Jump to content

niro

Senior Member
  • Posts

    372
  • Joined

  • Last visited

Posts posted by niro

  1. Hey there, I'm currently working with one tweak.xm file, which honestly has so many lines. I want to organize it some how, can I make multiple tweak.xm files? Such as

     

    AppVersion9.0.xm

    AppVersion8.0.xm

    Settings.xm

    Nightmode.xm

     

    And then include all of those in the main tweak.xm?

    Or could I make my settings / nightmode / etc in a custom header file?

     

    Thank you!

  2. hey, so I've been out of the 'creating tweaks' game for awhile and I have some questions that I either can't figure out or things I just don't understand. hopefully someone can clear these up for me.

     

    What is MSHook / MSHookIvar useful for, how do I know what to call in order to use it properly?

     

    How can I call instance methods from other classes / headers and use them in an existing function.

    example;

     

    1.h

    -(id)username;

     

    2.h

    -(void)sendMessageTo:(id)arg1;

     

    arg1 = ?? (how can I make it -(id)username from 1.h)

     

     

    What is the difference between .mm and .xm files and how are each helpful? in some open source tweaks I see that the Tweak.xm only contains Tweak.mm, why? (are they helpful with sandboxed tweaks?)

     

    how do I properly use the %c(Class_Here) functions / method?

     

     

    sorry for all the questions, I've looked places and can't find the answers relating to the jailbreak side of things!

     

    if you know any / one feel free to comment! you don't need to answer all :)

     

    thanks again

  3. Hello! I'm back, this time to release a brand new tweak called IGBoost. The first Instagram tweak the literally boosts your stats! With this tweak you will be able to increase the amount of likes on a picture by 50, 100, or 200. Everyone will be able to see these likes. No need to use those app from the AppStore anymore! We are submitting the tweak either tonight or today. Hopefully it will be on Bigboss by Friday if everything goes to plan. Here is a video showing off the tweak. We would like to thank (@i0sa)[Twitter.com/i0sa]

    If you have any questions feel free to pm us on Kik @EricLegend @north, Reddit, or comment. Have a good day.

     

     

     

     

    • Like 1
    • Thanks 1
  4. Hey! 

     

    I'm familiar with this kind of stuff... but, what repeater? How do you send the modified data back to the server? :D

    Awesome tutorial!

    repeater is an option within burp suite (should have mentioned that)

    but the repeater can repeat certain tasks (like a POST or a GET) without you having to physically do it over again

    lets say you search google on your phone and then you send it to the repeater you can keep repeating just that request from within burp so you dont have to do it on your phone :)

  5.  
                    Hello, user!
     
    Today I'm going to show you how I through this script together and how exactly I found it :)! (url with the exploit for the followers will be up soon, (school project final :p)
     
    Before we start off we must know what exactly this 'bot' does, and what it does is add the respected
    followers or likes to the share url or the username provided.
    If you are wanting to replicate this, or even replicate finding vulnerabilities you must understand that we aren't looking at the Instagram app at all, and instead we are targeting third party applications such as 'FollowGram' or 'InstaFamous' these applications provide the opportunity to use an in-game currency such as tokens or coins to redeem followers or likes.
     
    Now we need a way to attempt to manipulate the data to increase our coins or tokens, we can first try using our local storage (File manager) on our iOS or Android device, once you have that downloaded you can go ahead and locate the application and you can try to attempt to modify the data, but in most cases this doesn't work for various reasons such as when the application is loaded it checks your local application storage files and compares them to the server and if they are in the slightest different they will reset to the default value (usually this is the first test I do).
     
    Next is to MITM the application to try and find any PHP based exploits (which is the fun part) in order to intercept your application you will need to download a tool (Burp Suite is my personal favorite but there are many tools you can use, Charles and MITM-Proxy are a couple others.
    There are many tutorials online on how to configure this with your device. Once that is setup comes the testing and you have to be patient for this as every application doesn't work. (tutorial with vuln. application coming soon)
     
    But let's say you are trying to exploit your favorite application for Instagram followers. Once you have downloaded the application sign into your Instagram account and start intercepting the application, and here comes the part you need to pay attention to, when you have your application up and running you are going to want to do something in the application to get coins/tokens such as following someone or watching a video for 1 free coin, spending your coins, etc. If you have interception on correctly you will see JSON come up on your screen and this WILL vary for every application
     
    EXAMPLE OF JSON: 
    {'user'='instagramuser123','follow'='TRUE','coins'='1'}
    or in some cases
    user=instagramuser123&follow=TRUE&coins=1

    great it's in plain text JSON :)! From here you can send this item to the repeater and just repeat this process which makes the server think you are following more people but in reality you are not :) and this will then increase your balance on the application.

     

    If you wanted to change the 'coins'='1' to 'coins'='100' you could try that aswell and see how it goes! Congrats! You found an exploit! But what if this doesn't work? What can I do? Well you can try spending your coins (which I have found effective)

     

    Lets say the JSON resembles this when you purchase followers 

    {'action'='spendPoints','coins'='500'} 

    or 

    action=spendPoints&coins=500

    well you know how these apps have "if you unfollow a user you will get 5 coins back" or whatever if we change the 'coins'='-500' we are basically saying 500 people unfollowed us so give me my coins back, and so it does :).

    These are just a few of many tricks I have found while trying to find vulnerabilities within applications :)! another thing I should have said is you are going to want to keep an eye out for POST requests instead of GET as I basically tell my self POST is for POSTing things to the server instead of GETting them.

