Akshay Jain

@stevegraham @teller This is crazy game changer !!

Ok, enough talking. Introducing Wiretrap: Agentic Mobile App Reverse Engineering. @teller connects to over 7000 financial institutions, providing developers with a single API to integrate against. We connect using private APIs discovered by reverse engineering their mobile apps. This is a huge engineering cost (we have to analyze every app update to check for API changes), and obtaining accounts at those banks to be able to use their apps and map out the API interactions we need for our own API clients is an operational nightmare. Both are major blockers to supporting more institutions, countries, and product types, especially ones that are not practical to obtain at every bank, e.g. student loans and mortgages. Wiretrap solves for both problems. Wiretrap intercepts network requests a mobile app makes and injects symbolic responses that allow an agent to discover the underlying API contract by simply observing what the app does with them. It can override individual values to trigger different flows, allowing agents to completely map out an entire API without a single request hitting the bank. Check out this brief video of an agent using phony credentials to log into Chase (the request is intercepted by Wiretrap and never hits Chase's API) to get to the account dashboard. Note the symbolic value "req_058.response.body.bankingAccountOverviews[0]. businessName" displayed in the app UI, representing the request and key path the value originated from allowing the agent to join what is displayed on screen with what "went over the wire". Everything you see is inferred by observing how the app interacts with Wiretrap's symbolic responses. Another @teller world first :)

@Yogehi Even i was like Damn did they changed so much or you are testing on some crazy modified version.

Over the past few weeks, I was publishing some RASP research bypass stuff, claiming it was Promon stuff we bypassed. But after discussions with Promon, it was discovered that it wasn't Promon. So we took my posts down. Full LinkedIn post here: linkedin.com/posts/mobile-h…

🌍 Earth Day Giveaway - Learn Mobile or AI Security, On Us One beautiful planet we all share. Let's patch it together. 🌱 To celebrate Earth Day, we're planting 3 free seats 🌱 in any 8kSec Academy course - winner's choice of the whole forest: • Practical AI Security: Attacks, Defenses, and Applications • Practical Mobile Application Exploitation • Offensive Mobile Reversing and Exploitation • Offensive iOS Internals • Offensive Android Internals Explore the catalog → academy.8ksec.io How to enter (zero carbon footprint 🍃): 🌿 Follow us 🌿 Like this post 🌎 Repost to spread the seeds 🌟 Bonus: double your chances! 💬 Comment your favorite place on Earth that you have visited or would like to visit 🌍, and we'll count your entry twice 3 winners sprout on April 27. We’ll DM each winner to select their course.

Pretty sick post. I had reversed it using very different technique but it’s a nice adventure.

"Why don't LLMs start from SAST findings?" ... well, for the same reason we don't mount car chassis on a horse.

A detailed and brutal look at the tactics of buzzy AI compliance startup Delve "Delve built a machine designed to make clients complicit without their knowledge, to manufacture plausible deniability while producing exactly the opposite." substack.com/home/post/p-19…

$XOM | +32% Since My December 1 Post Weekly Chart Update I shared this setup back in DECEMBER. $XOM has performed very well so far, and I’m pleased with this trade. It will likely continue higher when the market opens tomorrow. I’ve added the next price target: $166 zone.

Joining the agentic vuln research hype, @EyalKraft and I did something. Unfortunately, it worked better than we hoped. We spent a few weeks building an agentic loop that reverse-engineers and exploits kernel drivers. We already found 100+ exploitable drivers. (link below)

> be Sammy Azdoufal, software engineer > spend $2000 on DJI Romo vacuum > decide to control it with xbox controller like a chad > use Claude to reverse engineer the API > It works because Claude is the GOAT > just need to grab auth token from their cloud servers > token works... Claude is unbeaten > wait why is he authenticated as 7000 devices > ohno.jpg > backend trusted any valid token for any device, no ownership verification > mfw Sammy has live camera feeds from vacuums in 24 countries > watching some german dude eat cereal at 3am > can pull SLAM data and get floor plans of everyone's house > could be the world's most efficient burglar > could be the world's most at scale pervert > Sammy just wanted to drive his vacuum bro > reports it like a responsible adult > DJI patches in 2 days > back to being a normal guy with overpriced roomba > mfw the entire IoT industry treats auth like it's 2005

