‫Instructor: Hi.
‫Right now we have completed the challenge two,
‫and within this lecture
‫we're gonna go into the challenge three.
‫So when we look at the API3,
‫it says excessive data exposure. Okay.
‫So, as a hint it says that
‫we have all been there, right?
‫Giving away too much data and
‫the Dev showing it. Okay.
‫And it says that,
‫try the Android app in the resources folder.
‫Great. Now, in the API3,
‫I believe we are dealing with too much data.
‫So, we are gonna get too much
‫data in a response but we need to find it.
‫And to make it harder,
‫I believe they have created an Android application.
‫So, we are gonna have to deal with that.
‫So, we only have one create user post over here
‫which is vAPI, API3 user.
‫We're gonna have to give some username
‫and password and name.
‫Okay. So, let's do that first in the postman.
‫I'm gonna go to create user,
‫and I'm going to take a look at the headers.
‫Nothing to change over here, I'm gonna go to the body.
‫So username, password, and name.
‫Great, so let's give some.
‫I'm going to give
‫a username, okay, "atil".
‫I'm gonna give a password like "atil123",
‫and just give your own name.
‫And I'm just gonna send this,
‫and here you go.
‫We get the user back,
‫"atil", and we get an id back.
‫Okay, so we have this id over here,
‫so we don't have
‫anything else, I believe.
‫Great, so we get this id,
‫but we don't have any kind
‫of excessive data over here.
‫So, I believe we're gonna have to go
‫and look at that Android application
‫as they suggest in
‫the documentation, right?
‫So, we are gonna have
‫to go into the resources folder.
‫So most probably,
‫we're gonna have to run an APK.
‫So if you're taking this
‫like in mobile application,
‫or mobile ethical hacking course,
‫then it's okay for you.
‫You know how to run this APK.
‫If you're watching this for
‫the web pen testing course,
‫I really recommend you guys
‫just watch it from here, okay?
‫Don't try to execute this.
‫Because we are gonna have
‫to install the Android studio,
‫we are gonna have to install
‫an emulator just to test this.
‫It's taking like two hours,
‫three hours to do that.
‫Just don't bother with it.
‫It's going to be very easy for me
‫because I'm already an Android developer.
‫I have everything in my computer,
‫and you can just watch how it goes
‫and take notes if you like.
‫Okay, so if you don't have
‫any Android emulator experience,
‫or any Android studio experience before,
‫just don't bother with it.
‫Just for this challenge
‫it doesn't make sense to install this.
‫But what I'm going to do,
‫I'm going to open the Android studio.
‫I'm just gonna open a new project,
‫or just select my existing ones
‫because what I wanna do eventually,
‫is to open an emulator,
‫not just a project, okay?
‫Because we already have an APK,
‫I don't think we
‫will be working something
‫like a reverse engineering
‫or something that complicated.
‫We're just gonna listen,
‫the incoming and outgoing request
‫and responses for that APK.
‫So, I'm going to open
‫any project from here.
‫So, this is a project that
‫I have been working on
‫with Kotlin, but it doesn't matter
‫because what I'm gonna do,
‫I'm gonna open the AVD manager.
‫This is the virtual
‫device manager for Android Studio,
‫and I can just run
‫any emulator that I want.
‫So, I open an emulator,
‫which is a virtual device
‫of Android operating system,
‫obviously as you can see.
‫And, this is actually a virtual phone.
‫Now, I can run the APK
‫inside of this phone.
‫And by the way,
‫if you don't know what an APK is,
‫it's an Android product,
‫like an EXE file,
‫but for the Android phones.
‫We get on there,
‫let me just try it one more time.
‫Yeah, here you go, this time it worked.
‫If it didn't work,
‫I believe you're gonna have
‫to sign this with jarsigner
‫or any other tool that you want.
‫If you watched the mobile
‫ethical hacking course,
‫now you know how to do that.
‫If you're very curious about this,
‫I can show you the comment.
‫This is keytool and the jarsigner.
‫These are two comments
‫that is needed in order to run this.
‫But in order to run these comments,
‫you are gonna have to
‫have the JDK installed on your computer.
‫Once again,
‫if you're not a mobile pen tester,
‫or mobile application developer,
‫just don't bother with it.
‫If you're here for web pen test,
‫just watch the rest
‫and see how it goes.
‫So I have installed the APK
‫on this phone, and let's find it.
‫Let me open the screen.
