Jump to content

niro

Senior Member
  • Posts

    372
  • Joined

  • Last visited

Everything posted by niro

  1. Been looking for this for a good hour, cant seem to find much documentation on it. Assuming it would go in the makefile? but im not 100% sure! Does anyone here know?
  2. Hey there, I'm currently working with one tweak.xm file, which honestly has so many lines. I want to organize it some how, can I make multiple tweak.xm files? Such as AppVersion9.0.xm AppVersion8.0.xm Settings.xm Nightmode.xm And then include all of those in the main tweak.xm? Or could I make my settings / nightmode / etc in a custom header file? Thank you!
  3. hey, so I've been out of the 'creating tweaks' game for awhile and I have some questions that I either can't figure out or things I just don't understand. hopefully someone can clear these up for me. What is MSHook / MSHookIvar useful for, how do I know what to call in order to use it properly? How can I call instance methods from other classes / headers and use them in an existing function. example; 1.h -(id)username; 2.h -(void)sendMessageTo:(id)arg1; arg1 = ?? (how can I make it -(id)username from 1.h) What is the difference between .mm and .xm files and how are each helpful? in some open source tweaks I see that the Tweak.xm only contains Tweak.mm, why? (are they helpful with sandboxed tweaks?) how do I properly use the %c(Class_Here) functions / method? sorry for all the questions, I've looked places and can't find the answers relating to the jailbreak side of things! if you know any / one feel free to comment! you don't need to answer all thanks again
  4. I've tried multiple times, I get the vendor folder but nothing is inside it
  5. Title says it all :$ can someone please upload there whole /var/theos/vendor folder? Much appreciated :$
  6. Hello! I have been getting more and more of these errors lately and I'm not sure how to fix them / what they mean? Could someone help thank you!
  7. Could someone please dump these headers For some reason iTunes won't let me copy the link for the app but just look up "kik" on the store Thank you
  8. Bump! edited the tweak should be available Friday'
  9. Thank you
  10. Hello! I'm back, this time to release a brand new tweak called IGBoost. The first Instagram tweak the literally boosts your stats! With this tweak you will be able to increase the amount of likes on a picture by 50, 100, or 200. Everyone will be able to see these likes. No need to use those app from the AppStore anymore! We are submitting the tweak either tonight or today. Hopefully it will be on Bigboss by Friday if everything goes to plan. Here is a video showing off the tweak. We would like to thank (@i0sa)[Twitter.com/i0sa] If you have any questions feel free to pm us on Kik @EricLegend @north, Reddit, or comment. Have a good day.
  11. repeater is an option within burp suite (should have mentioned that) but the repeater can repeat certain tasks (like a POST or a GET) without you having to physically do it over again lets say you search google on your phone and then you send it to the repeater you can keep repeating just that request from within burp so you dont have to do it on your phone
  12. Hello, user! Today I'm going to show you how I through this script together and how exactly I found it ! (url with the exploit for the followers will be up soon, (school project final ) Before we start off we must know what exactly this 'bot' does, and what it does is add the respected followers or likes to the share url or the username provided. If you are wanting to replicate this, or even replicate finding vulnerabilities you must understand that we aren't looking at the Instagram app at all, and instead we are targeting third party applications such as 'FollowGram' or 'InstaFamous' these applications provide the opportunity to use an in-game currency such as tokens or coins to redeem followers or likes. Now we need a way to attempt to manipulate the data to increase our coins or tokens, we can first try using our local storage (File manager) on our iOS or Android device, once you have that downloaded you can go ahead and locate the application and you can try to attempt to modify the data, but in most cases this doesn't work for various reasons such as when the application is loaded it checks your local application storage files and compares them to the server and if they are in the slightest different they will reset to the default value (usually this is the first test I do). Next is to MITM the application to try and find any PHP based exploits (which is the fun part) in order to intercept your application you will need to download a tool (Burp Suite is my personal favorite but there are many tools you can use, Charles and MITM-Proxy are a couple others. There are many tutorials online on how to configure this with your device. Once that is setup comes the testing and you have to be patient for this as every application doesn't work. (tutorial with vuln. application coming soon) But let's say you are trying to exploit your favorite application for Instagram followers. Once you have downloaded the application sign into your Instagram account and start intercepting the application, and here comes the part you need to pay attention to, when you have your application up and running you are going to want to do something in the application to get coins/tokens such as following someone or watching a video for 1 free coin, spending your coins, etc. If you have interception on correctly you will see JSON come up on your screen and this WILL vary for every application EXAMPLE OF JSON: {'user'='instagramuser123','follow'='TRUE','coins'='1'} or in some cases user=instagramuser123&follow=TRUE&coins=1 great it's in plain text JSON ! From here you can send this item to the repeater and just repeat this process which makes the server think you are following more people but in reality you are not and this will then increase your balance on the application. If you wanted to change the 'coins'='1' to 'coins'='100' you could try that aswell and see how it goes! Congrats! You found an exploit! But what if this doesn't work? What can I