Welcome back, guys.
In this video we want to talk about the Android manifest eczema because in my opinion, this is the
most important configuration file if we analyze an Android application.
So what makes this file that important for us?
This is something we're going to find out right now.
Let's have a look.
All right.
Here we are back in the Ubuntu VM and I have prepared a little application where we can analyze an Android
manifest XML.
So you will find this app as an attachment of the section.
I already got it here.
This one, this privacy dot apk.
So the first question is how can we get this android manifest out of this file?
I mean, we have seen two options unzip and apk tool d unzipping.
It doesn't bring us any advantage because the Android manifest example will be still in its proprietary
binary format.
And therefore we need to use the APK tool with the DX option which decodes this binary file into a plain
XML file.
All right, so therefore let's do this.
I am doing it right click open a new terminal because then I'm directly in this directory here and then
APK tool D on this privacy apk.
All right, we can see decoding Android Manifest Mel, both resources and all the the other options
also for example, classes, the text and so on.
And if you take a look into this one, here, we have it right now.
Let's go for the DV cells to do code editor.
So open with other application and there we have it.
Oops.
Not this one.
Here we have it.
I have also.
Yes.
Already enabled select language XML.
I mean, this is being done by default and will also enable verb wrap.
Then we've got everything on the page.
So those those lines will be simply break off over here, for example, that we do not have to scroll
on the right.
Okay.
So here we have now this file and let's split it up a little bit and then let's take it to the graphic
template.
So we split it up over here and we've Guten Tag Users permission.
If we've got permission, we've got some queries.
Here's an application tech provider receiver service.
You can see we've got a lot of stuff in here.
I mean, this is as much as we need during this course.
There's a bunch of new stuff which might not be familiar right now for some of those queries.
But I mean, that's why we are here.
We discussed this right now.
Okay.
So I guess this looks good.
Yes.
So let's take this to the graphic template and then let's have a look and deeper look into this file
right now.
Let's do this.
All right.
So here we are back on the graphic tablet.
And now let's find out what makes this file that important for an Android application here, because
this is the first file I'm taking a look into.
If I analyze an application and let's find this out right now, we start with line one because we will
analyze every single line in here.
So this one over here, the first half of this line is not really that important.
It starts getting interesting at this point.
Okay.
So what do we have here?
We've got Android compile SDK version 30 and we've got Android compile SDK version code name.
Let me get the cursor out of the way.
11.
So this means the developer has used the compiler settings for Android version 11, which is this one.
Android version 11 and the app level for Android version eight level is API level 30.
So that's one.
This one over here, this is just the AP, the app level.
Why is this not important?
Because it means that every security option till Android version 11 is being included in this app over
here.
And for example, in Android version seven, there wasn't huge change regarding the trust relationship
of certificates.
The user storage of an Android smartphone is not longer being trusted as default, and this means the
security setting is being used in this application over here.
Also regarding two things like the visibility of broadcast receivers or stuff like this, so far we
haven't talked about all of these components, broadcast receiver, certificate pinning and stuff like
this, and this version is dedicated to the Android manifest example.
And yet to be honest, I have to use these components quite often during this file.
But don't worry, we will have an extensive look into every single one of them during this course.
So this file is simply just getting an overview about this application and therefore do not worry too
much if you cannot follow on certain terms right now because we haven't discussed them yet.
Alrighty, perfect.
Okay, I'm back to this one.
We now ock all security features till Android version 11 are being included in this app.
All right.
Next, it's getting even more interesting because this one over here, this is the package name.
And the package name is some kind of unique identifier for this application.
So unique.
All right.
I guess it's hard to read, but still possible.
Alrighty.
So the unique identifier, I mean, yes, it's a unique identifier for this application, but it is
not the trust relationship between a developer and an application.
What does this mean?
Well, let's have a look.
And this one is the unique identifier.
Let's install this app now on our smartphone.
So here's our smartphone.
Right?
And here we have now this application and this one over here.
So this is being installed here.
