| 1 | Apr 24, '24 | A similar tool - Lockphish - is available on GitHub. It is convincing, and a user in a hurry can be easily tricked Lockphish is a tool for phishing the lock screen, designed to gra | 53.2× | 632k | 3.1k | 716 | 3.1k |
| 2 | Sep 11, '23 | Public WiFi: Quick demo for 2 devices on the same network 1. SSLstrip + DNS change leads to user input interception for HTTPS with HSTS bypass 2. DNS spoofing redirects user to att | 45.6× | 542k | 3k | 704 | 1.9k |
| 3 | Sep 7, '23 | How to spoof #iOS devices with Bluetooth pairing messages using Android #DoS | 37.1× | 441k | 2.9k | 611 | 1k |
| 4 | Sep 23, '23 | 0-days exploited by #Predator spyware were delivered via man-in-the-middle (MITM) attack and 0-click vulnerability against #iOS and #Android In the video below, I demonstrated how | 36.7× | 437k | 2.3k | 529 | 1k |
| 5 | Jul 12, '23 | Bruteforcing PIN protection of popular app using $3 ATTINY85 #Arduino Testing all possible PIN combinations (10,000) would take less than 1,5 hours without getting account locked. | 30× | 356k | 1.9k | 463 | 790 |
| 6 | Oct 2, '23 | Use silent #SMS messages to track LTE users’ locations An attacker sends silent SMS messages with a defined pattern and analyze LTE traffic to verify the victim location. All you n | 28.8× | 342k | 2.9k | 710 | 1.9k |
| 7 | Oct 9, '23 | Get external IP address of the user during #Telegram call. Now it works well and returns public instead of local IP | 20.1× | 239k | 1.7k | 397 | 775 |
| 8 | Nov 8, '24 | Is your wifi network well protected? 👉 In 3 minutes, I discovered 175 access points with 79 connected devices using just a smartphone #nethunter | 19.2× | 228k | 1.1k | 171 | 826 |
| 9 | Sep 19, '23 | Guessing app's PIN using Flipper Zero as #BadUSB This "App Locker" app protects access to user selected apps - in this case, Instagram - using PIN code. It is possible to guess it | 18.9× | 225k | 2k | 419 | 586 |
| 10 | Sep 12, '23 | Get the IP address of the user during #Telegram call to obtain geolocation of ISP It might have some bugs since on Android, it returns only local, not external IP | 18.5× | 220k | 1.5k | 350 | 761 |
| 11 | Apr 4, '24 | How charging your phone can compromise your data using Juice Jacking attack More info: | 17.7× | 211k | 866 | 192 | 573 |
| 12 | Oct 31, '23 | Car Hacking using Flipper Zero and HackRF Both blogs present in depth research and testing of common methods of hacking fixed-code and rolling codes of radio frequency locks using | 16× | 190k | 1.6k | 286 | 895 |
| 13 | Aug 25, '23 | Free charging station Flipper Zero is connected to Android and recognized as HID device (keyboard) that launches a Rubber Ducky script to download, install, and launch Metasploit p | 15× | 178k | 1.4k | 373 | 601 |
| 14 | Oct 5, '23 | BADBOX: a firmware backdoored trojan found in 74,000 Chinese Android phones, tablets, and TV boxes in 227 counties and territories There are confirmed 8 devices with backdoors inst | 14.5× | 172k | 699 | 281 | 198 |
| 15 | Nov 2, '23 | Bluetooth LE spam attack is now ported to dedicated Android app to push notifications for Android and Windows For Android, is can advertise over 170 devices | 14.3× | 170k | 1.2k | 313 | 547 |
| 16 | Jul 14, '25 | Chat without internet via Bluetooth using #Bitchat app | 12.7× | 151k | 1.3k | 227 | 486 |
| 17 | Feb 29, '24 | Some of supported Mobile Hacker setup with description | 12.2× | 145k | 2.1k | 306 | 1.1k |
| 18 | Oct 11, '23 | Wi-Fi hacking using just smartphone Using wifite, I was able to capture handshake and crack it using custom word-list to obtain password of my testing Wi-Fi network using internal | 12.1× | 144k | 1.2k | 249 | 746 |
| 19 | Jun 17, '24 | Exfiltrate #WhatsApp chat, or internal data of any Android app, running on Android 12 or 13 by exploiting CVE-2024-0044 vulnerability | 12.1× | 144k | 1.5k | 349 | 1.1k |
