Welcome back to the last part of this video right now.
And this is regarding to those logging credentials.
I mean, we have already figured out that things like Dinesh and Check might not be stored in this mobile
application because they are they are being used on the online side.
Therefore, we do not have access to them.
But nevertheless, I have often encountered some service accounts, operator accounts, which has some
hardcoded credentials in the application, and they can be also used to interact with the web app or
to yeah.
To manage certain things on this, on this application over here.
Okay.
But before we going hunting for them, let's have a look into the shared preferences file and the encrypted
credentials we have already seen in some code snippets over here.
Because even if this is not in finding, you will encounter this quite often and it's nice to have in
general approach on how to deal with things like this.
So therefore let's, let's have a look.
Okay, so let's open this application and we are locked in with the user check and the password hacked
at 1 to $3 I guess.
Okay.
So we have seen this information might be stored in the shared preferences and we can get access to
those shared preferences if we're having root privileges.
So if we're getting real privileges, we can see the device is not routed.
So this routing detection is really not that good.
Okay.
That's good for us as an attacker.
So let's see, those chat preferences are stored in an protected directory.
So the sandbox directory, we have talked about this in the application structure.
So within data data com android oops insecure bank.
Let's see.
Yes, here we have a lot of stuff.
Databases, let's see.
Do we have additional databases.
No, I guess that's the only one which which we have already seen in the content provider path.
But now we're having the shared preferences.
Oops, share press.
Oh, we are still in the wrong.
I am still in the wrong directory.
There we have it.
Shared press.
Okay, let's clear this and then let's have a look.
So now we've got my chat preferences, we've got insecure bank reference, shared preferences, and
we've got this webview chromium prefix AMA.
So if you go back into this one, we have seen our first interaction with those shared preferences in
the logging activity and here we can see it's the file, my shared preferences.
This one is being used over here in the spring and this spring.
Let's search for this one.
It's not being used.
Let's see.
Okay.
So this one is not being used, which is interesting.
At least not here and here.
We can see here we're having my share preferences.
So the same string.
Yes.
Okay.
Maybe it's just a compilation mistake that this string is normally being replaced with this variable
or the original code may be really does not have a reference to string underneath because they are identical.
Yes.
These are identical.
Maybe.
And the compilation error.
Okay.
But here we can see we are having this shared preferences file and then we are getting those encrypted
username and super secure password out of this file, which means this file should contain these two
strings, encrypted username and super secure password, right?
Absolutely.
Let's see my shared preferences example.
And there we go.
Super secure password and encrypted username.
And we can see there's a little bit of of mix up over here and also over here.
But here we have now the those values we can see those equals sign at the end and that's a good indicator
to be base64 encoded.
So we will encounter by base64 encoding quite a lot during this course and I will also keep explaining
it more than once.
The reason for this is you can skip certain videos and then it's good to have those information.
Okay.
Now the question, how can we decrypt this password, this one over here?
Because we want to have the plaintext value behind this, even if this wouldn't be in finding, because
it's within a secure environment and you need root privileges to read this out.
So that's that's not a big deal.
But let's say we want to understand how this is being decrypted because then we can encrypt our own
password and insert it over here and we can simply overwrite the log in process with our password.
So this would be also pretty nice to do.
So we have to figure out what encryption is being used, so we have to go down the rabbit hole.
So let's see, this password is being used over here.
So it's being stored and password.
Okay, then we've got.
If the password is not equal now that's good.
Then we are now in this part here we have the username.
It's not encrypted, it's just base64 encoded and the password appears over here.
But that's not the password variable.
The password is only being used in this field over here.
And this line.
And here we can see we are setting the text to crypto class as decrypt string and then the password.
So it seems like we're having an ace decrypted string function over here.
But we do not know this.
The developer can choose on whatever he likes.
We have to figure out if it's really a decryption.
Okay.
So let's dive into this one, as is a very common encryption algorithm and I will provide you in bonus
video where I go through all these important things you need to know about us.
So in case if you're not familiar with as have a look into this bonus video and then you might want
to come back to this one over here.
