I thought it's a funnel kind of video. I could walk you through a
general process of trying to do some bug
hunting in Android to show. How I
would generally go about looking into an application. If
I were doing some research into one of the
very first thing is before I T compile an APK. I'm going
to install grocer and I'm going to try the following thinks I'm going
to run the attack surface command against the
application, to see what different attacks Services exist.
If I see that their activities that are exported and
that there scanners that are exported rather. I'm content
providers that are exported. I'm going to try to start every
activity to see what that gives me. If
that gives me something that looks to
be vulnerable or looks to be a problem. Then
I've already found some problems, right? And then I'm
going to run this injection command to see if any SQL
injections exist if they do exist, then we've
already found a problem, right?
These are some very good low-hanging fruits that
we can try to pick off when they're available, right from
this. We can also try decompiling, the
APK and there were few things that you should generally be
looking for, when you compile an APK. There's actually
one other thing that I'm going to adhere to the end so that we can
remember to discuss it, which would be load
URL.
But starting with these ones execute SQL,
write query Rock query. Least
three functions are always tipu
going to be used to execute SQL. We should always look
at them with great scrutiny to determine if they're using
parameterize queries, or if they're doing something unsafe. If
we see something unsafe that we can potentially reach with,
use your input. This gives us a place to potentially try
to attack. So these are really great to try
to search for in general most applications going
to have some form of database query. If you can find the
database queries, we could potentially do something here, which is
important to be able to determine an application. The
next thing is going to look for a log. Something. So
it's usually log. D log. If
you just type in the log. You'll be able to find anything that has
log being extended with some form of
method, right?
These are really important because they can tell us what sort of information is
being blocked by the application. This will be able to let
us like easily pick off any sort of ladybug, messages are
error messages that could expose something sensitive. We just
need to determine how to get down that branch of code, and then we'll
be able to expose those log values easily. The next
thing is going to be the search for password in general. Most people are in
a hard card passwords, but just in case of the password, could
be a good thing to search. For if you see password equals something in, plain text
to then you've obviously found some sort of problems. So that's always
a good one to search for shared preferences is
a really good thing to look for. This will be any, the shirt preference is
files. If you're ready to start preferences, odds are that dude is
not going to be secure. If you can see, what kind of data is being written and
we see that it's something that should be treated with security. Check
references is going to be a good week, too.
Democratic file is being created in the temp file
that again, has some sort of data and it that's supposed to
be secure. Then we could potentially expose that,
right? So, this is a good thing to look for, as well. To see,
what kind of data gets written to Temp files. Exact is a
general sort of command that's used by Java to execute command
line. Type argument is a few different
ones that exist somebody specifically for Android
as well. If you ever see command line
being run with a user input, you might be able to
hit command injection, which is a very severe pain or
ability. So, I typically look for these and look for
your input is being allowed in them. If that
ever happens. We want to try to test that to see if we can do some
sort of command injection on it right now, in a course to
load URL, because we've learned, we can load URL. So we
can load files through the load URL function. So am
I ever get the opportunity to get data into load
URL, we might be able to load a specific file utilizing that.
So this is something to always look out for us.
So in general or do these videos, you should have
a pretty good understanding of how to hunt for vulnerabilities in Android
and how to be able to expose those vulnerabilities through
decompiling as well as utilizing tools. Like
grocer up a general. This should give you a little bit
of an overview towards the general flow of what we
typically look for in vulnerabilities and like how we
typically go about looking for the how someone like me would go
about looking for a vulnerability if I'm searching for what? So
this should give you some good information to
be able to get up there and start bug hunting, and Android. Whether it
be your own applications or looking for bug bounties
or testing other people's applications. This will
give you a good solid foundations to be able to try out some
vulnerability. Send learn all sorts of new stuff with
this using a sort of like a good foundation.