This means we can only have one application with this identifier and this one, let's make it more dramatic
on our device.
If we now try to install another application and this one, for example, with the same identifier over
here.
So this one.
Then we're getting an error because the smartphone is telling.
Nope, I already have one application with this unique identifier on the device and this one is not
this application over here.
The check is based on the signing certificate.
Don't worry, we will talk about signing later on.
But I mean, it's also not that relevant.
All we need to know right now is we cannot have two applications with the same name running on our device.
But why is this now important or interesting?
Because the package identifier is not some kind of trust relationship to a certain developer.
Let's say we've gotten sharing application on our device, this one.
And yes, I don't know a name, so let's call it this one is, for example, WhatsApp.
WhatsApp has a unique identifier, something both com facebook or meta.
I'm not sure about this one right now.
It has a unique identifier.
All right.
But this identifier can be chosen by every developer, too.
So if I develop an application, I can choose whatever package identifier I like to use.
In this case right now, let's say I'm using this exact same package identifier.
And if the user has not WhatsApp being installed on the device already, then my application will be
installed and it looks absolutely legit all the same until the user tries to inside the real WhatsApp
application.
In this one, for example, via the Google play store.
Then the user gets an error because there's already one application with this package identifier on
the device.
All right.
So it doesn't mean if you're having the package identifier come Facebook, WhatsApp or things like this,
that this is the original application.
It could be in Fake and Trojan Horse or things like this.
Alrighty.
Okay.
So that's one important fact about this package identifier.
And the other one is that we as attacker are also quite often using it because we can use this package
identifier to address this application regarding to our scripts, tools or even within the ADB shell,
we can use this package identifier to target in certain application on this device.
So this is really a useful and important information for us.
All right.
And let me do a little bit of cleanup right now and then we move on over here.
Okay.
Back to this one.
So at the end of this line, we've got then this part and this is not really relevant because this is
just the build version code, which means that the developer has verified that this application works
on API level 30 or Android version 11, nothing more.
The important part is that one in green in this part over here.
So this makes sure which compiler has been used to build this application, all of which compiled version
in this case Android version 11.
So we also need to meet the requirements and security features for this version.
And then we are done with line one.
But don't worry, the next one will be a little bit more faster at least I hope so.
Okay.
What do we have next?
Next, we've got those three lines.
And what do we have here?
We've got users permission and then we've got Android permission.
Read contacts, Internet, read external storage.
So these are the permissions our Android application can use.
It doesn't mean that they are being used, but the application has the ability to use them so the application
can access our contexts.
This one over here.
If the user grants this permission to our application.
All right, then the application can perform some network requests with the Internet permission.
But I mean, that's pretty common right now.
And last but not least, this one is a little bit important for an attacker because it means the application
is interacting with the external storage of our smartphone.
All right.
So every time the application wants to perform in certain tasks, getting access to the microphone,
camera, accessing our photos and stuff like this, this permission needs to be included in the manifest
XML.
They cannot be added afterwards.
They need to be initially included.
And this also gives us a good overview of what this app is capable to do, might interact with context
and also with the external storage.
So we should figure out what this app is doing.
I mean, context, yes, could be important, but this one over here, the read external storage might
be a little bit more important.
Why?
Maybe let's have a quick view into the data structure of an Android app and how this is being handled.
We will have extensive videos on this topic, but for now, let's see why this one is important for
us.
Okay, so here we have our smartphone and this time it's being yellow.
And if we install our application and then this application is being installed in a protected directory,
so those applications are being sandboxed.
We will have a look into this one when we talk about permissions.
Okay.
So the sandbox directory is on that data.
Data and then the package name of this application.
Okay.
So that's a protected directory.
Other applications are not able to interact or see those data.
If we're having root or system privileges, another story.
But other regular applications cannot do this.
But sometimes it's important that applications share or access shared media.
For example, the music directory downloads, directory photos and things like this.
So these files are being stored on a public available directory, which is the SD card.
So that's not an application right now.
That's an publicly available directory and SD card.
