@_bhamza

Democratizing mobile app security; building https://xitter.cf/t.co/jTAyyWNqWk

 🌎
bhamza.me/
Joined July 2018
  • Tweets806
  • Following343
  • Followers394
20Media
_bhamza retweeted
OtterSec
@osec_ioOct 15
In 2026, no program is closed source. We decompiled a propAMM into Rust that recompiles to the exact on-chain binary, then used it to find a critical bug that put $6.1M at risk.
22
72
15
538
30,982
This looks amazing. A cross-platform WiFi cracking tool was something deemed impossible just 10 years ago. Kudos to @derv82 for making this happen.
derv82@derv82Aug 5
Replying to @derv82
Released today: github.com/derv82/wifit3/?v=…

GitHub - derv82/wifit3: Wifite but USB-only & cross-platform.

Wifite but USB-only & cross-platform. Contribute to derv82/wifit3 development by creating an account on GitHub.

github.com
2
52
438
39,787
_bhamza retweeted
Meelo@CaptMeeloSep 21
It's been a while since I posted something. Here it goes. #mobile #android #frida captmeelo.com/mobile/2026/09…

Loupe: An Android Console in the Browser

A tool I built for driving an Android phone from a browser tab, with screen mirror, logcat, file browser, proxy, and Frida in the same window.

captmeelo.com
1
2
9
1,142
You don’t need a kernel 0day bour.ch/you-dont-need-a-kern…

You don’t need a kernel 0day

I’ve been in security engineering for more than ten years, and I’m still learning from others. There are some incredibly smart people in this field. If you s...

bour.ch
2
20
119
9,095
Demo time! atomicsecurity.app/ #mobile #security
2
6
133
Share your feedback right inside the app scanner.
1
1
6
139
or send me a DM :_)
34
_bhamza retweeted
Zhuo Zhang
@i2huerSep 10
1/6 🧵 Another thread -- and time to put on my slightly boring “professor” hat 🤓 We’ve just released the first three chapters of The Decompilation Book! We call it a book, although technically, it’s a series of blog posts: decompilation.education/

Decompilation Book

Build a decompiler to understand one. A chapter-by-chapter walk from RV32I machine code back to readable C, with the working Python implementation open beside you.

decompilation.education
6
64
350
15,304
still unsure if it was wayback machine, a random crawler or a random hacker poking at my scanner. xitter.cf/_bhamza/status/2097763…
_bhamza@_bhamzaSep 9
I woke up to a Sentry alert timestamped at 4:52 a.m: “Input should be a valid UUID...”. It was coming from a route used to view a sample public report, which expected the UUID of a scan. Nothing critical, but it reminded me of something.
1
7
214
I woke up to a Sentry alert timestamped at 4:52 a.m: “Input should be a valid UUID...”. It was coming from a route used to view a sample public report, which expected the UUID of a scan. Nothing critical, but it reminded me of something.
1
1
4
337
more replies
Each rescan generated a new UUID, which also meant a new public report URL. The frontend works fine, but from an SEO perspective, this is terrible. A search engine/crawler sees a disappearing URL (the old scan is gone) and a completely new one in its place.
1
1
31
The fix was simple: give each sample a permanent slug instead of using the scan UUID in the public URL. Funny how a completely harmless crawler error at 4:52 in the morning accidentally reminded me of an SEO flaw. See for yourself (no signup needed): atomicsecurity.app/examples

Example Android APK security reports · Atomic App Scanner

Real Android APK security scan reports: every finding with its exact code location and OWASP MASVS/MASTG reference, from deliberately-vulnerable demo apps.

atomicsecurity.app
1
20
_bhamza retweeted
Leo Tsaousis@LArippingSep 3
Last week we released Virtual//Attack An AtomicRedTeam-style collection of 80+ attack techniques against VMware environments including ESXi, vCenter, and many more. Optimised for adversary emulation, with TA tags and TI refs Check it out 👇 github.com/ReversecLabs/virt…

GitHub - ReversecLabs/virtual.attack: Attack techniques for threat emulation in VMware environments

Attack techniques for threat emulation in VMware environments - ReversecLabs/virtual.attack

github.com
1
53
2
237
10,844
Atomic App Scanner now has dedicated rules for Android React Native apps. It reads the JavaScript bundle inside the APK, both plain bundles and compiled Hermes bytecode, and folds those checks into the same scan. atomicsecurity.nl/blog/andro…

The Atomic App Scanner now reads React Native Android apps

Most of the logic in a React Native app lives in the JavaScript bundle, not in the Java code the scanner was originally built to inspect. It now reads that bundle too, whether it ships as plain...

atomicsecurity.app
3
7
353
Replying to @jun_song
I've seen this "no need to code" argument a lot online now with AI. At first I was trying to figure out whether this was true or not. However, in a recent venture of mine I've been working with a non-technical client. He discovered Codex, and he started creating what he needs by himself. I told him give it to me, and I will check to see whether we can use it. To say the least, it was a buggy mess, while he thought he could just deploy this to prod. I think we still need people with domain knowledge, what I produce with AI and what non-tech people produce with AI differs vastly in quality.
1
3
522
“Does it use AI/LLM?” is a recurring question I get asked about Atomic Scanner. Currently, the answer is NO. Not because I’m in denial, in the contrary, I do actually use AI to build and secure it. Here are six reasons why I didn't incorporate AI in the scanner (yet): 🧵
2
129
more replies
For all of this to work well later, I need the basic building blocks first. That’s what I’m building now. Next in the pipeline 🔜: dedicated detection rules for React Native apps.
1
29
If you have read this far, might as well get your first free scan (no card == zero commitment)-> app.atomicsecurity.nl/

Android APK Security Scanner · OWASP MASVS/MASTG | Atomic App Scanner

Scan your Android APK for 420+ OWASP MASVS/MASTG issues. Severity-graded findings with the exact code and the fix. First scan free, no card.

atomicsecurity.app
26
Load more