| 20 | Sep 18, '23 | Use ADB & fastboot in #Termux without root 1. Install Termux and Termux:API apps from F-Droid 2. Install wget: pkg install wget 3. Run termux-adb installation script Now you can us | 11.9× | 142k | 1.4k | 312 | 919 |
| 21 | Sep 24, '23 | Nice camouflage. This malware is hard to get rid of. Keeps changing its name and icon impersonating apps already installed on the device | 11.8× | 141k | 837 | 178 | 195 |
| 22 | Sep 11, '23 | [NEW] You can easily spoof #iOS Bluetooth pairing pop-up messages using any non-rooted #Android! All you need is nRF app from Google Play and input data to advertise, see the video | 11.7× | 139k | 911 | 210 | 527 |
| 23 | Sep 18, '24 | Exploding smartphones? In 2021, a GPS tracker implant was found in an iPhone in Russia. The iPhone was replaced with a smaller battery to create an extra space for the tracker, and | 11.7× | 139k | 1.4k | 313 | 435 |
| 24 | Oct 17, '23 | [New Blog] BLE Spam allows now to send unwanted notifications to iOS, Android and Windows at once using Flipper Zero If you don't have Flipper Zero, in the blog I explained how to | 11.5× | 136k | 1.1k | 247 | 431 |
| 25 | Mar 27, '24 | Demo of using #BlueDucky to exploit 0-click Bluetooth vulnerability of targeted Android smartphone (CVE-2023-45866) Executed by Raspberry Pi 4 and Android running #NetHunter | 10.9× | 130k | 1.5k | 337 | 848 |
| 26 | Oct 18, '23 | Automatically extract URL and IP endpoints from Android app to a txt file using apk2url Fast and useful tool for pentesters, bug bounty hunters, or malware analyst | 10.7× | 128k | 1.4k | 305 | 781 |
| 27 | Jul 23, '23 | Testing ADB Exploitation-Framework for Android The framework allows you to search and connect to #Android devices with open #ADB port (can't bypass authorization request) across th | 10.2× | 122k | 1.2k | 248 | 486 |
| 28 | Oct 3, '24 | Click farm with auto IG chat This is an #Instagram automatic fan machine. It appears to be programmed to chat with people on IG using "AI" and auto-clicks. It could be used as auto | 10.2× | 121k | 786 | 215 | 491 |
| 29 | Oct 16, '23 | @Human101Nature when you know a guy that can do it cheaper | 10.1× | 120k | 571 | 2 | 0 |
| 30 | Sep 21, '23 | Because of a bug in Android 8.0, it is possible to bypass lock-screen timeout and disable Android PIN/Password/Pattern using ADB commands In the video, I automatically tested 26 di | 10.0× | 119k | 985 | 211 | 403 |
| 31 | Nov 29, '24 | How to build portable hacking lab and control it with a smartphone | 9.6× | 114k | 1.3k | 289 | 970 |
| 32 | Sep 29, '23 | WiFi spam using Android You can generate SSIDs using rooted Android with an external WiFi adapter. If combined with deauthentication, it might be an interesting local advertising t | 9.6× | 114k | 1.1k | 228 | 433 |
| 33 | Jan 23, '24 | PoC to takeover Android using another Android by exploiting critical Bluetooth vulnerability to install #Metasploit payload without proper Bluetooth pairing (CVE-2023-45866) It sti | 9.2× | 109k | 1.1k | 285 | 467 |
| 34 | Jul 21, '23 | Trust me...I'm a dolphin 🐬 | 8.7× | 103k | 976 | 158 | 224 |
| 35 | Jul 28, '23 | Keytap3: Retrieve keyboard clicks from audio recording You can place a smartphone near the keyboard or record phone calls and afterward extract pressed keyboard keys to get sensiti | 8.6× | 102k | 974 | 277 | 447 |
| 36 | Sep 26, '23 | Your access card is mine now. Stay tuned! | 8.3× | 99k | 755 | 105 | 238 |
| 37 | Sep 19, '23 | Don't connect to wrong Bluetooth speaker 🔊 Flipper as bad Bluetooth impersonates speaker discoverable in the vicinity. After established connection, it can trigger custom code suc | 8.0× | 95k | 873 | 166 | 230 |
| 38 | Jun 11, '25 | Can your phone be tracked without installing any malicious app? Yes. In my post I'll show how a simple link can reveal your smartphone’s location, demonstrate what a targeted user | 7.9× | 93k | 1.5k | 282 | 1.5k |
