Penetration testing notes and research by Guler Tech Ltd — web, mobile, API, network/AD, cloud and privilege-escalation writeups from real engagements and lab work. https://gulertech.co.uk/ Thu, 03 Sep 2026 00:57:23 +0100 ART protects managed code, not JNI/NDK. What to test in native libraries, why MASTG dropped its black-box tests, and how to scope this in a report. Wed, 02 Sep 2026 00:00:00 +0100 https://gulertech.co.uk/mobile/mastg-know-0005-memory-corruption-bugs/ https://gulertech.co.uk/mobile/mastg-know-0005-memory-corruption-bugs/ androidndkjninativememory-safetyghidramasvs-code Identifying bundled dependencies in an APK, mapping them to known CVEs, and the licence exposure most reports leave out. Wed, 02 Sep 2026 00:00:00 +0100 https://gulertech.co.uk/mobile/mastg-know-0004-third-party-libraries/ https://gulertech.co.uk/mobile/mastg-know-0004-third-party-libraries/ androidscadependenciescvesupply-chainmasvs-code Signature schemes, debug-key detection, certificate validity requirements, and why a v1-only APK is a repackaging finding. Wed, 02 Sep 2026 00:00:00 +0100 https://gulertech.co.uk/mobile/mastg-know-0003-app-signing/ https://gulertech.co.uk/mobile/mastg-know-0003-app-signing/ androidapkcode-signingapksignerrepackagingmasvs-resilience The deprecated pre-API 28 fingerprint API — what a correct implementation looks like, the five prerequisite checks, and how to spot the null-CryptoObject pattern. Wed, 02 Sep 2026 00:00:00 +0100 https://gulertech.co.uk/mobile/mastg-know-0002-fingerprintmanager/ https://gulertech.co.uk/mobile/mastg-know-0002-fingerprintmanager/ androidbiometricsfingerprintmanagerkeystorelegacy How Android biometric auth actually works, why event-bound implementations are trivially bypassed, and how to test for Keystore-backed flows. Wed, 02 Sep 2026 00:00:00 +0100 https://gulertech.co.uk/mobile/mastg-know-0001-biometric-authentication/ https://gulertech.co.uk/mobile/mastg-know-0001-biometric-authentication/ androidbiometricskeystorefridamasvs-auth