Democratizing mobile app security; building https://xitter.cf/t.co/jTAyyWNqWk
🌎
Joined July 2018
- Tweets807
- Following343
- Followers393
- Likes1.2K
_bhamza retweeted
lots of noise with new CVEs. I hope we'll see more challenges like stealmybitcoin.com to prove how exploitable these issues are, especially with open models
my sense is the nodejs brotli bug is an order of magnitude easier to exploit than php2shell.
with cheap tokens, perhaps we can get a more insightful measure of exploitability. as opposed to just indexing off of CVSS rating..
_bhamza retweeted
This looks amazing. A cross-platform WiFi cracking tool was something deemed impossible just 10 years ago.
Kudos to @derv82 for making this happen.
Released today: github.com/derv82/wifit3/?v=…
_bhamza retweeted
It's been a while since I posted something. Here it goes.
#mobile #android #frida
captmeelo.com/mobile/2026/09…
_bhamza retweeted
1/6 🧵 Another thread -- and time to put on my slightly boring “professor” hat 🤓
We’ve just released the first three chapters of The Decompilation Book!
We call it a book, although technically, it’s a series of blog posts:
decompilation.education/
still unsure if it was wayback machine, a random crawler or a random hacker poking at my scanner.
xitter.cf/_bhamza/status/2097763…
Each rescan generated a new UUID, which also meant a new public report URL.
The frontend works fine, but from an SEO perspective, this is terrible. A search engine/crawler sees a disappearing URL (the old scan is gone) and a completely new one in its place.
The fix was simple: give each sample a permanent slug instead of using the scan UUID in the public URL.
Funny how a completely harmless crawler error at 4:52 in the morning accidentally reminded me of an SEO flaw.
See for yourself (no signup needed): atomicsecurity.app/examples
_bhamza retweeted
Last week we released Virtual//Attack
An AtomicRedTeam-style collection of 80+ attack techniques against VMware environments including ESXi, vCenter, and many more.
Optimised for adversary emulation, with TA tags and TI refs
Check it out 👇
github.com/ReversecLabs/virt…
Atomic App Scanner now has dedicated rules for Android React Native apps. It reads the JavaScript bundle inside the APK, both plain bundles and compiled Hermes bytecode, and folds those checks into the same scan.
atomicsecurity.nl/blog/andro…
_bhamza retweeted
I've seen this "no need to code" argument a lot online now with AI. At first I was trying to figure out whether this was true or not. However, in a recent venture of mine I've been working with a non-technical client. He discovered Codex, and he started creating what he needs by himself. I told him give it to me, and I will check to see whether we can use it. To say the least, it was a buggy mess, while he thought he could just deploy this to prod.
I think we still need people with domain knowledge, what I produce with AI and what non-tech people produce with AI differs vastly in quality.
“Does it use AI/LLM?” is a recurring question I get asked about Atomic Scanner. Currently, the answer is NO.
Not because I’m in denial, in the contrary, I do actually use AI to build and secure it.
Here are six reasons why I didn't incorporate AI in the scanner (yet):
🧵
For all of this to work well later, I need the basic building blocks first. That’s what I’m building now.
Next in the pipeline 🔜: dedicated detection rules for React Native apps.
If you have read this far, might as well get your first free scan (no card == zero commitment)-> app.atomicsecurity.nl/