| 39 | Nov 7, '23 | Video tutorial on how to install rootless Kali NetHunter in 8 minutes on Android 13 and Android 14 by @davidbombal | 7.6× | 90k | 536 | 102 | 229 |
| 40 | Oct 10, '23 | NHLaucher: a customizable component of NetHunter that provides feeling of desktop Kali running on Android with over 250 tools NHLauncher is an open-source app that makes it easier | 7.6× | 90k | 793 | 172 | 539 |
| 41 | Jan 24, '25 | USB Army Knife: Close Access Penetest Tool created by @therealshodan It is capable of: remote keystroke injection, VNC, USB network adapter, EvilAP, Marauder, record microphone, co | 7.3× | 87k | 1.2k | 188 | 971 |
| 42 | Mar 28, '24 | drozer 3.0.0 After almost 7 years, new version of drozer compatible with Python 3 and modern Java was released If you don't know, drozer was a very popular security testing framewo | 7.3× | 86k | 1.1k | 307 | 537 |
| 43 | Oct 6, '23 | Guess pass-code to unlock PIN protected TV using #BadUSB I have tested a few TV's lock protection, and none of them include any timeout or lockdown. Because of that, brute-forcing | 7.2× | 86k | 739 | 143 | 181 |
| 44 | Sep 23, '24 | 0-Click exploit discovered in MediaTek Wi-Fi chipsets affects routers and smartphones (CVE-2024-20017). Published PoC can be tested even from a smartphone Technical details: PoC: b | 7.2× | 85k | 1.1k | 291 | 509 |
| 45 | Jul 6, '23 | Auto pwn Android using cheap BadUSB Metasploit payload is auto installed via Digispark Attiny85 programed as Rubber Ducky #Rubberducky #Metasploit #Digispark #KaliLinux | 7.1× | 84k | 999 | 269 | 302 |
| 46 | Oct 12, '23 | iOS Pentesting Series Learn how to work with useful tools and apps such as Frida, Objection, 3uTools, Cydia, Burp, fsmon, fridump, SSL bypass, reFlutter etc. Part 1: Part 2: Part 3 | 7.0× | 84k | 658 | 224 | 418 |
| 47 | Jul 14, '23 | SIGIT - Simple Information Gathering Toolkit SIGIT performs #recon based on user name on 27 popular websites, dump Facebook information (cookies needed), find email, retrieve infor | 7.0× | 83k | 686 | 175 | 367 |
| 48 | Oct 4, '24 | Transform your smartphone into a portable hacking lab Lear how to set up Kali Linux #PiTail and control it with just your smartphone. Plus, get some of my tips on troubleshooting c | 6.8× | 81k | 1.1k | 242 | 867 |
| 49 | Jul 31, '23 | Auto Android pwn using BadUSB Plug in and auto-install Metasploit payload using Digispark Attiny85 as BadUSB. It is programmed as HID, which means it behaves as keyboard that press | 6.7× | 80k | 727 | 170 | 243 |
| 50 | Jul 19, '23 | Get Wi-Fi password via WPS Button attack using NetHunter This scenario requires you to have physical access to a router that has the WPS feature enabled or to be in the Access Poin | 6.7× | 80k | 844 | 217 | 446 |
| 51 | Jul 12, '23 | ADB-Toolkit v2.3 ADB-Toolkit is a BASH Script with 28 options and a Metasploit section, which has 6 options. These are made to do easy penetration testing for Android Device by @as | 6.7× | 80k | 704 | 187 | 300 |
| 52 | Aug 5, '24 | Heap overflow in JPEG loading in Samsung's Little Kernel in bootloader allows a privileged attacker to execute persistent arbitrary code (it survives reboots and factory reset) CVE | 6.7× | 80k | 1.1k | 334 | 396 |
| 53 | Jul 23, '24 | WhatsApp trick: Android malware can impersonate PDF file | 6.7× | 79k | 765 | 200 | 544 |
| 54 | Jul 11, '23 | Step-by-Step Guide to Building an Android Pentest Lab 📲 | 6.1× | 72k | 797 | 251 | 416 |
| 55 | Jul 13, '23 | New #PhoneSploit Pro is available on GitHub PhoneSploit Pro is all-in-one #pentesting tool to remotely exploit Android devices using ADB and Metasploit-Framework to get a Meterpret | 6.1× | 72k | 629 | 143 | 286 |
| 56 | Oct 26, '25 | The weekend project continues. Today, I installed Pi-hole on an old rooted Android and turned it into a portable Pi-hole that blocks ads and trackers on the network - even on the g | 5.9× | 70k | 1.5k | 167 | 564 |