do? Well you can try spending your coins (which I have found effective) Lets say the JSON resembles this when you purchase followers {'action'='spendPoints','coins'='500'} or action=spendPoints&coins=500 well you know how these apps have "if you unfollow a user you will get 5 coins back" or whatever if we change the 'coins'='-500' we are basically saying 500 people unfollowed us so give me my coins back, and so it does . These are just a few of many tricks I have found while trying to find vulnerabilities within applications ! another thing I should have said is you are going to want to keep an eye out for POST requests instead of GET as I basically tell my self POST is for POSTing things to the server instead of GETting them. Most if not all exploits will be with a POST request If you have any questions let me know and I will try to help as much as I can I wont be giving out my personal exploits/scripts but I will be more than happy to help you make/find some Enjoy!
  13. Hello I cant figure this out for the life of me I am attempting to remove all the users from the array by only actually removing one (so removing one person within the array would trigger the loop), I have tried for loops, while loops and everything as of now the code compiles, but it only removes the very first person in the array, and it wont remove the rest. (I guess I am trying to call the same function over and over again without actually removing the user manually) %hook KikStanzaGroupRemoveUser - (id)initWithUserJid:(id)arg1 fromGroup:(id)arg2 { NSArray *allUsers = @[@"[email protected]", @"@[email protected]", @"[email protected]"]; for (int i = 0; i < allUsers.count; i++) { NSString *user = [allUsers objectAtIndex:i]; if ([arg1 isEqualToString:user]) arg1 = user; } UIAlertView *alert = [[UIAlertView alloc] initWithTitle:@"KEight Error" message:@"No users to purge or user selected is outside of hardcoded array!" delegate:nil cancelButtonTitle:@"Close" otherButtonTitles:nil]; [alert show]; [alert release]; return %orig; } %end I am now lost, I don't know what to attempt next, I was thinking selectors but I am probably wrong
  14. Hello, as some of you may know I am trying to turn my IG exploits into a reality, but I am having trouble with parsing/returning JSON from a URL response. Here is an example lets say I submit this to a server firstname=first&lastname=last&age=99 and the response from the server is this { "person":{ "firstname":"first", "lastname":"last", "info":{ "age":"99" } } } how would I retrieve this information (certain elements) lets say I JUST want the persons age so the return string should be just "99" or how do I JUST return the lastname or JUST the firstname, another thing how would I pass the returned element into the next POST request without the user having to type it again? if anyone can find an example that would be fantastic Thank You!
  15. taking a look at this
  16. thank you
  17. Haven't tested this, I'm not sure if I'm fully understanding the code I wrote but I tried explaining what I do know! Please feedback helps me a lot! Thanks! //Text Color Per Username (NOT TESTED) //'Reaching' = Hooking, kind of, we are pulling functions from other classes //so we can achieve what we are trying to do (to my understanding) //'Reaching' into the other classes so they work with HybridSmileyLabel //even though they aren't in the class 'HybridSmileyLabel' @interface HybridSmileyLabel : NSObject //From the class XMPPJID - (XMPPJID *)userJid; //From the class KikUser - (KikUser *)username; - (KikUser *)user; //Closing the interface with an @end (to my understanding it is like the %end, but I may be wrong) @end //Hooking into the class that deals with the message color %hook HybridSmileyLabel //This is the function that deals with the specific text color //We put UIColor * as the id because we are dealing with color //The word after UIColor * can be anything, in this case I put color, but it could be arg1, eric, niro, etc -(void)setTextColor:(UIColor *)color { //'Reaching' into the KikUser Class and is searching if the username is nooneloves me (niro) if([self.user.username isEqualToString:@"noonelovesme"]) //If it is equal it sets the color to a nice blue color = [UIColor colorWithRed:0.43 green:0.62 blue:0.92 alpha:1.0]; //Instead of 'reaching' into KikUser, it is 'Reaching' into XMPPJID to see if the jid is equal to yours (EricLegend) if([self.userJid.user isEqualToString:@"[email protected]"]) //If it is equal it sets the color to a dark red color = [UIColor colorWithRed:0.60 green:0.00 blue:0.00 alpha:1.0]; //Returns all other possibilities to the original color return %orig; } //Closing the hook and all the modifications %end
  18. hello, so I'm trying to make a UIAlert with options (send, cancel) I want to make a tweak similar to the Instagram like pop up warning, but Instead want to do if I choose send it sends the messages and if I choose cancel it cancels it and does nothing haven't really found any examples online :S and I'm better at learning from examples! thank you
  19. hello, I am trying to make an ingame menu with a 50% opacity so I can switch on modifications in real time! are there any good tutorials for this? or where should I start thank you (sorry for being so vague)
  20. DUMPED BY NIRO APRIL 29, 2016 @ 7:15PM ###################### Brittanya187 swedishkiller NickyHolender Cherryd27 jessicakillings NikkiVianna Dannitabruna brazilianbarbi NadinneDoll cjmiles jaydenicole liverichmedia JessicaCribbon jena rayhughesla shenizh phoenixskye iamnikkiphoenix ZzaikamMboo caroesteph shibalove ryphoto viviankindle stevebitanga caitlinoconnor destinyeastwest StephMi triceylala angeln99 stwillis misshunter_d victoriamynguyen maria.bozinovska ###################### Here are some of the bigger users dumped, I am attempting to bruteforce now
  21. EDIT: Please close this thread
×
  • Create New...

Important Information

We would like to place cookies on your device to help make this website better. The website cannot give you the best user experience without cookies. You can accept or decline our cookies. You may also adjust your cookie settings. Privacy Policy - Guidelines