All righty.
Okay, back to this one.
So let's see if it's really as we are using this decrypted string function.
So we have to take a look into this one.
Okay.
So here we are calling as 256 decrypt, we are having an initialization vector, maybe we're having
some keys and our base64 decoded string.
Let's see where this function is.
This function is over here.
Okay, so now let's see.
Yes.
Now we can be sure that we are definitely using an as crypto function y because here we can see we are
using cipher cipher at instance s and we can see the cipher is not an own cipher class.
The cipher is being used from Java X crypto cipher.
So that's that's a generic cipher class from, from the Android system over here.
This means we are using the method get instance.
And if you are providing this parameter, we are using as in cipher blockchain in mode with an padding.
Okay.
So now we know we are using as CBC, which means we are having a key and we are also having an initialization
vector.
I will explain this in detail in the bonus video because I do not want to stretch this unnecessarily
long right now.
Okay, let's have a look.
Where are those keys and where are those initialization vectors?
So we have within this this decrypt string function and let's see, we are providing we are calling
this function and we are providing the following parameters.
This initialization vector get bytes and also this one over here, this key.
And then we are providing our let's see, this is our base64 encoded string.
Okay.
Nice.
This means.
Let's have a look.
This is decrypt function is using initialization vector bytes as the first parameter and key.
Sorry.
Let's let's do not mess those colors up.
Key as a second parameter.
And this is our text bytes as the as the third parameter.
So this is our text.
This might be the key.
Oops, key.
And this one over here is our initialization vector to be 100% sure we need to track these variables
because the developer can also name them differently to do some obscurity.
So security by obscurity.
Okay.
So here we can see these bytes are being used in algorithm parameters back IB spec.
So here we can see if we look up this function, this is getting the, the initialization vector out
of these bytes.
All right.
Now we know this is definitely our initialization vector.
This part over here.
Okay, then let's see.
Key.
Yes, here we are having secret key spec and this secret key spec is returning the secret key.
Oops, wrong color as byte array into this one.
So this is our key.
And last but not least, we've got this text bytes cipher to final.
Yes, that's the parameter where our crypto functionality loops crypto functionality takes place.
So this is our string, our base64 encoded.
So this one over here is our string, this one over here which has been fetched from the shared preferences,
it's being inserted in by an invite array.
So we are inserting those raw bytes into this function over here.
We have now everything together and the easiest way to do an A is decrypt method right now is simply
using cyber chef.
Cyber Chef.
It's an amazing, amazing tool to perform all these kind of tasks.
And there's an online version, but also an offline version if you do not want to have to decrypt your
secrets online, which is something I cannot recommend right now.
So we take the offline version, okay?
To get the offline version, we simply have to go to the Cyber Chef page in this one over here.
And then let's see, we can simply download it over here.
So then we are having the web application running on our local system and we can interact these same,
but then we are not giving away those information.
All right.
Okay.
So thanks for having also the opportunity to make this as easy as possible to do this locally.
Really?
Thank you.
The whole cyber chef crew.
Okay.
So let's see.
Within downloads we've got now, I've downloaded twice.
We simply extract this directory.
That was not good.
Oh, I hate when things like this happen.
Let's get rid of this one.
Okay, SLI.
Let's do it this way.
Okay, then let's take it into our tools.
Okay.
And now let's extract it over here.
Yes, of course.
Now it's it's doing it this way.
Yes, I know.
I have hit the wrong button before, but, yeah, that's that's how it goes.
All right, now we can simply use our status HTML file, and the whole stuff is happening in the background
via JavaScript so we can use this offline.
That's absolutely no problem.
All right, so now let's do this, because that's that's pretty amazing how fast this goes.
The first thing we need to do is we need to get those shared preferences string the base64 encoded string,
this one over here.
But without this any percent.
Okay.
Yes, that's the password.
Okay.
Now we're having the the input as an basically for string defined.
The first thing we want to do, we want to decode it because then we're having the raw bytes and we
can use those blocks on the left to simply drag and drop this in.
So we say this one here is our input and here we have now the output.