And this one doesn't mean right now it's a little bit confusing, but it doesn't mean that it's an physical
SD card in our device.
So attached to this device right now, the SD card, I guess the term comes from the EMC, which is
what was it?
Embedded multimedia cat, I guess.
Yes, I guess.
Embedded multimedia cat.
And this is basically the same like an SD card.
So even if you're not having a physical SD card plugged into our device, the directory name will be
still SD card based on the EMC.
That's just an flash chip.
Okay.
All right.
So this SD card now contains several directories and for example, the downloads directory or the music
directory, the documents and more.
Why is this now important?
Because it could mean that this application stores some sensitive data on the SD card, or it's fetching
some data which are being used in this app.
In this case, we are having read external storage, so it might just fetch data from a file over here.
And depending on the data this application is fetching, it could affect the workflow or for example,
the application security itself.
And attacker might be able to abuse this in the following way that the attacker also gets this permission,
also the right permission, for example.
Then the attacker places its own application on the smartphone and then modifies this file.
Let's say that's the directory which will be read afterwards.
From this app modifies this file which gets afterwards used in this application.
All right.
So it escalated a little bit.
Let me clean this up here.
Okay.
So this means if you are seeing permissions like read external storage, then we should check out what
the application is doing with this permission.
That's the that's the key takeaway from this whole drawing right now.
All righty.
Okay.
Clean up and then back to this one.
Okay.
Next, we've got this line over here and here.
We need to be very precise what we are reading.
We've got permission.
And if you take a look at both, then we had use this permission.
So yellow permissions are being predefined permissions, which are being used by this application.
But now in this one is now defining and own permission.
And this is something we will we will heavily exploit during this course.
So the application can also define an own permission.
And here we've got the label, what this permission is doing.
So here we can see allows reading user in or out there some typo in their user information.
But I mean, that's a description, so it's perfectly fine.
This is the description of this one.
So we are allowed to reduce the information and then we forget the name.
The name is now the name if you want to request this permission within our own application.
And then we've gotten protection level and dangerous in this one over here.
So we will talk about this extensively in the in the common videos right now.
To sum this up, it simply just means an application can define its own permission.
If you want to perform some sensitive task but want to share this task with other applications, then
they can ask for requesting this one.
And if the user grants us permission, then they can exchange data between each other.
Okay, so that's what this one over here defines.
So within our Android application, we can use existing permissions or we can also create our own ones.
And this one, this is important because we will exploit this during this course.
All right.
Okay, then next we've got this one, this queries.
And this one is an Android security feature which has been implemented, I guess, in in version eight
and higher.
But don't quote me on this one.
So this means if our application wants to exchange data with another application via an and component,
for example, in broadcast receiver, then it needs to be visible for the other application.
In this case, right now it's the C application.
So I guess a drawing will explain this a little bit better.
So let's say we've got here our C application and here we've got our application, the privacy application
privacy.
If you now want to exchange data with this application, we need to tell the C application that we accessed.
And this is exactly what this very parameter over here does.
It tells us if, hey, we do exist on the smartphone and we want to get back the data we have asked
for.
This should be an eye.
Maybe it's not that clear, but I guess it's okay.
So now this application knows we we are an application on the smartphone and we exist.
We are asking for data and here we can see see if it's returning data back.
All right.
So that's what this very parameter means.
We will also use this if you write our own checking application to bypass logging screens, extract
sensitive information, or perform an arbitrary file access, then this one over here will be required.
So therefore I have included it.
All right, so we can see we already got a lot of stuff in our configuration file and now we focus on
the second half.
So over here we've got the application tech.
This starts over here and it ends here.
Okay, let's see what's inside this application tech right now.
So I choose a new color on this one.
And let's see, this one is the first interesting entry allowed back up.
True.
So it means we can perform and back up, for example, by the ADB shell and the data of this application
will be included in our backup.
It doesn't mean that they are sensitive information included in our backup like credentials or tokens
or things like this.
It just means that some data will be backup.
