- Hello, and welcome to the new video of Android Security and
Exploitation by Pentetser Academy. I am Aditya and I am your course instructor for
this entire training series. So if you're watching the video, you can go
check out the certifications at securitytube-training.com. You can also
subscribe to the videos at PentesterAcademy.com. So in this
particular video, we are going to have a look at the Damn Insecure and Vulnerable
Application, also known as "DIVA." And we'll have a look at the hardcoding
issues, the second part. So, in the previous hardcoding issues, if you
remember, we had a look at the application source code and we were able to figure out
the vendor secret key, right? But if you look at the hardcoding issue in this case,
you will notice that the JNI is used to perform validation. And what I mean by
this is if you open up the source code, "jakhar/aseem/diva", and you go inside the
hardcode 2 activity, you notice that the djni.access is actually getting a text
from somewhere using the JNI and it is checking it whether it is valid or not,
right? Now, the way in which you can check it is by doing an "adb shell,"
going inside the application directory, and looking at the "lib" folder. If you
notice, we have a "libdivajni.so" over here. And all you need to do is pull out
that ".so" file and analyze it using "objdump" or "readelf" or any other
disassembler for that matter, right? So we just exit this and do an "adb pull,"
and the location I'll use is "/data/data /jakhar.aseem.diva/lib/libdivajni.so".
And now once I have the, this particular file, which is "libdivajni.so" I can go
ahead and analyze it. And one of the ways to analyze it is by simply running
strings on this particular ".so" files. So a lot of times the vendor or the
manufacturer of the application actually hardcode the keys inside the ".so" files,
so if you run a strings you'll be able to see all the different constants, or
strings, inside the ".so" file. So you see a lot of different sections, like the
data, the bss. And you also see some weird-looking characters, or strings, such
as this one, or the "dotdotdot" string, right? And this could possibly be the
secret key, right? Now, another way to check is whether the vender would have
declared this particular key inside the ".rodata" section. And the ".rodata"
section is simply a segment which stores the constant data in a binary, right? So
if you want to look deeper inside any binary, or any ".so" file for that matter,
you can check out the ELF structure at this particular URL. So once you go
to this URL, you'll be able to figure out the different sections that are there
in a binary and what does exactly ".rodata" means, right?
But for now, we'll simply use "objdump", along with showing the full content using
"-s" and printing out the section ".rodata" specified by "-j". So let's try
this out. So we'll use "objdump" in order to extract the ".rodata" section. So let's
go ahead and use it. Let's specifiy... And if you notice, it has printed out the
contents of the ".rodata" section. And in this case, it simply is this entire
string, right? So this might be one of the strings and this could be another string,
right? So let's go ahead and try this out on the Access Control Issues, and find the
Hardcoding Issues - Part 2. So let me just go ahead and copy this, and paste it. And
if you click on "Access" it says, "Access granted! See you on the other side." So
this was indeed the key which the hardcoding issues challenge was looking
for. Now, another way to get the same information is using the "readelf"
utility. So you can do a "readelf -x .rodata" and the "libdivajni.so" filename.
And it will print out the same ".rodata" section. And for futher information, you
can also look for the source code for this particular exercise which is in the
"diva-android/app/src/main/jni/". And if you look at "divajni.c", you can see that
vendor key is one of the constants that is defined and this is the value. And later
on, the vendor gives the key that it is comparing it against, right?
So this was the hardcoding issue part two, and this pretty much is everything about
"DIVA". Now there is another exercise which is "Part 13 Input Validation Issues
- Part 3". And I highly recommend you to go ahead and try it out as a challenge.
So you can check out the complete training at securitytube-traning.net and you can
check out the subscription videos and pentesteracademy.com. And feel free to
reach out to me at adi@attify.com or tweet it to me @adi1391. So hope you enjoyed the
video, and looking forward to seeing the other course videos.