‫Let's see what we called it,
‫or what they called it.
‫It's comment APK. Let's see the comment.
‫Yeah, here you go. This is the one.
‫Yeah, here you go. vAPI.
‫Great splash screen, my friend.
‫So over here, it asks for a base URL.
‫So it should be the URL
‫of our API, right? This one.
‫So maybe we can just copy this
‫and paste it over here.
‫I don't think, yeah, we cannot do that.
‫The clipboard doesn't work over here,
‫so I'm gonna just write it.
‫HTTP 1-3-4.
‫Obviously, you need to write your own.
‫And vAPI, here you go.
‫Now, if I click on save,
‫it will ask me for
‫a user id and password, great.
‫Now, we have this
‫user id and password,
‫because we created it via postman, right?
‫So, the user ID should
‫be two, user password.
‫I don't know the password, yeah.
‫Password is "atil123", great.
‫Here you go, let's try to log in.
‫It says that something wrong happened. Let's see.
‫Let's try one more time,
‫or let's try to create
‫an account from here.
‫Yeah, here we go.
‫We have a screen over there.
‫So for the user id,
‫I'm just gonna go with three,
‫because we already have two for the password.
‫Again, I'm gonna go with "atil123".
‫Display name, again,
‫just choose whatever you want, man.
‫I'm going to go with maybe "atil",
‫but we have already used "atil", right?
‫I'm gonna go with Atlas.
‫So far, so good.
‫I'm just gonna go with register,
‫and here you go.
‫Now I know the user id,
‫which is three, and I know the password,
‫"atil123", and try to log in.
‫Yeah, here you go. We have logged in.
‫So, let's see what this app is about.
‫So, this app is about commenting,
‫I believe, kind of a Twitter.
‫So, I can write some comments
‫and I can just send this comment
‫by clicking over here.
‫Maybe it asks for the location,
‫I'm just gonna allow it, for some reason.
‫And if I just send this,
‫yeah, here you go.
‫It works. It works great.
‫Now, this is a great application,
‫but I don't see any issue over here
‫because we are not seeing any kind
‫of JSON responses,
‫or we are not seeing the request
‫that we are making, right?
‫Because this is an application,
‫user will only see what
‫developer allowed us to see
‫like the user interface.
‫So what we need to do,
‫we need to of course burp suite this.
‫We need to intercept this package
‫with the burp suite.
‫So, we are going to use the proxy again
‫with the intercept on,
‫but we need to make sure
‫that our emulator has the same proxies.
‫So, I open the settings of this emulator,
‫and if you go to settings,
‫as you can see, there is a proxy section.
‫I'm gonna go with
‫the manual proxy configuration this time.
‫And for the host name,
‫I'm just gonna go with 1-2-7-0-0-1,
‫and port number will be 80-80, not only 80.
‫So, this would be the same with this.
‫Okay, great.
‫Now I'm gonna say apply,
‫and I'm going to try
‫and send something from here,
‫and let's see if we can capture this.
‫So let's send this, and here you go.
‫We managed to capture this.
‫So we can see what kind
‫of things that we have inside of this request.
‫We have the device id, we have the latitude,
‫and longitude and everything.
‫So, intercept is on.
‫I'm just gonna turn this off,
‫because what I wanna do,
‫I want to see what happens
‫when we log in from scratch.
‫I'm just gonna close this down,
‫and I'm just gonna come over here.
‫What I really try, I'm trying to do
‫is to get all the responses back,
‫like with the login response
‫and everything so that we can be sure
‫that we get the flag and we get to see
‫what kind of excessive data
‫that we are getting.
‫So, but the problem is I cannot log in,
‫so I'm going to delete this app. Okay?
‫I'm just going to delete
‫this application so that I can install
‫it one more time and then I can log in.
‫But for some reason,
‫I cannot delete this application.
‫I believe the emulator got stuck.
‫As you can see, I cannot do anything right now.
‫Let me try to close this.
‫As you can see, it doesn't work.
‫So my emulator got stuck somehow,
‫and I cannot even
‫delete this application.
‫So if you come across
‫in a situation like this,
‫just make sure you quit this, okay?
‫And make sure you open
‫the Android studio one more time,
‫and make sure you wipe the data
‫or just delete that emulator,
‫and install it one more time.
‫So what I'm going to do,
‫I'm going to go into the AVD manager,
‫and I'm going to find my emulator.
