- Hello and welcome to the Android Security and Exploitation training series
by Pentester Academy. My name is Aditya and I am your course instructor for this
training series. So, in this video we are going to have a look at one of the other
tools that is called Introspy. So, this is a tool which basically helps you with API
hooking and you can analyze what an application is doing and what all APIs are
dis-calling and the best part is everything is completely automated in case
of Introspy. So you simply select the APIs that you want to hook and analyze and it
will hook to those APIs and prepare a HTML report for you. So that is really, really
handy in any application which you are analyzing. So, Introspy comes with two
different applications that is the Introspy-core which basically consists of
core functionality and all the API hooking code. And the other application is
Introspy-Config which allows the user to select the applications they want to
analyze. Now this entire tool is written on top of mobile substrate which is a
framework written by Jay Freeman, also known as Saurik, who was the creator of
Cydia and all those other related tools. Now, Introspy, it is really easy to set up
hooks on interesting functions. So, let's start off with setting up Introspy for our
device. So, we actually need to install couple of different applications. So we'll
start out with Supersu and then we will move to Cydia Substrate and then the
Introspy-core and the Introspy-Config. So, in the VM you will have a
IntroSpy+CydiaAPK.zip. You can simply unzip it and if you look over here, you
have the Introspy-Analyzer-master, Introspy-Android-master,
com.saurik.substrate, and we need one more application that is the Supersu. Let me
also copy it. Training/eu.chainfire.supersu.apk. So, we
will start off by installing this. In my case, it might already be installed. No.
Let's go ahead and install it. So, this one hasn't installed properly. So, let me
just go ahead and set up the the Supersu so I can continue. I will go with the
normal mode. Allow. Uninstall the other Supersu application and that's basically
all of the Supersu installation. Right. So once we have installed a Supersu, the next
step is to install the Saurik Substrate, which is over here so adb install
com.saurik.substrate. This will install the Saurik Substrate. So all you need to
do is click on link substrate files and grant it the permissions of superuser.
Click, come back to the application, click it again and you will see that it has the
substrate files linked. So all you need to is restart system soft which will restart
the Android system and now this has been linked. Let's also confirm that Cydia
Substrate has been added to Supersu list and it has been added, so this means that
the installation is successful. And now let's go ahead and install the config and
core apks. So let's install this one first, copy, adb install, paste and let's
also install the config.apk. Right. So this will install both the applications.
Now you should note that Introspy-Android Core.apk does not create any icon on a
device. So it's simply a core application which is without an icon and what you will
see over here is the Introspy Config and this will basically have all the APIs
which you can hook to and all the applications which is currently installed,
right. So this is simply all the installation of Introspy and let's also
grant it superuser permission by selecting any application. And here you can select
the application which you want to analyze. So, let's say I want to analyze
InsecureBank, I can just check on it and I have these all API hooks already, so I can
now go ahead and use the application, InsecureBank. And in the background
Introspy will create all the reports for me which is simply wonderful. Log in,
let's perform something, transfer. Also, let's have a look at the logcat and it
says that one of the file is missing where it actually stores the raw history of all
the transactions. Let's also create that file. It's a adb shell touch and this
particular file. Now, let's do an ls of /mnt/sdcard. I have...let's go and do adb
shell, mnt/sdcard, Let's do a mkdir statements and cd statements, touch
rawhistory.html, right, let's try to transfer again...
So now the transfer is getting successful
without any error, also if you notice in the logcat, now you will have a lot of
Cydia Substrate, excuse me, which is basically the Introspy hooks which you
have configured, right. So depending on what the application does, the Introspy
will create a Introspy.db in the application folder. So, let's go ahead and
analyze it. So, adb shell. Let's go inside the application that we are analyzing,
which is com.android.insecurebank. Now, Introspy sometimes might not create the
database. In that case, you simply need to restart Genymotion. So let's see if it's
able to create. It hasn't created anything so far. So let's simply restart the
Genymotion, and see if it works. Nexus S 4.1.1...
Check the IP 102. Devices, connect
192.168.57.102. Connected. Simply let's wait for the device to come up.
Now let's try it again. So then just by,
configs setup. Let's go ahead and use the InsecureBank. Dinesh, Dinesh@123$. Login.
Any transaction. Transfer. Let's shell
ls/data/data/com.android.insecurebank/ databases/. And now if you see there is a
intropsy.db created over here, right. So let's simply go ahead and pull this
database out and make a HTML report out of it. Now this database might not consist a
lot of information because, just because simply this application isn't doing a lot
many things, right. So let's go to the Introspy-analyzer-master and pull this
database /data/data/com.android. insecurebank/databases/introspy.db
and maybe store it as Insecure.db, right. So if you look over here, there is a
Introspy or insecure.db. So let's create an HTML report out of it. So python
introspy.py, -p for platform which is Android in this case, -o for the output
folder name, let's do it InsecureBank and then simply the name of the db which we
are analyzing. So if you look over here, you can go to InsecureBank and here you'll
have the report.html, right. So the report.html simply is a html file which
shows you what all things have been done and if you'll look over here, so it will
show you all the file system changes as we are hooked into the file system as well
and what all preferences it took and all this sort of things, right. So Introspy is
a really nice tool which helps you analyze all the different things that an
application is doing and if you perform it on a real world application you'll get a
lot of information about the application over here which might also reveal a lot
many different vulnerabilities, right. So this is why Introspy is like one of the
handy tools for a Pentester to start off with assessment. So that's all for this
video and in the next videos, we will move on to some other tools and techniques for
hooking and we will look into them. So I hope you liked the video and if you have
any feedback or queries, feel free to reach out to me at adi@attify.com and you
can also tweet me @adi1391. Thank you.