Hacking Android Using L3MON

Requirements:
Android Device
Windows 10
L3MON
Ngrok
Java

Step 1:- Download and Execute "L3MON".
https://github.com/D3VL/L3MON/releases/


Step 2:- Start Ngrok All "Services" using.

    ngrok start --all


 

Step 3:- Using Ngrok "Http" or "Https" Link To Open L3MON Login Using "Username And Password".
    http://<SERVER IP>:22533 


Step 4:- Navigate To "APK Builder" And Enetr "IP Address" And "Port Number" Of Ngrok.


Step 5:- Now Click On "Build", It Will "Created APK".



Step 6:- Now Copy The APK File To The "Android Device" Using Any Medium Like "File Sharing Websites" (mega.nz, Etc.)



Step 7:- Install The APK In The Android Device. You Will Get A Session On Device In L3MON To Interace.
It Will Dispaly Android Device Is "Online" Or "Ofline" And Also You "Manage Device"("Call Log", "Clipboard Log", "Contacts", "Devices Info", "File Explorer", "GPS Log", "SMS Log", "Send SMS", "Installed Apps", "Microphone", "Notifications", "Event Log", "WiFi Manager").


Manage Device

 
  
WiFi Manager
Send SMS
 
SMS Log
Notifications
Microphone
Installed Apps
GPS
File Explorer
Event Log
Contacts
 
 Clipboard Log
Call Log

Enjoy!!!

Countermeasures:
Download Apps Only From Playstore.
Developers Option Should Be Disabled If Not Needed.
Unknown Links Should Not Be Clicked.
Internet Should Be Disabled If Not In Use.
Stop Using Android .. JUST Kidding.


Comments

Post a Comment

Popular posts from this blog

OSINT Tool in Termux

Image
The Instagram OSINT Tool gets a range of information from an Instagram account that you normally wouldn't be able to get from just looking at their profile The information includes: [ profile ] : user id, followers / following, number of uploads, profile img URL, business enum, external URL, joined Recently, etc [ tags & mentions ] : most used hashtags and mentioned accounts [ email ] : if any email is used any where it'll be displayed [ posts ] : accessability caption, location, timestamp, caption, picture url, etc ( yet not working correctly with posts instagram marks as 'sensitive cotent' ) How To Install apt update && upgrade -y Pkg install git pkg install python3 git clone https://github.com/th3unkn0n/osi.ig.git && cd osi.ig python3 -m pip install -r requirements.txt Usage python3 main.py -u username
Read more

Active Directory Ransomware Attacks

Image
    Organizations worldwide use Active Directory (AD) as their primary identity service , which makes it a top target for ransomware attacks . This article explains how adversaries exploit Active Directory during ransomware attacks and provides strategies and tools for defending against this modern menace. The two phases of a ransomware attack A common misconception about ransomware attacks is that they are quick: Someone opens an infected email attachment or inserts an infected USB device , and within minutes data across the network is encrypted and a ransom demand is displayed on every screen . The reality is quite different. Ransomware attacks today tend to be quite sophisticated and methodical . To encrypt as much sensitive information as possible and therefore maximize the chances of receiving a high payout , attackers proceed in two phases: Find an entry point — The first step is to gain a foothold in the victim organization ’s network . One common strategy is to comp...
Read more

Colt Telecom Hit by WarLock Ransomware: SharePoint Zero Day Used for Mass Data Theft

Image
  What Happened On August 12, 2025 , Colt Technology Services—a UK-based telecom giant—experienced a cyberattack that disrupted several internal support services, impacting systems like Colt Online, porting, and Voice API platforms, while core network services remained unaffected. Who Claimed Responsibility A threat actor using the handle "cnkjasdfgd," claiming to represent the WarLock ransomware group , offered 1 million stolen documents for US$200,000 , providing sample files to prove their legitimacy. Made Possible By The attackers exploited a critical zero-day vulnerability in on-premises Microsoft SharePoint (CVE‑2025‑53770), which was publicly patched on July 21, 2025. Technical Breakdown (“ToolShell” Exploit Chain) Attackers used a sophisticated exploit chain now dubbed ToolShell , involving multiple steps: 1. Initial Access – Bypassing Authentication A crafted HTTP POST to the /_layouts/15/ToolPane.aspx endpoint with a spoofed Referer header (/_layo...
Read more