NetSPI Blog

Vikram Kulkarni

Vikram has a MS in Information Security from Indiana University and a BS in computer engineering from India. His main focus is on Mobile and Web application security. His research is mainly present in Android and IOS security. At NetSPI, he has worked on Web, Network, Mobile and thick client penetration tests. Vikram currently holds the CCNA certificate.

Vikram Kulkarni
April 4th, 2016

Tinder Flaw: Location-Based Application Payment Logic Bypass

The location based payment option of Tinder can be abused to use Tinder in the US, using a promotional offer of $3 per month instead of the usual $10 per month charge…

Vikram Kulkarni
August 4th, 2014

Intercepting Native iOS Application Traffic

In this blog, we will go through proxying an iOS application which uses native web sockets to interact with a web server. The blog will help penetration testers who are trying to intercept sensitive data that is being sent by an iOS application in a non-trivial manner over the network because some applications do not […]

Vikram Kulkarni
July 28th, 2014

Bypass iOS Version Check and Certification validation

Certain iOS applications check for the iOS version number of the device. Recently, during testing of a particular application, I encountered an iOS application that was checking for iOS version 7.1. If version 7.1 was not being used, the application would not install on the device and would throw an error. This blog is divided […]

Vikram Kulkarni
December 13th, 2013

Reverse Engineering iOS Applications in a Fun Way

Analyzing iOS application files to manipulate objective C functions is not a trivial process. The most common way to perform reverse engineering is by class dumping ipa files to discover all the class names and methods present in an application. This can be done using Cycript. Cycript is present within Cydia, and Cydia is installed […]