef's Magic operation.

Hooking a deobfuscation method with Frida to leak a scrambled flag, then unscrambling it with an index map left in the app's resources.

Rooting an Android emulator to launch an unexported activity via adb with a crafted action, URI, and extras bundle.

A warmup Android challenge where tapping the app's button directly reveals the flag.