‫Instructor: Hi.
‫Within this lecture we're going to see a very simple flaw,
‫very simple error in code
‫that lets us log in with administrator account.
‫So basically when we do this decompiling thing with JADX,
‫we're gonna have to analyze and have it take a look
‫at every code that we can see over here.
‫For example,
‫if you come over here to do log in .java
‫and open it with any text editor
‫you can see the codes and you can try to see
‫if anything funny is going on over here.
‫For example,
‫let me browse a little bit.
‫We see some method called postData
‫and over here we see some HTTP requests.
‫But at this methods we have an if statement.
‫And as you can see,
‫there is something called devadmin.
‫So if we dig a little deeper over here
‫we see that it actually takes the username
‫and password from the login activity.
‫However,
‫if the username equals devadmin,
‫which is administrator username,
‫it doesn't do this login thing,
‫it rather takes us to this devlogin page.
‫And it means that we have found a loophole over here.
‫Even though we don't have any account,
‫we can try to log in with this devadmin username
‫and try to see if we can get in.
‫So I believe in this case
‫they didn't actually specify
‫any administrator rights regarding this account.
‫However, we can actually try and see what happens.
‫So I'm gonna come over here to username,
‫and rather than giving the instructions
‫like Dinesh over here,
‫I'm gonna go for devadmin
‫and I'm not going to give any password.
‫It asks me my server IP.
‫So I'm gonna give it like 192.168.121.
‫And if I submit and try one more time,
‫here you go, now I'm logged in.
‫Even though I don't see any administrator menus over here,
‫I'm still logged in.
‫So this is another way of going into the application
‫without having to know the username and password,
‫without having to create any new username.
‫So maybe you can think that this is way too easy,
‫this is a way too easy flaw for developers,
‫they don't generally do that.
‫But the main idea is that we have to check every Java file,
‫every CodeBin file that we see
‫in order to find some errors or bugs in the process.
‫So let's continue within the next lecture.