https://nirajkharel.com.np/Vulnerability Assessment, Penetration Testing, HackTheBox, HTB. 2026-07-03T06:11:00+05:45 Niraj Kharel https://nirajkharel.com.np/ Jekyll © 2026 Niraj Kharel /assets/img/favicons/favicon.ico /assets/img/favicons/favicon-96x96.png 2026-06-22T12:15:00+05:45 2026-06-22T12:15:00+05:45 https://nirajkharel.com.np/posts/app-link-autoverify-false/ nirajkharel

Android App Links let apps claim ownership of HTTPS domains so that links to those domains open directly in the app instead of showing a browser or a chooser. The claim becomes authoritative when the framework verifies it via android:autoVerify="true" against a valid assetlinks.json on the domain. Without autoVerify, the filter is advisory - any other installed app can declare the same scheme a...

2026-06-21T12:15:00+05:45 2026-06-21T12:15:00+05:45 https://nirajkharel.com.np/posts/react-native-bridge-inspection/ nirajkharel

React Native apps have a JavaScript runtime and a native runtime, with a bridge between them. The bridge is enumerable - apps expose a collection of NativeModules that JavaScript can call. Each module has a method list you can dump, then call directly from Frida. In production builds, React Native does not expose its bridge to arbitrary cross-origin JS the way a hand-rolled @JavascriptInterface...

2026-06-19T12:15:00+05:45 2026-06-19T12:15:00+05:45 https://nirajkharel.com.np/posts/janus-v1-signing/ nirajkharel

CVE-2017-13156 (Janus) lets an attacker prepend a malicious DEX to an APK and have the system execute the prepended DEX while the v1 signature still verifies. v1 signs files inside the ZIP, not the file as a whole - so prepended bytes before the ZIP boundary are invisible to the signature check. Android 7.0 introduced v2 signing that covers the entire file, closing this. Apps that still ship v1...

2026-06-15T12:15:00+05:45 2026-06-15T12:15:00+05:45 https://nirajkharel.com.np/posts/logging-pii-in-release/ nirajkharel

Log.d, Log.v, Log.i calls in production builds dump strings to logcat. On Android 4.1+ the READ_LOGS permission is signature-only, so a regular third-party app cannot read another app’s logs. But anyone with USB debugging enabled can. Crash-reporting SDKs like Crashlytics, Sentry, and Bugsnag also capture nearby logcat output when a crash occurs and ship it off-device. If sensitive data is in a...

2026-06-14T12:15:00+05:45 2026-06-14T12:15:00+05:45 https://nirajkharel.com.np/posts/reflection-class-loading-intent/ nirajkharel

Class.forName(intent.getStringExtra("class_name")) is one step short of the dynamic-code-loading bug. The attacker cannot supply new code, but they can pick which existing class on the app’s classpath gets instantiated and which method on it runs. In practice that is enough to reach internal initialization logic, OAuth handlers, admin utilities, or database migration runners that the developer ...