Android App Hacking - Black Belt Edition

We will discuss the concept (setup) of this course. How we can interact with a device and we also talk about the advantages and disadvantages of an real smartphone vs an emulator / virtual machine.

This video covers the core setup of an Ubuntu VM together with the installation of Android Studio. We will set our environment variables and get ready for this course :)

We will have a look into the installation process of an android emulator. We will also find out, which images directly gives us root access and which not.

In this video, we will learn more about the emulator and the really amazing options it provides. We will also have a look into some secret interfaces, which helps us location spoofing. It is not the mocking feature in the developer options ;)

We will setup a virtual machine which is based on an android image. This can be faster if we have to deal with nested virtualization. You will find more information about this in the concept video (beginning).

Let's do a quick recap about the concept and different options we have, because this might be a little bit confusing :).

Just a quick look into some useful developer options. Some of them are really underrated like the "bluetooth hci snoop log".

This video covers automating processes like inserting text or performing clicks on the device. This can be turned into playing games, without playing them :)

You will find two versions of this game. They are identical regarding to the functionality but the one having "12" at the end has been compiled for android version >= 12. The other one will work on all lower versions.

We will learn how to create and dump the bluetooth log of a smartphone. Afterwards we will have a look into the connection parameters with wireshark.

We move on with capturing and analyzing the traffic and start sending our own modified packages, without requiring the android application.

We will get a better understanding of the Android Debug Bridge (ADB) and it's components. This is very helpful to perform more advanced attacks, that also requires port forwarding.

The final video of this chapter will cover useful adb commands and shows some interaction with the device.

The scrcpy version has been updated regarding to certain vendors. Some things have changed in Android version 14 and therefore, the old scrcpy version does not work anymore. This only affects real devices. Within the emulator I do not have encountered any issues.

In this video we will have a look into installing the new version to fix the problem for real devices :)

In this video we will get familiar with the app structure of an android app.

You smartphone is using the ARM architecture. You Java application bytecode is therefore being transfered into the "Dalvik Executable" (dex) format. Here we will learn more about this process.

This video gives a deeper view into the "Dalvik Executable" (.dex) format and also shows ways, analyzing it.

If we want to modify an android application, we need to decompile it. We will find out how this process works, in this video here.

In this video we will decompiling an android application.

The AndroidManifest.xml is the most important configuration file of an android application. In this video we will learn more about the strucutre.

You will find two versions of this game. They are identical regarding to the functionality but the one having "12" at the end has been compiled for android version >= 12. The other one will work on all lower versions.

Android apps are being sandboxed. We have a look into the permission model, how it works and also get some impression, how to attack it.

In this video we will have a look into activities.

*Update: Just flashed the information that contentProvider do not have intent filters. That's all :)

Some practical exercises on interacting with activites

Some practical exercises in exploiting misconfigured activties.

Intents are some sort of messaging objects. We will learn more about them in this video.

This video shows the "arming" and "disarming" process of an alarm system, based on an intent.

Here you will find different versions. The "alarmPin.apk" is the apk which I have used in this video. One participant mentioned, that this application does not work for him. Therefore I have added an additional check which is "alarmPin_updated.apk". In case if you are using an android device version >= 12, I have also added the "alarmPin_androidVersion12.apk" for you. I hope we should be good to go right now :)

This quiz is about the things we have learned so far about activites and intents.

We will find out how deep- web- and app-links work and what vulnerabilities they offer.

We will take a practical view on deep- and weblinks and how they work. We will cover different android versions - up to 14 - and we will also see how to manipulate the application behavior by viewing them :)

BroadcastReceiver are some sort of notifcations for applications. They can be used for various tasks. We will find out how they work and also have a look into exploiting them.

In this video we learn, how to hunt for vulnerable BroadcastReceiver within an android app and also start exploiting them, with the adb shell.

You will also find a version of this app for android devices >= 12 (SDK31).

In case if a customer demonstration is required, it might be required to write our own application to demonstrate an exploit. This topic will be covered in this video.

Services are being used for all kind of background tasks. We will learn the differences between "bind" and "intent" services and also get a better understanding of, how they work.

ContentProvider is a very interesting topic. They simply "provide content" to other applications which can be sometimes be abused to trigger SQL injections or Path-Traversal attacks. In this video we will find out, how they work.

SQL injection attacks are not related to web applications. They can be used to bypass security features of an android application. An attacker might be able to access sensitive information of your app. We will find out how such an attack look like.

Equipped with the theory about the attack, we are now performing some practical one. We will gain access to a protected database table, through a vulnerable ContentProvider. Hands On!

Path-Traversal attacks are still common in android applications and could lead to a complete breach of the app. We will learn how they work and more important - how to exploit it.

Another recap. After this quiz, you are absolute ready to exploit your first applications. As already mentioned, we have some challenges in the reversing section for this.

Android applications needs to be signed. We will learn more about this process and why it is necessary.

This video covers some additional information about the signing process and the corresponding files of it. Knowledge about it might be required if there are some anti tamper actions: "has the app been modified?". We will learn how we can verify if an android app has been modfied and also, how to bypass it again :)

The "Bluebox Master Key" vulnerability is an issue within the signature verification of an android app. It has been patched a couple of years ago but it is still very interesting and might be useful regarding to the other platforms / checks.

This video gives an introduction into the reversing tool dex2jar and its corresponding features.

This video gives an introduction into the reversing tool jadx-gui and its corresponding features.

An exercise on how to get back the Java code of an android application. It is not the original code but regarding to the functionality, pretty close to it. This Java code cannot be dirctly modified and compiled back again. If we want to modify an android application, we have to do this in SMALI (see SMALI chapter).

This tool has some really amazing features and the switiching between different decompilers sometimes allows us, to restore back the Java code of hard obfuscated applications.

Some practical view into Androguard.

This video shows, how to create a call graph of an android application. It can come handy if we have to deal with high obfuscated android apps.

IMPORTANT

In the video I mentioned using the networkx library in a certain version. This step is not necessary anymore. Androguard did remove this library and it should work right now out of the box.

Please update your current androguard with the following command:

1. git pull

2. pip3 install -r requirements

In case if you have not downloaded it yet, please follow the instruction on the installation page of the wiki. I cannot link external sources here.

Info:

You will find two versions of the "reverseme.apk". They are identical regarding to the functionality but the one having "12" at the end has been compiled for android version >= 12. The other one will work on all lower versions.

This video shows, how to create a flowgraph of an android application. It helped me solving really hard CTF challenges. This approach is of course also useful for real world applications. Really hard obfuscated android apps.

Let's recap everything we have learned so far by hacking a "banking app". This of course a training application but many findings we cover here, are also out there and waiting for you to be discovered (... and reported!:) ).

IMPORTANT:

Please install the following version of sqlalchemy if you encounter an error. Thanks Kyle! :)

$ pip3 install sqlalchemy==1.4.32

Let's try to bypass the login screen of the insecureBank application. 

Let's play around with the databse entries of the logging table.

Changing the password of this application, without even knowing it? Not a big deal because we know how to hack a BroadCast receiver.

Modern applications are now a days encrypting many of their data. We will find out how the password of this application is being encrypted and more importantly, how to decrypt it :)