- Hello all and welcome to the Android Security and Exploitation by Pentester
Academy. My name is Aditya and I'm your course instructor for this entire training
series. So this course is available on PentesterAcademy.com and you can
also check out the certifications at securitytube-training.com. So in
the last video, we actually got InsecureBank up and running where we were
able to do transaction from one account to the other account and we were basically
able to see it in the login screens as well. So in this video we are going to
have a look at one of the tools which is called AndBug and is used for Android
application debugging and basically allows you to see what is going inside the
application, which particular methods are being called with what particular
arguments and all these kind of things. So AndBug is simply a wrap around JDWP
which is the Java Debug Wire Protocol and compared to the other debugger which is
the Java Debugger or JDB, it's much more interactive and gives you a lot more
flexibility over it. So using Andbug, you can basically analyze what are the
different classes and methods which look interesting to you and which might be a
thing for further introspection and once you have identified that you can go inside
JDB and basically set break points and all of that. So you can download AndBug from
this GitHub link. Also it's available in the VM which is provided along with this
course. So the goal for this particular video is to find out the method
responsible for the transaction. Once you have identified the method responsible for
transaction, we'll go ahead and and trace the method. So let's start up AndBug. We
have the InsecureBank up and running. Let's unzip the AndBug master. You can
simply install it by doing a python setup.py install. So this will install the
AndBug. Now you have the AndBug. So you can get inside a AndBug shell by providing
in the process id of the application you want to debug. Let's do a adb shell ps and
grep for insecure. So we got the process id which is 1212. We can do andbug shell-p
1212. Now we are inside the AndBug shell and everything worked fine so far so
let's go ahead and do a classes which will give us a list of all the currently loaded
classes. As you can see over here there're a lot of classes. Basically anything that
you import in one of your javaclass, we'll be able to see it over here. So if you
have to import the HTTP package or activity package, you'll see all of that
over here which is not that interesting to us. So what is interesting to us is the
classes which is responsible for the application. So we can do a classes and
basically grep for com.android.insecurebank. Now we have
these different classes which is for the Insecure Bank. Now we are interested in
the transfer funds, like how the transaction actually happens. So we can
maybe look inside the Transfer class or we can either look inside the RestClient.
Let's have a look at the methods inside that RestClient class. You can simply type
methods, basically paste it and this will give you all the methods inside this
particular class. If you look over here there's a RestClient init method, do log
in, do transfer which is something useful for us. GetHttpContent, parseError, post
HttpContent, and sidechannel. We are interested in the dotransfer method over
here. You can simply now do a method trace and copy and paste this. It will set up a
hook at this particular method. Now whenever this dotransfer method gets
called, it will show up all the parameters or the arguments that it is being called
with in the AndBug screen. Let's try it out. So from account, let's say 9876 to
account 4444, amount let's make it $60,000 dollars. And if you click on transfer, you
basically see the entire thing that's happening over here. You can see that some
of the arguments that are being parsed are from account and then the server, the
port, the to Account and the amount. This is how you analyze any particular method
using AndBug. So in the next video, we'll have a look at how you can use this
information along with JDB and set break points and maybe even call arbitrary
methods which you want. So that's all for this video. I hope you like the video. If
you have any feedback or comments, feel free to send it out to me and you can also
tweet it @adi1391. Thank you