| 57 | Sep 27, '23 | Trust me...I'm a dolphin 🐬 [NEW BLOG] I explained how it is possible to get persistent reverse shell from Android app without visible permissions to make device unusable via annoy | 5.9× | 70k | 656 | 151 | 226 |
| 58 | Sep 20, '23 | You can run Rubber Ducky scripts on iPhone as well How it works: #rubberducky #flipperzero #iPhone | 5.9× | 70k | 568 | 80 | 132 |
| 59 | Jan 15, '25 | Scanning Wi-Fi networks using desktop Kali Linux running on rooted Android This is a huge difference between the wifi networks discovered using an internal wifi chipset (wlan0) and | 5.8× | 69k | 970 | 179 | 544 |
| 60 | Jul 8, '23 | APKHunt - static code analysis tool for Android apps that is based on the OWASP MASVS framework | 5.6× | 67k | 656 | 157 | 189 |
| 61 | Mar 5, '25 | EvilLoader: Yesterday was published PoC for unpatched vulnerability affecting Telegram for Android The exploit has been sold on underground forum since January 2025 ✅Don't install | 5.6× | 67k | 524 | 96 | 260 |
| 62 | Jul 6, '23 | Search engines for pentesters #Pentesting #bugbounty | 5.5× | 66k | 1.1k | 285 | 639 |
| 63 | Feb 21, '25 | [new] Bettercap on Android 60-pages guide on how to use bettercap on mobile device | 5.5× | 66k | 1.2k | 189 | 745 |
| 64 | Dec 30, '24 | 2024 recap | 5.5× | 65k | 1.1k | 126 | 545 |
| 65 | Jul 15, '25 | Include computers into #Bluetooth mesh network for Bitchat app ✅️ More devices = more nodes ✅️ Wider communication range by @kaganisildak | 5.5× | 65k | 1.1k | 169 | 482 |
| 66 | Oct 31, '23 | [new blog] How to get Wi-Fi password via WPS Button attack using NetHunter This scenario requires to have physical access to a router with enabled WPS feature or to be in the Acces | 5.3× | 63k | 676 | 138 | 324 |
| 67 | Jun 3, '25 | This is who you're arguing with online | 5.3× | 63k | 1.2k | 207 | 288 |
| 68 | Jun 10, '25 | Locating Smartphones Using #Seeker: How a Simple Link Can Reveal Your Smartphone’s Location | 5.1× | 61k | 1.1k | 171 | 942 |
| 69 | Jun 6, '25 | BrutDroid — Android Security Toolkit that automates tedious emulator setup with one command (emulator, Magisk, Frida, Burp certificates, etc.) | 4.9× | 58k | 1.2k | 195 | 780 |
| 70 | Oct 21, '23 | Offensive Clipboard Proxmark3, Nexus 5 with Nethunter, Wifi Pineapple Nano, Raspberry Pi Zero W, Mophie battery pack, USB hub, and Clipboard (from Walmart). With this clipboard and | 4.8× | 57k | 622 | 96 | 167 |
| 71 | Dec 29, '24 | Install and run any firmware (Marauder, Bruce, Ghost ESP...) on ESP32 devices without using computer with M5Stick Launcher | 4.7× | 56k | 845 | 147 | 505 |
| 72 | Oct 7, '24 | Preparing slides for my upcoming awareness presentation on how hackers can use mobile malware, exploits, and these gadgets. It will be fun with lot of demos 📱 📡 | 4.7× | 56k | 803 | 119 | 333 |
| 73 | Feb 7, '25 | Demo of recent NFC Android malware called #NGate | 4.7× | 56k | 919 | 186 | 553 |
| 74 | Oct 14, '25 | New Pixnapping Attack: allows any Android app without permissions to leak info displayed by other apps exploiting Android APIs and a hardware side channel (CVE-2025-48561) Pixnappi | 4.6× | 55k | 555 | 126 | 308 |
| 75 | Jan 18, '25 | Smartphones constantly tell nearby devices which WiFi networks you've connected to and want to reconnect automatically. This information is visible for anyone, and anyone can, base | 4.6× | 54k | 697 | 113 | 357 |
| 76 | Feb 26, '24 | When Windows can't properly disable driver signature feature to let you install fastboot drivers, then you can use #NetHunter or #Termux running on Android to unlock the bootloader | 4.6× | 54k | 693 | 104 | 259 |
| 77 | Jan 3, '25 | #BlueDucky is still a relevant tool to scan and identify vulnerable #Bluetooth devices (CVE-2023-45866). Don't postpone updates of your devices in 2025 #NetHunter | 4.5× | 54k | 1.1k | 193 | 639 |