And by dropping in the block from page 64, we can see it's now being decoded.
So that's the representation of this string over here.
That's the base, 64 decoded string.
And here we can see we have those thoughts where we do not know the real value behind this because this
is binary data and cannot be represented in this text form.
This is why we have base64 encoded it, but our decrypt function works with raw bytes.
Therefore we need to decode it first.
Okay.
Then we're using as decrypt.
And now we have to take care about a few things.
Our input is not hexed.
Our input is now raw.
So we are now taking the base64 encoded string.
We are decoding it and we are feeding it into the next block, into this one here.
So our input is raw bytes.
We have seen this before over here.
I also disable the auto function because then we are not getting 1000 errors that could not decode the
string with these parameters right now.
Okay.
Now, I mean, if you want to stay to Hex, then you could also use what we have it or we have to repeat
it real quick.
You could also do it in this way, of course.
CM RN OC
64 HD and then 60 HP.
You could also insert on those hex values and then you could switch it to hex.
But basically, if was way easier, we do not have to convert anything first.
All right.
Now we need to insert the key.
The key?
We have already seen the key as this one, this IV bytes.
Sorry, this one.
This key.
This one over here.
And we can see this key is being referenced over here.
This is the super secret key.
So this is our key.
One, two, three.
Let's insert it here.
And now the key is not in hex format.
The key is UTF eight.
So that's the basic string over here.
Now we need to insert the initialization vector.
So what's the initialization vector?
This one over here.
So it's simply just 16 times.
Yes.
One thing we need to mention, this one is not in string.
This is now, by the way.
So we should also keep those those types in mind.
This means I'm not sure.
No, it wouldn't work if you provide those 16 zeros as a string because in string zero and then spring
is in different value than an zero in binary.
So therefore we apply these as hex values.
And this is this can be also easily done here.
We already have defined it to hex values and now inserting one zero requires two zeros in hex.
So this is one zero in hex.
We can also see maybe enable this real quick invalid key length.
Oh, that's interesting.
Why is it invalid?
Yes.
So there was an error regarding to the key length, but the key length was probably fine.
So by inserting one and removing it, we, we get the update that it's now correct.
Maybe because I have disabled the outback feature first.
Okay.
So now we can see invalid length, got one byte.
So here we can also see this one over here, two zeros is simply just one byte.
So one zero and we need to apply 16 of them.
So let's copy this.
One, two, three, four, five, six.
I mean, we can also look at here until it matches and suddenly our text appears.
That's all we need to do.
Amazing, right?
The whole crypto stuff has been already implemented and we simply reuse those functions in case if we're
not having CBC mode, we can also play around with these modes.
ECB, for example, doesn't make a difference.
Ctrl might.
Yes, and CTRL is the counter mode.
So this is a complete different aggregate.
Most amazing.
So now we also got this password over here.
Okay, cool.
This is how we can decrypt as encrypted share preferences while in under 2 minutes.
The only thing we have to track down are those parameters.
But I mean, if they are using those cryptographic functionalities, which every developer does, of
course, because you do not have to reinvent those fields, you can simply take those key words cipher
in it to final things like this secret key spec.
What else do we have?
Cipher Forget instance.
So if you're looking for those keywords in an application, then you easily identify all those as encryption
decryption stuff.
Alrighty.
Okay.
Perfect.
Last but not least, let's have a look or let's go for hand on hardcoded user credentials.
So we have to wait until the application has been compiled over here.
Okay.
And what I will do right now is I would go down the rabbit hole regarding to all this lock in functionalities,
because if you haven't successful looking, there need to be this comparison against the hardcoded credential.
But we can also do it more easily, for example, with the user.
And here we can see we want to skip everything which is Android support before.
And that's all.
Case insensitive.
Yes.
This is what we want to have.
Oh, oh, yes.
We can see we've got a lot of pages over here.
So.
Yes.
This is maybe that's not a good option, but nevertheless, we see it over here.
Oh, that's interesting.
The username, username, username and he can see username equals def admin.
All right, encrypted username.
