OAuth 2.0 From Zero to PKCE – Everything You Need to Know
What is OAuth 2.0? OAuth 2.0 is an authorization framework that lets one application access your data on another service—without ever requiring you to share your password. Instead of handing over your login details, you simply approve access— like clicking “Allow this app to view your Google Calendar”—and the app receives limited, controlled permissions. Your […]
Building a Jailbroken iOS 26 VM for Penetration Testing on Apple Silicon
Penetration testing iOS apps has always been a challenge for security engineers, jail-breaking physical devices and then patching the apps to support a very old version. It’s been a mess until vphone-cli came out! vphone-cli is an open source tool that lets you run a virtual iPhone on Apple Silicon Macs using Apple’s own virtualization […]
Breaking Multi-Layer Root Detection in a Flutter Android App
During a recent mobile security assessment, we encountered an Android application that appeared straightforward at first glance but quickly evolved into a layered challenge involving Java-based detection, native checks, and Flutter-driven enforcement. The initial objective was simple: run the application on a rooted device for dynamic testing. However, the app consistently terminated on launch, indicating […]
Comprehensive Guide to GCP Penetration Testing for Security Experts with No Background in GCP
Google Cloud Platform (GCP) is a powerful suite of cloud services, but like any complex environment, it presents unique security challenges. In this guide, we’ll conduct a hands-on exploration of GCP penetration testing, drawing from real-world methodologies to create a comprehensive reference. We’ll start with foundational concepts like GCP’s resource hierarchy, identity primitives, and core […]
