I thought it's a funny kind of video.
I could walk you through a general process of trying to do some bug hunting and Android to sort of show
how I would generally go about looking into an application.
If I were doing some research into one so the very first thing is before I compile an EPA I'm going
to install Roser and I'm going to try the following things.
I'm going to run the attack surface command against the application to see what different attack services
exist.
If I see that they're activities that are exported and that there are scanners that are exported or
rather content providers that are export it I'm going to try to start every activity to see what that
gives me.
If that gives me something that looks to be vulnerable or looks to be a problem then I've already found
some problems right.
And then I'm going to also run this injection command to see if any sequel injections exist.
If they do exist then we've already found a problem.
Right.
So these are some very good low hanging fruits that we can try to pick off when they're available.
Right.
So then aside from this we can also try D compiling the HBK and there are a few things that you should
generally be looking for when you compile an EPA.
There's actually one other thing that I'm going to adhere to the end so that we can remember to discuss
it which would be lowered.
But starting with these ones X execute sequel right query raw query.
These three functions are always typically going to be used to execute sequel.
We should always look at them with great scrutiny to determine if they're using pressurised queries
or if they're doing something unsafe.
If we see something unsafe that we can potentially reach with the user input.
This gives us a place to potentially try to attack.
So these are really great to try to search for.
In general most applications are going to have some form of database query if we can find this database
queries.
We could potentially do something harmful which is important to be able to determine in an application.
The next thing is gonna be to look for a log dot something.
So it's usually a log dot D log dot e if you just type in log dot you'll be able to find anything that
has the log being extended with some form of method.
These are really important because they can tell us what sort of information is being logged by the
application.
This will be able to let us like easily pick off any sort of like debug messages or error messages that
could expose something sensitive.
We just need to determine how to get down that branch of code and then we'll be able to expose those
log values easily.
The next thing is going to be to search for a password.
In general most people aren't going to code passwords but just in case that they do password could be
a good thing to search for.
If you see password equals something in plain text then you've obviously found some sort of problem.
So that's always a good one to search for shared preferences is a really good thing to look forward.
This will be any of the shared preferences files.
If we're writing to shared preferences odds are that data is not going to be secure.
If we can see what kind of data is being written and we see that it's something that should be treated
with security shared preferences is going to be a good way to show that right.
Smith create temp file is something being created in the temp file that again has some sort of data
in it that's supposed to be secure.
Then we could potentially expose that.
Right.
So this is a good thing to look for as well to see what kind of data gets put into temp files exact
as a general sort of command that's used by Java to execute command line type arguments and there's
a few different ones that exist some that exist specifically for Android as well.
If you ever see command line being run with the user input you might be able to get command injection
which is a very severe vulnerability.
So I typically look for these and look for any instances where user input is being allowed in them.
If that ever happens we want to try to test that to see if we can do some sort of command injection
on that.
Right.
And then of course the load you URL.
Because as we learned we can load Uber or so we can load files through the load.
You are El function so if we ever get the opportunity to get data into load you or El we might be able
to load a specific file utilizing that.
So this is something to always look out for as well.
So in general through these videos you should have a pretty good understanding of how to hunt for vulnerabilities
in Android and how to be able to expose those vulnerabilities through D compiling as well as utilizing
tools like drones here.
In general this should give you a little bit of an overview towards the general flow of what we typically
look for in vulnerabilities and like how we typically go about looking for them how someone like me
would go about looking for vulnerability if I'm searching for one.
So this should give you some good information to be able to get up there and start bug hunting in Android
whether it be your own applications or looking for bug bounties or testing other people's applications.
This will give you a good solid set of foundations to be able to try out some vulnerabilities and learn
all sorts of new stuff.
With this using a sort of like a good foundation.