- Hello, and welcome to the Android Security and Exploitation Training Course
by Pentester Academy. You can also check out the certifications at
securitytube-training.com. So in the previous video we had a look at how you
can use AndBug in order to analyze any applications and basically check out the
methods and the arguments that are going along. So in this particular video, we are
going to have a look at JDB or Java DeBugger and how we can use it in order to
analyze applications much more deeply, right? So one of the drawbacks of AndBug
is it does not allow you by default to set up break points and maybe change the
variables at that particular point of time, which is possible with JDB. So that
is one of the reasons you can use JDB for, maybe by--for setting up break points and
changing some of the variables and seeing how the application performs for that,
right. So one of the things you can start doing is you can figure out which all
applications are debuggable using Drozer. So you can simply do a run
“app.package.debuggable,” and it will show you a list of all the packages or
applications which have debug flag enabled. Alternatively, if the application
is not debuggable, you can reverse the application and add the particular
statement “android:debuggable=true, ” into the AndroidManifest.xml, which will simply
make the application debuggable and then you can use JDB for that, right. So JDB
simply relies on the Java DeBug by protocol, which AndBug also uses. And you
can check out the official documentation on the article website. And this is some
of the things from the actual website. So JDWP was introduced in JDK 1.4.2, and
it is mostly used to debug applications for java, which are running in the JVM,
but it also supports DVM or the Dalvik Virtual Machine. Right. So what we can do
is we can start off by finding out the process ID for a particular Android
application. So let me log in to Santoku and make sure that AndBug is not running.
Yeah, okay. So now let's do a adb shell PS and grep for insecure, so the process ID
is 1212. And once we have found out that, we need to forward the port. So we need to
do adb forward, tcp and give it a particular port, and then jdwp and put the
process ID of the application. So let's go ahead and do it. So adb forward, tcp lets
use the port 1337, and jdwp to be 1212, right? And once you have done the
forwarding, you can simply go ahead and attach local host 1337. Sorry. So let's...
Good. Yeah. So if you see something like this, this means that the JDB or the Java
DeBugger has successfully attached to your particular application. And here also you
can do a class list and get a list of all the classes, but in this case you won't be
able to parse it, just like you did in AndBug, but since we already know that
package name is com.android.insecurebank, and the class name is RestClient. So let's
go ahead and analyze the methods, which is com.android.insecurebank.RestClient.
Right? It gives you a list of all the methods. Now you might notice that it
gives some additional methods as well, which were not visible in AndBug, right?
So let's set a break point at this particular dotransfer.
It's client.dotransfer, and try to transfer some amount. And if you see that
in JDB the break point has been hit. Now here you can do a lot many different
things, so one of the things is you can check out all the local variables. You can
even change any of the local variables. For example, you can change the amount to
be something like 70,000. And you can basically resume it, so 70,000 will be
transferred. And you can verify it by doing a adb logcat, and then grepping for
1212. Right. So you see that amount transferred has been 70,000. Now there's
another transfer 60,000 which is the default amount which we put inside the
application. So this might be because this is not the actual thing which is actually
transferring the amount, or this is not the actual thing which is actually
printing out this log statement. So that you can figure out from the application
source code, right? And also, one of the other things you can do is basically call
a particular method just from the JDB, right? So for example, let's maybe make a
transfer again. The break point has been hit, and let's do eval dotransfer.
Position error. Maybe...okay, because the port was not correct, so it's 161.241. So
let's do a eval dotransfer. Place, we're putting in the IP and then the port, from
account, to account and the amount. Port, from account, to account, and the amount.
987. And this has simply happened, right? If we look over here, it says transfer
amount 987, from account, to account, and this one, right? So this is how you can
use JDB in order to debug applications, and also to call any arbitrary methods
from within the application. So that's all for this video, and you can play a lot
more with AndBug and JDB if you want, and you can do a lot more different things
with it. So I hope you liked the video, and if you have any feedback or queries,
feel free to reach out to me at adi@attify.com and you can also tweet to
me @adi1391.