- Hello all and welcome to the new video of Android Security and Exploitation by
Pentester Academy. My name is Aditya and I'm your course instructor for this entire
training series. So in this particular video we are going to have a look at
Android Hooking and basically we'll get started with Android Hooking as the next
couple of videos will be simply telling about different ways of API Hooking and
what all you can achieve with Android API Hooking. So Android Hooking is typically
essential when you want to analyze an application on the go. So, for example,
let's say you want to analyze an application which is calling some methods
and you want to know what those methods are or you want to know what kind of
arguments are being parsed to that particular method. And also, when the
application might be using some custom protocol for communication and not the
typical HTTP or HTTPS which you can simply analyze using the proxy tool. Right. Or
the application might also be using a kind of cryptographic algorithm which is custom
developed. So you want to know what kind of algorithm it is using, it might also be
leaking the key in maybe one of its arguments, or you can basically find a lot
more information about it. Right. So what do you do in that particular scenario? So
the answer is you can create an API hook and tell the name of the methods or tell
the name of the API calls which you want to hook into and analyze the application
like that. So there are a couple of tools which you can use for API hooking or
simply Android hooking or debugging. And some of the tools are JDB,
which is the Java Debugger, which actually comes along with the Java
installation. And then the other tools are Andbug, which is a nother really nice tool
written on top of JDB. And then you have the Cydia Substrate which is also for iOS,
as well as Android. And then you have Introspy and Xposed Framework. Right. So
we'll be going through each of them one by one in one of the subsequent videos and
the application we'll be taking for example for this entire exercise is the
InsecureBank. So InsecureBank is a wonderful Android application written by
an Android security researcher called Dinesh Shetty. It uses a client-server
architecture so the application communicates with the server running on
your system in order to basically lock in as it has performed some transactions as
it's a vulnerable banking application. Right. So I'll quickly guide you through
how to set up the InsecureBank application. So if you go to your VM
inside the debug folder you'll have the My-Insecure-Bank.zip, so you can simply
unzip it and you go inside the InsecureBank, the extracted one. There
will be an AndroLabServer which is the server component, and the InsecureBank
which contains the source code as well as the APK of the application. Right? So
let's first of all go ahead and install the APK. We'll go inside the bin and here
you have the InsecureBank.apk. Let's do adb install InsecureBank. APK, right? And
if you look in Genymotion, you'll have the InsecureBank over here. Right.
The next thing that you need to do is go inside the Android lab server,
and launch the server which is the app.py, and simply do app.py and restart the web
server, right? So let me also figure out my IP, so that I can put inside the
application. So it's 192.168.161.241. Simply change this 161.241. And also
change the server port to 8080. And now I can basically log in to the
application...dinesh, dinesh@123$. So now I'm able to log inside the application and
I can basically do any transaction I want. So I can transfer from the account 333 to
1234 and the amount is maybe $50,000. So this transaction happened. Right. Also
you'll see all the transactions happening in the logcat. So if you look inside the
logcat, let's just grep it for this particular application shell ps grep
insecure, logcat, grep the process ID. So if you look over here it says the transfer
amount is $50,000 from account 333 to 1234, right? So anything you do in the
application will be basically visible over here. So you can do it again. And if you
look over here it transferred the money. So this is how you set up the InsecureBank
application and the server component, right?
So in the next videos we'll start using the debug tools for Android such as JDB
and Andbug. We'll carry on forward with the other Android Hooking tools. Thanks
for watching the video. If you have any feedback or queries feel free to email me
at adi@attify.com or you can tweet me @adi1391. Thanks a lot.