| 78 | Dec 22, '23 | Bad Bluetooth attack is implemented in the latest Kali NetHunter version As a result, it is possible to inject keystrokes into a Bluetooth connected device | 4.4× | 52k | 542 | 137 | 173 |
| 79 | Jan 9, '25 | Boost Flipper Zero with FEBERIS: 3-in-1 SubGhz, NRF24, and WiFi board | 4.3× | 51k | 880 | 169 | 495 |
| 80 | Jun 6, '25 | How to transform old Android into cyberdeck running Kali #NetHunter | 4.3× | 51k | 1.1k | 140 | 450 |
| 81 | Oct 24, '23 | [New Blog] How to increase radio range of Flipper Zero beyond 100 meters yourself | 4.1× | 49k | 518 | 98 | 120 |
| 82 | Feb 17, '25 | Just wrapped up a 60-page guide on setting up and using #Bettercap on Android for mobile pentesters. Should I publish it this week? #Termux #nethunter | 3.8× | 45k | 915 | 135 | 430 |
| 83 | Jun 20, '24 | Metasploit: Spyware generator in a pocket Attackers can generate, host and distribute malware only using a smartphone #NetHunter | 3.7× | 45k | 580 | 135 | 293 |
| 84 | Dec 12, '24 | Bluetooth and Wi-Fi Jamming using Flipper Zero | 3.4× | 41k | 668 | 135 | 393 |
| 85 | Feb 21, '25 | Mobile arsenal Description for some of these gadgets at: | 3.4× | 41k | 822 | 130 | 605 |
| 86 | Jun 12, '25 | Stryker - Android pentesting app with premium access now free until 2050! Scan networks, launch exploits, and test web apps—all from your phone Bonus: includes a list of suggested | 3.4× | 40k | 541 | 98 | 467 |
| 87 | Mar 10, '25 | Looks like that starting from Android 15, you wont need #Termux anymore. There will be a native Linux terminal app from Android system | 3.4× | 40k | 621 | 88 | 114 |
| 88 | Dec 23, '24 | Exploring Marauder, Bruce, and Ghost ESP on Cheap Yellow Device | 3.3× | 40k | 600 | 98 | 359 |
| 89 | Feb 11, '25 | Introducing Evil Crow RF V2 A portable radio frequency device that's fully compatible with Flipper Zero. It can even replay prerecorded Sub-GHz frequencies available for unofficial | 3.3× | 39k | 796 | 147 | 508 |
| 90 | Jan 29, '25 | Any smartphone can be extended with Marauder firmware to operate an Evil AP These attacks can be well hidden and don't require laptops, Flipper, or other devices with antennas. A s | 3.3× | 39k | 599 | 127 | 419 |
| 91 | Jan 25, '25 | Did you know you can monitor Bluetooth and BLE traffic in real-time with #Wireshark on a customized Android device? This helps you understand device-to-host communication and spot | 3.2× | 38k | 761 | 128 | 367 |
| 92 | Sep 27, '24 | How hackers can exploit Wi-Fi Captive Portals to distribute Android malware all from a smartphone using Wifi-Pumpkin on NetHunter | 3.0× | 36k | 583 | 158 | 424 |
| 93 | Nov 13, '25 | How to build Android Bug Bounty lab Guide to configuring emulators, real devices, proxies, Magisk, Burp, Frida by @yeswehack | 3.0× | 36k | 644 | 120 | 444 |
| 94 | Jul 9, '25 | How to Install Gemini CLI on Android using Termux | 2.9× | 34k | 581 | 96 | 275 |
| 95 | Jul 14, '25 | Shizuku unlocks advanced functionality on any Android Using #Shizuku your Android gains ADB privileges to remove bloatware, list running processes, open listening ports, view store | 2.9× | 34k | 551 | 132 | 376 |
| 96 | Jul 25, '25 | This is Evil Crow RF V2 A portable radio frequency device that can be operated just by any smartphone. Fully Flipper Zero compatible — even replays Sub-GHz signals from unofficial | 2.8× | 34k | 543 | 98 | 393 |
| 97 | Oct 24, '25 | DroidRun brings AI-driven automation to Android: ✔ Auto-fill OTP codes ✔ Automate app/device initial setup ✔ Security/malware testing with #Frida running in the background ✔ Automa | 2.8× | 34k | 568 | 104 | 405 |
| 98 | Dec 26, '24 | Jamming Bluetooth and Wi-Fi using Flipper Zero | 2.7× | 32k | 585 | 84 | 249 |
| 99 | Oct 17, '25 | New Android BEERUS framework for dynamic analysis & reverse engineering BEERUS brings Frida auto-injection, sandbox exfiltration, memory dumps, Magisk integration and more for | 2.7× | 32k | 569 | 93 | 345 |
@karpathy
@levelsio
@paulg
@naval
@marclou
@illyism