- Hello all, and welcome to this new video of Android Security and
Exploitation, by PentesterAcademy. So, in this video, we are going to have a look at
a framework, called Androguard, which is one of the really handy frameworks for
analyzing applications. So, it's a reverse engineering and malware analysis
framework, which is, also, completely open-source. So, if you're planning to go
into scripting of malware analysis, or even just Android application security
analysis, by writing automated scripts, so this is something, which you'll be really
interested in. So, the framework is completely open-source and located at
github.com/androguard/androguard. It's really easy to start out with. I'll just
give you a sample. Androguard comes with a bunch different other tools, such as the
Androlyze, which is for analyzing an application. Androsim, for analyzing the
similarity between two different Android applications, which is, kind of, useful,
in malware analysis. Then you have the Andromercury, which is related to the
drozer framework, which was earlier known as Mercury. Androsign, Androdump,
Androdiff and a lot many others. So, we'll start off with Androlyze, which is the
part of Androguard framework, and we will start off with it. So, this entire
framework is written in iPython, and that is also one of the reasons, which...it's
really easy to use in all the scripting that you do. Right. So, once you have
launched Androguard, or, in fact, Androlyze, we'll go ahead and identify all
the activities, permissions, and services. So, we don't have to decompile the
application, and go through the entire AndroidManifest.xml, in order to identify
all this. So, once we load up Androlyze, we can simply do a myapp, or any variable
name, and load the APK with it. So, let's go here and do it. So, let's myapp =
APK('/home/adi/Downloads/training/ vulnapps/catch.apk'). You have myapp over
here, right? And that's, basically, a really good starting point. And now, if
you simply do myapp, then dot and just hit Tab, it will show you a bunch of options,
which you can play around with. You can get different files, you can get all the
activities, you can get the dex, package name, and so on. So, let's start off with
getting the activities. Get activities. So, it's as simple as this. It will show
you a list of all the activities. Similarly, for services, get services,
and, in this case, it just has three services. Let's try out with content
providers. Providers. And these are the two different content providers of Catch
application. You can also get the permissions for the application, model
permissions as user. Let's have a look at the permissions, as
well, myapp.get_permissions. These are all the permissions that the application is
using. Right. You can also do myapp.get_details of all
the permissions. So, it will show you a detail of all the permissions. So, for
example, the permission INTERNET is one of the permissions that comes in the
dangerous category, and the description is, "full internet access, " and it simply
allows an application to create network sockets. And so on, and so forth. So, this
is how you can use Androguard, and what you can do is, you can just write a Python
script, and play around with the application, basically, extracting the
application in full, finding a bunch of different vulnerabilities. I really
recommend you to do that, and, maybe, post it on GitHub, and share with the security,
or the PentesterAcademy community, so that others can also learn from your
experiences. Right. And, taken care of all the activities. So, this is permissions,
and also the providers. So, the android_manifest_xml gives you the
manifest in the XML format. Then you have the details_permissions, which we just
did. Then you can get the list of all the files, as well. So if you're, maybe,
analyzing a malware, you might be interested in what all files this
particular application has. So, if you'll do get_files, it'll give you a list of all
the files inside the application, without even you having to unzip it. Right. So,
the other things, that you can do is get the package name, and check whether it's a
valid apk or not. One of the other things, you can do, is, you can retrieve all the
classes from the application. Right. So, you just do a d, or any other
variable, and give it a dvm. DalvikVMFormat, and simply use the myapp,
which was the name of the variable, which we used earlier, and get_dex. From there,
you can, basically, get all the classes. So, let's try it out. So, you can simply
do a d = dvm. DalvikVMFormat/myapp.get_dex. I have d
with me. And now I can simply do for class in d.get_classes, and print out all
the class names. Print class.get_name. I hope it works. Invalid syntax, which is,
kind of, interesting. So, for class in d.get_classes, so I missed something over
here. Let's try it again. Classes. Print class.get_name. Let's see where we went
wrong. For class in d.get_classes print class.get_name. This should be working.
Print class.get_name Invalid syntax. Let's try it for t in
d.get_classes, print t.get_name. Right. So, class was already a part of it, so
that's why it didn't work. This is how you get a list of all the different classes,
in the particular application, which is really, really useful. So you can see that
there's a ClearNotes class, there's a MediaMover class and so on. Basically, you
can, also, go ahead and write a script to get all the methods. This is
something, which I recommend you to do, and, also, post it on GitHub, and share
with the community. So, that's all for this video. I would really recommend you
to play around with Androguard a lot, and experiment with all the different tools,
that are a part of Androguard framework. Thanks for watching this video, and if you
have any feedback or queries, feel free to reach out to me at adi@attify.com, and you
can also tweet to me @adi1391. Thank you.