In this video, I will show you how perpetrators inject payloads in legit applications, such as what's
up?
They do that.
And by using social engineering techniques, they get these apps up and running on end users smartphones.
Suppose now we are the bad people here.
I'm using a different or test box.
It's the parrot just for a change.
You can do the same thing in Cali, so users will usually go to these Web sites.
HBK Pure, a Mitra, et cetera, that you seen earlier in the course and they search for any application.
I will search for WhatsApp here and press the button.
Now go to the first result, WhatsApp Messenger and download the AP case.
So let's close that now.
I have already downloaded that and it's on the downloads.
So this is the WhatsApp, HBK, supposedly the legit one.
Now, I'll open that in terminal.
Where is it?
It's here.
So I'll open that and a terminal.
And as you can see, I can see the application now, I'll go to a super user.
By simply issuing one command, which is the MSF, Viña, then Dash X, you have to specify the name
of the application.
Then provide the P parameter for the payload, which is Android.
Metro operator, reverse TCAP.
Then you specify the local host.
I'll put just an IP now.
And the local port.
Again, any port for now.
And the output is for example hacked dort ap k.
Now MSF Venom will try to reverse engineer the application decoded.
You compile it, inject the payload, change the manifest file by putting in you dangerous what they
call and permissions and then it will compile the code again.
So we'll wait for that to finish.
It'll take like a couple of minutes.
As you can see, it's the compiling the payload, locating hook points and adding the permissions to
the Android manifesto.
Ximo file.
And this is the output here.
After that, the compilation and the insertion or the injection of the payload.
So I'll stop that.
I'll just show you.
I'll go to this directory here.
And a list.
So as you can see here, we have the original HBK, which is the WhatsApp and the payload APJ, we have
the original folder and the payload folder.
So let's see the difference between the original manifest.
So I'll just leave it here.
Android manifesto ximo to clarify my point.
I have placed both Android manifestoes ximo files side by side.
The logit one is on the right and the forged one is on the left.
If you look closely, you will see that the content is totally different here.
It's obviously generated by Metters point.
And if you look closely here and drill down, it looks like this is the legit one generated by WhatsApp.
So this is how the perpetrators in git applications.
They will compile the applications later on using the Android studio, for example, or even the API
key tool.
And in many cases, and then they upload these AP case files on many platforms that we have discussed
earlier in this course.