So the configuration is being done by the application itself.
But we we know, okay, we have the opportunity to perform a backup for the self.
So we should definitely try this out.
What data are being included over here?
All right.
And then we've got this one.
This is not really interesting.
So we skip this part and then we've got Android debugger built through.
We will talk about debugging and application at the end of this course because this topic can be a little
bit more complex.
It simply just means that having this feature enabled, we are allowed to attach to this process of
this application.
So we are allowed to debug it, which is I mean, it's good for an attacking perspective.
And to be honest, if you build in release or if you're making and release bit of your application,
this will be automatically being set to false.
So it's it's not really often included, but even if it's not being included in the Android manifest
XML, this file over here can be used to enable it.
Once again, let's say this one has been set to false.
Does this mean we are not allowed to debug this application for now?
Yes.
But what if if we are simply decoding this this application?
So with the APK tool decode modifying the Android manifest XML to enable it once again.
Beat this application and install it.
Then we would have an detachable enabled and we could attach to this one once again.
So the Android manifest segment can be also used to enable certain features.
For example, debug features.
OC Yes, absolutely.
Nice.
So you get some, some nice sites here.
Okay.
Next, we've got Android extract, native flips forwards.
And this one simply just means if we have native libraries included in our application, they are not
longer being compressed.
So this will increase the size of our application, but unless they are small, it doesn't really affect
us at all.
So this flick is normally not very important for us, and this is just if the developer has chosen to
compress the native libraries or not, until we are talking about freedom, when we inject Frida into
a native library, then this one needs to be false because otherwise we are injecting Frida into uncompressed
library and this wouldn't work.
So for now, we can simply ignore this.
If we talk about Frida and injecting Frida into a native library, then we will get back to this topic
and it has to be set to false.
Alrighty, perfect.
Let's move on.
Next, we've got this icon.
That's the app icon.
Not really important.
So maybe let's do it this way.
Not important for us.
Then we've got the Android label.
Also not important.
So therefore, let's get rid of this one.
And then we've got the Android network security config.
This one, this is really important for us.
We already know we are targeting Android version 11, which means we also need to meet all the requirements,
security requirements regarding to Android version 11.
And in this case, we have to include our network security config XML in our app.
What is this one doing?
It's regarding to certificate pinning in version seven.
There wasn't huge change regarding to certificate pinning.
So pinning it's not greater.
It's greater equal version seven, which means the applications are not trusting the user storage of
our smartphone anymore.
If you want to trust them, we have to include this in a network security config.
Also, if we are having own certificates and stuff like this, so this file is pretty important when
we are dealing with certificate pinning.
So over there we are also having an extensive look into this file, how to use it and why we are using
it.
For now, the only thing we need to remember is if we are having this file, then we should definitely
check this out because there might be some some certificate pinning active in this application and these
are very useful information to bypass this.
Or if this file has not been included, we can define our own in this application and then we are able
to re-enable the the user storage of our smartphone.
So, yes, don't worry.
We will we will talk about this later on.
All right, then we've got an icon which is regarding to round.
Not really important.
It's the same icon, but just as an as in round logo.
And then we've got this one, which is regarding to the format right and left.
So if the application can handle this or it's not important and then the theme odds are not important.
So far, so good.
The most important things we are getting out of this one, we can also get rid of this one.
These are the most important information we can get out of this one.
So our application is debugger.
Then we can perform a backup and it has an custom network security config which can be used or can be
handy to bypass certificate pinning.
Last but not least, we've got extract native flips equals false.
But I mean to be honest, it's not that important.
If it's not being included, then we can simply add it and we are good to go.
All right.
So these are the three most important options.
Let's move on to make this video not unnecessarily long.
A little bit of cleanup first.
We are already reaching the last part.
I mean, we haven't talked about them in those components over here.
So these are the four key components of an Android application.
And we will talk about them in just a couple of videos extensively.
So these are very important and they also need to be defined in the Android manifest example.
So by looking into this file, we are already getting good understanding what this application has in
its background.
