Edit

Hacking InsecureBankv2 App

Analyze traffic using burp

  1. Install Apk in the android emulator

  2. Fire up burp suite and configure the proxy to listen to all interfaces on port 8081

  3. Configure proxy settings in the android emulator WIFI settings to be your localip:8081

  4. Install Certificate to your emulator by exporting the burp certificate -> rename it to burp.cer -> push it to the emulator via adb push <PATH> then install it to your device

  5. run app.py for your server and proxifiy traffic using burp and use all feature and collect all requests

Pulling apk from devices

Decompiling application

  • Analyze the code and android manifest.xml subl base/AndroidManifest.xml

  • Use drozer to give you an overview about the application how to do it run app.package.info -a com.android.insecurebankv2 run app.package.attacksurface com.android.insecurebannkv2

Previlige Escalation

  • Fire up JADX and open up the base.apk file

  • Now you can see the source code and the apk data like the resources files

  • After searching for keywords like "admin" in the LoginActivity if ound this

  • this guy using a boolean value from resources to hide some functionalities

  • Go to res/values/stings.xml and notice "is_admin" is equal to no

  • Now Using code editors like sublime change it to yes and save the project

  • Now Change the name of directory to

  • Use APKTOOL to build our updated version and use sign tool to sign the application

  • And that's it you just remove the old version from phone and install your updated version instead

  • the signed apk will be insecurebankv2.s.apk

  • Notice Now there is a functionality for registration added

  • Back to jadx in the DoLogin Activity i found this weird Code

The "devadmin" part in the postData method handles a specific case where the username is "devadmin." When the username is "devadmin," the method sends the login data to a different endpoint (/devlogin) rather than the standard login endpoint (/login). This could be used for developers or administrators who might need to authenticate through a different process or endpoint. Here’s a more detailed explanation focusing on this aspect:

  1. Check Username:

    • The method checks if the username is "devadmin":

  2. Send to /devlogin Endpoint:

    • If the username is "devadmin", it sets the entity (the body of the HTTP request) for httppost2 (which points to the /devlogin URL) with the prepared login data and executes this post request:

  3. Send to /login Endpoint:

    • If the username is not "devadmin", it sets the entity for httppost (which points to the standard /login URL) with the login data and executes this post request:

  • So Login with username "devadmin" and without password will authenticate you as devadmin

Analyze SqlLite Storage

  • It is as easy as just go to the database directory of the package in the data directory

  • Then initialize sqlite and interact with it read tables and that stuff

Insecure Logging

  • Android Logs Accessible by all applications so when app expose secrets or private information it is a bug !

  • I Entered command adb logcat

  • And tried to Login to Apllication and Voila!!

  • The app Exposes plaint-text of the users

Exploit Broadcast Receivers

  • Information Gathering

  • Static Analysis MyBroadCast Activity

This code defines a BroadcastReceiver that listens for specific intents containing a phone number and a new password. When triggered, it retrieves encrypted username and password from shared preferences, decrypts the password, and sends an SMS to the given phone number with a message about the password update. If the phone number is not provided, it logs that the phone number is null.

  • Exploit send message tophone number 8888888 with new password

Exploit Content Providers

  • Find Provider URIs

  • Scan for Injection

  • Exploit SQL Injection

  • The Reason

Using SQLiteQueryBuilder without proper input validation can lead to SQL injection in content providers. If selection, selectionArgs, or sortOrder are directly used from untrusted sources (like user input) without sanitization, attackers can manipulate these parameters to execute arbitrary SQL commands, compromising the database.

Weak Cryptography

  • In shared preferences, logged-in user credentials are stored in an encrypted manner.

IDOR to ATO

  • While Proxifying the trafiic with burp suite i Looked up some functions like change-password feature

  • I noticed the part that contains username but i cant edit the username on it

  • After sending acorrect request and the password successufully changed

  • In burp the request was sple api request with parameters username and newpassword

  • So I Edited the username parameter to another username and it worked i changed other user's password

PreviousHacking the VulnWebView Lab

Last updated

Was this helpful?