- Hello, and welcome to the Android Security and Exploitation training video
series by Pentester Academy. My name is Aditya and in this particular video, we
are having a look at Damn Insecure and Vulnerable Application. Currently we are
at the Challenge 3 which is insecure data storage, the first part. Now this is a lot
similar to something which you have already learned in the Video 8 of
Android Security for Pentesters course by SecurityTube-Training. Right. So if we
have a look at the application, the insecure data storage part one, it tells
us to find out where the credentials are being stored and the venerable code. And
it simply asks to enter the third party service user name and the password. So,
let's try to enter something over here-- just simply write attify and
securitytubetraining. And go ahead and save it. Now there are a couple of places
where an application can store the data, and one of them being shared-preferences.
Now even though shared-preferences are not recommended to be used for sensitive
information, a lot of developers end up using...storing any kind of sensitive
information in the shared-preferences. And if you're already familiar with adb or the
Android Debug Bridge, you can find out the shared-preferences at this location which
is /data/data/[packagename]/shared_prefs. So let's go ahead and maybe first have a
look at the file responsible for storing the data. So I guess this should be the
InsecureDataStorage1. So let's look at it, and if you look here in the
saveCedentials code block, it simply uses the preference manager and
getDefaultSharedPreferences and stores the username and password and prints out that
"third party credentials have been saved successfully." So this is an indication
that shared preferences are being used to store the data. Now let's go ahead and
analyze the file system and look at it's shared-preferences. So we'll do a adb
shell and go to /data/data/jakhar.aseem.diva and go to the
shared_prefs. And if you look over here there is a preferences.xml which is stored
over here. And if you simply cat this file, you will see that the username and
password which is attify and securitytubetraining, which is the exact
same thing which we saved over here. So this is how an application stores data in
the shared preferences and this is how you can access it. So that is all for this
short video and in the upcoming videos we will have a look at the other ways of
insecure data storage and so on. So thanks for watching the video and if you have any
feedback or queries, feel free to reach out to me on Twitter, which is @adi1391.
Or you can send me email at adi@attify.com. Thank you.