Mobile Exploitation Tutorials
Hands on Technical write-ups. Each post takes a real CVE from the exploit DB and walks through triggering, weaponizing and detecting the bug — with copyable, downloadable code blocks at every step.
hands on technical write-ups. Each post takes a CVE from the exploit DB and walks through triggering, weaponizing, and detecting the bug.
Weaponizing WebKit Type Confusion for iOS RCE
We walk through triggering the type confusion in JavaScriptCore, building a fake object primitive, and pivoting to arbitrary read/write inside Safari on iOS 17.3.
function trigger() {
let arr = [1.1, 2.2, 3.3];
let oob = new ArrayBuffer(0x1000);
arr.__proto__ = oob.__proto__;
return arr[0x100];
}Rooting Pixel via Firmware Privilege Escalation
Step-by-step exploitation of a Pixel-specific bootloader logic flaw to land a persistent root shell without unlocking the bootloader.
adb shell /data/local/tmp/exploit.bin --trigger ./pixel-lpe --target=oriole --kaslr-leak
Reproducing BLASTPASS: 0-click iMessage Implant
Reverse engineering Apple's ImageIO PassKit attachment chain. We rebuild a malformed WebP that bypasses BlastDoor and lands code execution.
python3 forge_webp.py --huff-overflow 0x4141 --out blast.webp python3 wrap_pkpass.py --payload blast.webp --recipient target@icloud
WorkSource Parcel Mismatch — Android In-the-Wild LPE
Dissecting the parcel/unparcel mismatch abused by commercial spyware. Building a reliable exploit against Android 11–13.
Parcel p = Parcel.obtain(); WorkSource ws = new WorkSource(); p.writeInt(0x1337); ws.readFromParcel(p); ws.writeToParcel(p2, 0);
$ Open a secure channel. PGP preferred. Pre-engagement NDA available on request.