So we have to go down all those things.
Sometimes they also do not of course, compared with things like user or password because they want
to hide their tracks.
Then I guess the best option is tracking down those locking functionalities because there needs to be
in comparison with those credentials and they need to be in decision if these are correct or not.
In this case right now we have identified this def admin.
And we can see post data.
So we are connecting or we are contacting our our web server at logging and def looking.
So we're having to log ins.
Also interesting, by the way, this web server is running on on this interface, which means if we
go on
17717200 and then pop out 80, we can see the Web servers also running on our local host.
So this means if we go back, then we've got do logging the server port slash login.
Here we can see method is not allowed because we're making and get requests, but we need to have an
post request.
So the thing that happens in the background, the mobile application is connecting to this web server
over here and performs these tasks, which means this web server is of course publicly available.
I mean this hopefully not, but if you have a real world mobile application, this web server is publicly
available, then you can also, of course fetch those network traffic and interact directly with the
web application without having the mobile app.
As already mentioned, we will do this in demand in the middle part.
Okay, so let's go back now.
We've gotten another app point dev def login.
This is something we should take a look into.
OC method orders are not allowed, so we need to provide post parameter.
Let's see what's being sent.
This one is http post to.
To lock in and if the user name is equals def admin.
For entity, then we perform our login.
So there's no password inside here right now.
Yes.
So I cannot identify any password for this user right now.
So can we simply log in with username def admin?
Let's find this out.
So let's open this one over here.
Let's reset it.
Okay.
Death.
Amen.
Let's see.
I'm not providing any passport and.
Nice.
We are locked in.
So these are this is a perfect example for hardcoded credentials that the developer might have used
it for development and has forgotten to exclude them from the mobile application and also from the web
server part.
To be honest, I have encountered this three or four times within my last eight or nine years of mobile
experience.
So this doesn't happen often anymore.
It depends on the type of application, I guess, but this is definitely something you should check
out.
If this works out, I mean, you got the you got the pony under the Christmas tree.
You got directly access to to some developer functions or things like this.
Okay.
One last thing I would like to try out right now is if we restart because this user might be admin.
And within the activities we have seen, there was something really strange and we've got this button
which might be visible depending if you are admin or not.
And this is something I would like to try out real quick.
So if you hit out of your credentials.
Yes, the deaf atman appears, but there's no there's no create user button.
Nevertheless, the user button has no the create user button has no functionality and it wouldn't work
anyway.
But I would like to try it out over here.
Okay.
So that's all for this challenge right now.
I mean, there's a ton of other stuff which is included in there and there might be additional vulnerabilities
in case if you have question to any of them, then please drop a message into the comment section over
here and then yeah, I will get through this and answer them.
Alrighty.
Okay.
So this challenge was absolutely perfect to recap everything we have learned so far.
And if you recap what we have learned, I mean, this is already amazing, right?
We can handle activities, content providers, broadcast receivers.
We've got knowledge about cryptography already.
We did identify in hardcoded credentials and even more.
But don't worry, we are not even being close to our final form.
So we've got tons of other stuff which we go through during this course.
Over here there are some two really huge chapters which is Smiley and Freedom.
With a smiley you will become an absolutely Android ninja and free to it's the it's the bad boy on top
of it.
So if you go through this course together with me the whole course, then after absorbing this course,
you will be definitely within the top five of your of your company.
Regarding to Android application pen testing, I'm pretty sure about this one.
Regarding to mobile penetration testing, smiley is an ability that not many people have out there.
So reading and writing Smiley is it's not very common.
And within the next chapter you will see what we can do with Smiley.
So Smiley gives us unlimited power in hacking mobile applications.
Even if there are some really hardcore rooting detections, we do not care about them.
So with Smiley, we can do whatever we want and there are not many things that can stop us right now.
All righty.
Okay.
So therefore, I'm really looking forward to see you in the next chapter because this chapter has been
mentioned to reading and writing.
SMILEY So we will learn.
Smiley in the next couple of, I guess, 45 videos.
Alrighty.
I'm looking forward to see you there.