‫Instructor: Hi.
‫Within this lecture,
‫we're going to see another flow, another mistake
‫in the implementation and it will let us do a login
‫with an administrator account one more time.
‫So in order to do that, I'm gonna uninstall this APK.
‫Okay?
‫And I'm going to delete this,
‫and I'm going to open my Apktool,
‫I mean, Apktool decompiled folder.
‫If you come into the resources folder,
‫you will find the values.
‫So this is one of the things that I actually look at
‫when I do some real penetration tests.
‫And because you have these values,
‫or strings.xml over here.
‫Right?
‫So in the strings.xml,
‫developer can actually define some strings
‫to use in the application,
‫but they sometimes store values
‫like passwords or user names or any kind of hashes
‫that may lead us to any funny thing,
‫any funny implementation in the process.
‫So make sure you check the strings.xml
‫when you actually do a penetration test.
‫So that's exactly what I'm going to do over here.
‫So another thing, maybe you can look for,
‫the network configuration and other stuff,
‫like we have seen before,
‫but make sure you check the strings.xml, definitely.
‫So I'm gonna come over here,
‫and if you scroll down a little bit, let me just zoom in.
‫I cannot seem to find it very...
‫In a proper way.
‫Okay, so let me zoom in.
‫So here you go.
‫Now, it's much better.
‫If you come over here,
‫you can see the activity names.
‫But there is a value called is_admin.
‫And as you can see,
‫this is hard coded over here and it has the value of No.
‫So this is very suspicious, right?
‫So maybe, rather than No,
‫we can just say, "Yes."
‫And see what happens.
‫So definitely, developers try to hard code over here,
‫like the privilege of the user.
‫And if we change it, we can manipulate the app.
‫Let's see.
‫So I'm gonna exit out of this ADB shell,
‫and I will just run the Apktool with B like building,
‫and it will build a new APK for me.
‫'Cause we have manipulated the file, right?
‫So as you can see, Apktool can be very helpful in this case.
‫So let's wait until our new APK is created.
‫Okay?
‫And then we're gonna install it and then we're gonna use it.
‫So let me come over here to Distribution,
‫and just use this one.
‫So I'm gonna copy this to my desktop,
‫and let me minimize this and open my Genymotion.
‫And here you go.
‫Oh yeah, it gives me an error,
‫because we haven't signed it yet.
‫So we are gonna have to sign it
‫by using the same old commands that we use generally.
‫So I'm gonna just hit Upper Arrow over here
‫to find the Jarsigner.
‫So I'm gonna sign this.
‫I remember we have created this key store file,
‫so I know the password and stuff.
‫So now it's signed and here you go.
‫Now, it's uploaded to my Genymotion.
‫So as you can see we have a Create User button.
‫We didn't have that, right?
‫We haven't seen it before.
‫Since now we are an administrator,
‫we can create actual users.
‫And in real life, it should give us much more privilege
‫on this app.
‫Even though we see the Create User button right now,
‫I believe it doesn't do much.
‫So when I just hit on it will say,
‫"Yeah, this is still in progress."
‫But if you can make something like this happen in real life,
‫of course, you're gonna discover
‫a lot more administrator privileges.
‫Like you can create users,
‫you can manipulate the process and stuff.
‫So it's a very dangerous thing
‫to have an administrator control,
‫or administrator condition to be stored
‫in the strings.xml file.
‫So this is it.
‫We're gonna stop here and continue within the next lecture.