So even without installing or having a look into this one, we can see we are having activities.
For example, this one over here activity is some screen content, which means we have some or we have
two different screen layouts in our apps.
We've gotten profile screen.
So by here, for example, this could be in profile screen and we've got main activity with some intent
folder.
Intent folders are folders which are listening for certain intents in this case, those two are regarding
to pressing this icon on on the smartphone.
So if you press this icon, then the intent folder will be triggered and this smartphone screen, the
main activity will be started.
So this is our entry point.
Don't worry, we will have an extensive view into all of these components later on.
Okay.
So that's our our entry.
So based on this one, we know we've got two screens.
That's the first one and that's the second one.
And then we can see this one over here.
This one is in service and service is just in background task.
So in service is being used when we need to perform an in resource intensive task because this is not
allowed to be done on the UI thread, which means if our application gets blocked by a long task, it
will be terminated by the system.
This is something it should happen in the background.
So that's in service in a nutshell.
Okay, so here we have our service that's we do not know what the service is doing based on the name.
It's maybe regarding to better notification.
So it could access some data from an in weather database and fetching it back and provide us information
about the new better information or stuff like this.
We have to analyze this in the application, but we know there is some kind of background task running
in our app.
All right.
And then last but not least.
Oh, not last, but not least.
This one over here.
Oh.
Sorry.
I did ping it wrong.
And this one over here.
This is our.
Our Weather Service.
And this one and this color.
And this one is broadcast receiver and broadcast receiver.
Simply just an information for applications.
For example, let's say we are receiving an SMS, then we've got this notification, this audio notification,
and also this pop up on the screen that we have received new SMS and also applications will be informed
about this event that an SMS has been received right now.
So this is simply just in messaging system.
So let's also add this over here.
So let's say here we can see we are informing all those applications about in event broadcast receivers
are prime text services.
So we will also explore them quite heavily in this queue over here.
For now we, we only keep it in this way.
There is some broadcast event or receiver in our application.
All right.
Last but not least, we've got this content provider and the content provider is simply just in the
form of interacting or providing content.
Most of the time this is regarding to database accesses.
So our application might use a database where it store some information.
In this case, we can see it's also named this way user database.
User database.
Alright.
So our application might also have some database where it stores those user details.
Okay.
One last thing I want to mention over here is that this content provider has this path permission enabled
here and we can see this path permission is now just read permission user info and this one has been
defined over here.
So if someone else wants to read this database information, it has to request this permission.
This is regarding or this has been bound to the content provider over here.
So if an external application tries to read those data, it has to request this permission already.
Okay.
So first of all, don't worry if you couldn't follow along all the time activities, broadcast receiver,
services, content provider.
These are separate topics we will discuss in detail later on.
I just want to show you by analyzing this file how much information we get out of this.
I mean, let's summarize this really quick.
What we've got over here.
We've got Android security features till Android version 11 enabled.
All right.
And then we've got our unique identifier on this application, which we are analyzing right now, might
interact with context database.
It might interact or send data, and it can also access files on public available storage.
Alrighty then.
This one is also defining its own permission.
It's being able we can back up it.
And what was the third point over here?
Yes, it has some custom network security conflict, which means this one can be super handy if we if
we are dealing with certificate pinning.
So we will find a lot of useful information already inside there.
Then it has certain components, it has at least two screens and background task and form of service
and broadcast receiver, which is listening to certain events.
And it also has a database which can be accessed by external applications if they are requesting the
custom permissions.
All right.
This is a huge stuff just based on and single configuration file, isn't it?
Absolutely.
And this is why this configuration file is that important for us as application hackers and also my
first view into an application if I analyze one.
All right.
So all the things we have seen right now, everything we need during our course.
And to be honest, I guess these are also most of the stuff you will find in a configuration file like
this one over here.
Okay.
So this is everything for this video right now.
In case if you have certain questions, please drop a message under this video.
I'm glad to receive some feedback and otherwise.
I'm looking forward to see you in the next video.