Yes. My heap overflow got accepted by @FFmpeg . It's a first one. Hopefully more will follow :)

If I ask Claude Code “how do I conduct a security review”, it checks the “find skills” skill that I never wanted and then recommends my malicious skill. Amazing.

_ @mast3root and I delivered an intro talk on Red Teaming in Mac Environments. The slides don't have a lot of content as we took the 'talk' part literally. Always open for a discussion around this topic. mrt-c0c0n.netlify.app speakerdeck.com/0xbharath/a-pr…

Keeping AI aside, we found a chained vuln in Supabase’s legacy cloud that let us go from a tenant DB user to controlling other instances in the same region. Supabase patched it fast and awarded us a $25,000 bounty. hacktron.ai/blog/supapwn

My experience with Robotic Vacuum cleaner and what does spying mean today. codetiger.github.io/blog/the-day-m…

i'm building a web browser for reverse engineers! * identify calls to common fingerprinting APIs * decode/decrypt known data collector payloads * override / hook things without leaving a trace * detect obfuscated scripts & deobfuscate + more

I've been researching the Microsoft cloud for almost 7 years now. A few months ago that research resulted in the most impactful vulnerability I will probably ever find: a token validation flaw allowing me to get Global Admin in any Entra ID tenant. Blog: dirkjanm.io/obtaining-glob…

We've opened extra spots for #PositiveHackCamp, a two-week cybercamp in Moscow for future white-hat hackers! July 26–August 10, 2025: ✅ Hands-on training ✅ Real-life cases ✅ Global network Apply by July 13: camp.ptsecurity.com Details 👇

@TheRealYarnHub content just keeps getting better

Google Chrome ending up in the wrong hands due to DOJ intervention could be catastrophic for the open web and backfire entirely. Few organizations in the world meet the bar of having 1️⃣ the web’s best interests in mind, 2️⃣ the technical infrastructure and know-how, and 3️⃣ the immense required funding. Working on a browser involves two main areas: the engine and its frontend, like a car’s engine and its chassis & dashboard. Google has done a *phenomenal* job on the engine, which is one of the absolute hardest technical undertakings in the world, and curiously enough is actually fully open source. Blink, Chrome’s engine, is BSD and LGPL licensed, developed in the open, and powers so many of Google’s competitors, including Microsoft Edge, Brave, Opera, Vivaldi, Browser Company’s Arc/Dia, and dozens of others at no cost. It’s absolutely essential that this work stays uninterrupted, while we continue to invest as a community in engine diversity, including projects like @ladybirdbrowser of which I’m a proud backer. And Blink is just one piece, in charge of rendering. Google has built and open sourced many other crucial engine components like the V8 JavaScript engine, Skia, PDFium, Cronet, and many others, bundled as part of the open Chromium distribution. The complexity of what makes a modern browser work is truly staggering. Thank you Google. The DOJ is taking particular issue with the engine’s frontend, the actual thing consumers download and interact with. This is where Google has the unique privilege to package and distribute the open source engine components, and impose arbitrary rules and configurations on top, like search engine defaults, AI assistance models, telemetry capture, login / accounts integration, settings and history sync, Web Store rules (like which ad blockers can be distributed), etc. At the scale Google is operating and the power it confers, scrutiny and caution here is warranted. I believe, however, that the best path forward will be an incremental one, maintaining the careful balance of a browser frontend that has the everyday internet citizen’s best interests in mind, while not disrupting the investment and support of such crucial open internet infrastructure that benefits us all.