‫Of course, I can just install another one,
‫but I'm just gonna do with this.
‫I'm just gonna wipe the data
‫and it will reset this emulator,
‫and I'm going to open it from scratch.
‫The only downside over here
‫is that we are going to have to wait
‫a little bit to initialize this emulator.
‫And also of course,
‫we are going to lose
‫the data inside of that emulator,
‫but it doesn't even matter
‫because it's just an emulator, right?
‫It's designed to be reset, if it's needed.
‫Great. Now it's open.
‫One more time,
‫I'm just gonna go to the resources.
‫Yep, that's not it, that's it.
‫For the APK, and I'm just going
‫to drag the APK to the emulator,
‫and see if we can install it.
‫Yeah, here you go.
‫We managed to install this.
‫So I'm going to open the vAPI one more time,
‫but before we log in,
‫or before we create an account,
‫and let me just give the URL.
‫Before we log in,
‫I'm just going to make sure
‫we have the proxy,
‫but before we go with the proxy,
‫I'm just gonna give this
‫vAPI URL from scratch.
‫Okay, make sure you do the same thing.
‫So I'm going to say save,
‫and here you go.
‫Now, we need to log in.
‫I believe we can log in
‫with the same credentials,
‫but I'm going to
‫turn the proxy on like this.
‫Okay, it's already on.
‫So I'm going to go
‫into the burp suite,
‫and turn the intercept on.
‫Now, it started to capture the packets.
‫Most probably, it captures the Google services,
‫or something like that.
‫For the user ID,
‫I'm gonna go with 3 for the password.
‫I'm gonna go with "atil123",
‫and I will log in.
‫Here you go.
‫We are sending this username and password.
‫So what I wanna do,
‫I want to check the post,
‫and I want to check,
‫send this to repeater.
‫So, in the repeater,
‫I will just send this
‫and see the response.
‫Yep, here you go.
‫For the response, we have the success true,
‫and the username as well.
‫But for some reason,
‫we don't have any
‫excessive data exposure, right?
‫We are not seeing,
‫at least I cannot see any excessive data.
‫We only get the success and the user name.
‫So I'm going to go into
‫the proxy and send this.
‫I'm just going to forward this,
‫and forward that as well, obviously.
‫And forward, since we are not getting
‫we are not getting anything back,
‫but I believe we need to
‫do it one more time.
‫I'm just gonna log in and forward this
‫again and again, and here you go.
‫Okay, we are inside of the comment app.
‫Still, we are getting some packets.
‫I'm just going to forward everything,
‫until we get nothing
‫and go into the HTTP history tab.
‫Now, I will check everything
‫that I have done so far.
‫So for the post request,
‫I'm getting some responses
‫back for the get request.
‫Yeah, here you go.
‫For the get requests,
‫we are getting a lot of responses
‫and we get a flag.
‫So what happened?
‫What was the thing over here?
‫So I think that in the vAPI, API3 comment endpoint,
‫we are making a get request,
‫and we're getting a lot of data.
‫As you can see,
‫from the response of this request,
‫we are getting the device id,
‫we are getting the latitude,
‫and longitude, and comment text.
‫And the idea over here is that,
‫even though the developer
‫is not showing us this information,
‫even though we are not seeing
‫the latitude and longitude,
‫remember this asked
‫for a location permission.
‫So, it gathered our latitude and longitude.
‫It's not showing that,
‫it's not showing the latitude
‫and longitude to us.
‫But, it doesn't mean that
‫we cannot see it.
‫The idea over here is that,
‫even if you're not going
‫to show it to the user,
‫even, if it's not necessary,
‫then just don't send it
‫with the response, right?
‫Because a hacker can easily listen
‫for the responses, and just get the JSON back,
‫and get all this data that
‫they're not supposed to be seeing.
‫That is the idea.
‫That is why we got the flag, back over here.
‫So that is the definition
‫of the excessive data exposure.
‫So, even if you didn't exercise that,
‫even if you didn't have
‫the Android studio and the emulator,
‫I believe you get the idea.
‫This is not only for mobile applications.
‫This is for APIs for the web as well.
‫If you're not going
‫to be using that data,
‫and even if it's a sensitive data,
‫the location is sensitive,
‫then just don't do it.
‫Just don't send that as a response back,
‫because a hacker can easily get this.
‫Okay. So what I'm going to do,
‫I'm going to stop here
‫and continue within the next lecture
‫for the next challenge.