‫Instructor: Hi.
‫Now, within this lecture,
‫we're going to use ApkTool
‫in order to start our reverse engineering process.
‫And also, I'm going to create an APK
‫in order to make things realistic.
‫So we're not going to look into source code anymore, okay?
‫Otherwise, it would be cheating.
‫Now, I'm not gonna do that.
‫I'm going to create an APK,
‫and I'm going to run ApkTool on that.
‫So you know how to do these things, right?
‫And I'm going to enable ProGuard as well.
‫So I suggest you pause the video,
‫enable the ProGuard, generate an APK,
‫and then try to debug it,
‫decompile it, actually, using ApkTool on your own.
‫Just go for it.
‫I hope you managed to do it.
‫If you couldn't do it for some reason,
‫or if you skipped the previous lectures,
‫it doesn't matter, I'm just going to show you how.
‫But if you have skipped
‫the Android reverse engineering section,
‫then you wouldn't understand what we are doing right now.
‫So please go back and watch it.
‫So I'm going to start with enabling this minify thing
‫in the Release section.
‫So remember, this enables the ProGuard usage,
‫and it actually shrinks down our APK,
‫and it also does some obfuscation
‫in order to encode the code itself, okay?
‫So I'm going to make this true to be realistic.
‫Most of the time, developers won't skip this step,
‫at least, for some security reasons,
‫but I have seen a lot of live applications
‫that have skipped the configuration of the Firestore,
‫or real-time database in the Firebase.
‫So we are going to copy this release
‫and paste it below, like this,
‫and change it to debug like we have done before, okay?
‫And make sure you stay in the curly braces in buildTypes.
‫So not only release, but debug as well, like this.
‫And we don't have to do that.
‫We're going to work with ReleaseAPK anyhow,
‫but since it's good to have two APKs
‫for some reason if you want to do some additional tests,
‫I'm going to enable the debug version as well.
‫So I'm going to say Sync now,
‫and here, we are ready.
‫So let me come over here and say Build Bundles and APKs.
‫Of course, you can go for Signed Bundle and APKs as well
‫and just generate a signed APK.
‫Since we are doing only tests over here
‫and since we know how to manually sign it as well,
‫I'm gonna go for Generate APKs.
‫So it will generate an APK for us,
‫and it will show us the output directory.
‫So once we do that,
‫it will take a while, like a couple of minutes,
‫because now it's actually a big project
‫because we have the Firebase modules over here as well.
‫Now, if you see this, you can hit on Locate,
‫or just open the Android Studio project like this.
‫And as you can see, it's opened over here,
‫SecureTweetApp.
‫So I'm in the app folder, build folder, output, APK,
‫debug, and here you go.
‫Here, we see the debug.
‫So again, build, outputs, APK, debug, and app-debug.APK.
‫So of course, as I've said before,
‫you can create your signed APK
‫and go with the release version as well,
‫but it doesn't make some difference over here.
‫Since we are doing this for a test,
‫I'm gonna go for this.
‫And then we're going to actually manipulate it.
‫And in order to run this,
‫we're going to sign it later on manually,
‫like we have done before.
‫So this is good.
‫Now when you see this,
‫then you are done with the Android Studio.
‫Now you have the APK.
‫Just imagine that you found an application
‫and you try to see if it works with Firebase,
‫and then you're going to do
‫what we are about to do over here.
‫So let me close this down,
‫let me close this down, and this one as well.
‫And I believe we have to just close this down from here.
‫Let me save this and close this down, okay?
‫And in fact, I'm going to shut down the emulator as well
‫since we are going to shut down the SecureTweet.
‫We're going to delete this, right?
‫We don't need this anymore.
‫So let me come over here
‫and find the SecureTweet application, like this.
‫Let me just uninstall this one.
‫And here you go, SecureTweetApp.
‫And let's see, I believe I have another one over here.
‫Let me delete that one as well.
‫I believe this is one of the tests that I have done before,
‫or I've changed the name somehow, I don't know.
‫Yeah, here you go. Now I got rid of that.
‫So we are good to go.
‫Let me paste the APK that we have copied before.
‫Now it's on my desktop. Let me minimize this as well.
‫And we are going to run the ApkTool on that
‫because we are ready.
‫Now, I'm going to do this on my Mac.
‫So if you have Jadx and ApkTool on your Kali Linux,
‫make sure you upload that APK to some service
‫and then download in the Kali Linux as well.
‫So over here, I'm going to open my terminal as usual.
‫So I'm gonna make this a little bit bigger, okay?
‫So let me make this bigger and actually a little bit more
‫so that you can see it better.
‫Yeah, I believe this is good.
‫So we are going to go into the desktop first
‫since we are on desktop.
‫I'm going to say cd Desktop.
‫So make sure you just wander around your computer
‫with cd comment until you see the app debug APK.
‫Like, if yours is in Download, just go to cd downloads.
‫So, I'm going to start with ApkTool, as I've said before.
‫And remember how we use ApkTool.
‫It's very easy and it's very convenient.
‫All you have to do is just write apktool and d for decompile
‫and the name of the app itself.
‫So it's app-debug.apk, like this.
‫So if we hit Enter,
‫it will create the app debug folder for us.
‫We will get to see the uncompiled,
‫the decompiled things and these smally bytecodes as well,
‫as we have done before.
‫So let me just double-click on it and open it.
‫Here we go. Now we see all the files and folders.
‫So let me make this a little bit bigger.
‫So I'm gonna start with the manifest.
‫So this is the first file that we see.
‫Let me open this, actually.
‫You can open this in Android Studio
‫or in like any Leafpad, TextEdit, Geany,
‫whatever you want, okay?
‫I'm gonna open this in a regular text edit.
‫You can open the same thing
‫withinside of Kali Linux as well.
‫So here you go.
‫And I believe this is very, very small,
‫so I'm going to make this a little bit bigger
‫to see the content.
‫I can't even see it right now.
‫So let me come over here and say Zoom In.
‫Yep, now that's good.
‫So we have the information.
‫As you can see,
‫we have the TweetActivity, FeedActivity, SignUpActivity.
‫We see the activity names.
‫We see the MAIN, LAUNCHER tag over here.
‫We know the first activity that is shown to us,
‫SignUpActivity.
‫And over here, we see the Firebase.
‫So as you can see,
‫there are a couple of permissions
‫to use Firebase in this app,
‫and now we know that this app uses Firebase.
‫So we are certain of that right now.
‫And of course, it doesn't stop your...
‫All we know right now is that this app uses Firebase.
‫And in order to test for vulnerabilities,
‫we need to gather much more information,
‫and we are going to do that with several methods.
‫We only know that this uses Firebase,
‫and we see the Firestore over here as well.
‫So we are certain that this uses Firestore database
‫and not real-time database,
‫not Parse database, not MySQL, but it's Firestore.
‫So we can go for that.
‫We can try to see if it's misconfigured.
‫So we can see other information here as well,
‫but I believe we got the most important thing
‫that we need right now,
‫which is the definition
‫of the permissions of Firebase and Firestore.
‫We're gonna take a look into the other things
‫in the next lecture.