    Most if not all exploits will be with a POST request

     

    If you have any questions let me know and I will try to help as much as I can ;) I wont be giving out my personal exploits/scripts but I will be more than happy to help you make/find some :) Enjoy!

    • Like 1
  6. Hello I cant figure this out for the life of me I am attempting to remove all the users from the array by only actually removing one (so removing one person within the array would trigger the loop), I have tried for loops, while loops and everything as of now the code compiles, but it only removes the very first person in the array, and it wont remove the rest. (I guess I am trying to call the same function over and over again without actually removing the user manually)

    %hook KikStanzaGroupRemoveUser
    
    - (id)initWithUserJid:(id)arg1 fromGroup:(id)arg2 {
    
    NSArray *allUsers = @[@"[email protected]", @"@[email protected]", @"[email protected]"];
    
    for (int i = 0; i < allUsers.count; i++) {
    NSString *user = [allUsers objectAtIndex:i];
    
    if ([arg1 isEqualToString:user])
    	arg1 = user;
    	
    	}
    	
    	UIAlertView *alert = [[UIAlertView alloc] initWithTitle:@"KEight Error"
    	message:@"No users to purge or user selected is outside of hardcoded array!" delegate:nil cancelButtonTitle:@"Close" otherButtonTitles:nil];
    	[alert show];
    	[alert release];
    	return %orig;
    	
    }
    
    %end
    

    I am now lost, I don't know what to attempt next, I was thinking selectors but I am probably wrong

  7. Hello, as some of you may know I am trying to turn my IG exploits into a reality, but I am having trouble with parsing/returning JSON from a URL response. Here is an example

     

     

    lets say I submit this to a server

    firstname=first&lastname=last&age=99

    and the response from the server is this

    {  
       "person":{  
          "firstname":"first",
          "lastname":"last",
          "info":{  
             "age":"99"
          }
       }
    }

    how would I retrieve this information (certain elements)

     

    lets say I JUST want the persons age so the return string should be just "99"

    or how do I JUST return the lastname or JUST the firstname, another thing how would I pass the returned element into the next POST request without the user having to type it again?

     

    if anyone can find an example that would be fantastic :)

     

    Thank You!

  8. Haven't tested this, I'm not sure if I'm fully understanding the code I wrote but I tried explaining what I do know!

    Please feedback helps me a lot!

    Thanks!

     

    //Text Color Per Username (NOT TESTED)
    
    
    //'Reaching' = Hooking, kind of, we are pulling functions from other classes
    //so we can achieve what we are trying to do (to my understanding)
    
    //'Reaching' into the other classes so they work with HybridSmileyLabel
    //even though they aren't in the class 'HybridSmileyLabel'
    @interface HybridSmileyLabel : NSObject
    
    //From the class XMPPJID
    - (XMPPJID *)userJid;
    
    //From the class KikUser
    - (KikUser *)username;
    - (KikUser *)user;
    
    //Closing the interface with an @end (to my understanding it is like the %end, but I may be wrong)
    @end
    
    
    //Hooking into the class that deals with the message color
    %hook HybridSmileyLabel
    
    //This is the function that deals with the specific text color
    //We put UIColor * as the id because we are dealing with color
    //The word after UIColor * can be anything, in this case I put color, but it could be arg1, eric, niro, etc
    -(void)setTextColor:(UIColor *)color {
    	
    	//'Reaching' into the KikUser Class and is searching if the username is nooneloves me (niro)
    	if([self.user.username isEqualToString:@"noonelovesme"])
    		
    		//If it is equal it sets the color to a nice blue
    		color = [UIColor colorWithRed:0.43 green:0.62 blue:0.92 alpha:1.0];
    	
    	//Instead of 'reaching' into KikUser, it is 'Reaching' into XMPPJID to see if the jid is equal to yours (EricLegend)
    	if([self.userJid.user isEqualToString:@"[email protected]"])
    		
    		//If it is equal it sets the color to a dark red
    		color =	[UIColor colorWithRed:0.60 green:0.00 blue:0.00 alpha:1.0];
    	
    	//Returns all other possibilities to the original color
    	return %orig;
    }
    
    //Closing the hook and all the modifications
    %end
  9. hello, so I'm trying to make a UIAlert with options (send, cancel)

    I want to make a tweak similar to the Instagram like pop up warning, but Instead want to do if I choose send it sends the messages and if I choose cancel it cancels it and does nothing

     

    haven't really found any examples online :S and I'm better at learning from examples!

     

    thank you

  10. DUMPED BY NIRO

    APRIL 29, 2016 @ 7:15PM

    ######################

    Brittanya187

    swedishkiller

    NickyHolender

    Cherryd27

    jessicakillings

    NikkiVianna

    Dannitabruna

    brazilianbarbi

    NadinneDoll

    cjmiles

    jaydenicole

    liverichmedia

    JessicaCribbon

    jena

    rayhughesla

    shenizh

    phoenixskye

    iamnikkiphoenix

    ZzaikamMboo

    caroesteph

    shibalove

    ryphoto

    viviankindle

    stevebitanga

    caitlinoconnor

    destinyeastwest

    StephMi

    triceylala

    angeln99

    stwillis

    misshunter_d

    victoriamynguyen

    maria.bozinovska

    ######################

     

    Here are some of the bigger users dumped, I am attempting to bruteforce now :3

×
  • Create New...

Important Information

We would like to place cookies on your device to help make this website better. The website cannot give you the best user experience without cookies. You can accept or decline our cookies. You may also adjust your cookie settings. Privacy Policy - Guidelines