Original subtitles

1

Hey, guys, welcome back to another episode on How to Hack.

2

So over here, I have an Android device running and of course, this is powered up by Android studio.

3

So it does not matter whichever mobile device you're running.

4

So over here we have the Android running and I can open this up so we can look at the applications that

5

we have.

6

And of course, we have Devar, we have four goats.

7

And of course, this already mobile applications that we will be doing our penetration testing on as

8

part of our series.

9

So, of course, in the future will be going through a lot more different kind of security assessment,

10

penetration testing directly on the mobile application.

11

So moving forward, what we can see is I can click onto Devar and I can also open up magnifier so it

12

is easier for you to see.

13

So once want open up magnifier, I can actually see more carefully.

14

So Devar, it is an insecure, vulnerable application that we can do penetration testing on.

15

So of course in today's case we'll be looking primarily on the access control issues.

16

All right.

17

So we have went through the insecure data storage.

18

We went through the input, validation issues and we're going to look at the expense control issues.

19

So go in and click on access control issues, part one.

20

So once I click on it, so over here we can reach the objective.

21

So I'll read it out for you.

22

You're able to access the API credentials when you click the button.

23

Now try to access the API credentials from outside the application.

24

OK, so what happened is that components of applications can be invoked.

25

And of course from the tutorial title we can invoke that from Android Debark Breech.

26

So we do have a full tutorial on Dezso.

27

Do check that video out as part of this channel.

28

So once you click on it, view API credentials so we can immediately see more details about the API

29

credentials.

30

All right.

31

So we can see those data immediately.

32

So what I'll do next is how open up command from.

33

OK, so we got commander, I'm running and I'll put it on to the right side for you and on the Android

34

emulator, I'll put it on to the left side for you.

35

So what I'll do is I'll go hit enter Abebe Lockette.

36

So this would actually start looking at all those lock status massagers regarding the Android device

37

in case when I click on their view credentials and I click back so I can actually stop the Adblock cat

38

and I can screw up a little more so we can look at the locks that have been created when I invoked it.

39

We're going to click onto The View API credentials.

40

OK, so as I screw up a little more, trying to find out specifically what was being called.

41

So over here we can see we have the activity manager.

42

All right.

43

And it says start you zero act jcua assume devar action dot view on a score.

44

Kretz, Sampi, Jugulator, assume Devar Slashdot API Kretz activity.

45

OK, this was from Eweida one zero zero six seven.

46

OK, so from here what we can do is we can try to invoke the API credentials directly from EDB.

47

OK, so we may not have control of what the user is clicking.

48

However, based on what the user click, we can trigger certain activities to be started to invoke all

49

this different classers.

50

So when we were looking at a reverse engineering of mobile application, we saw the different classes

51

in site, a mobile app and we can trigger name based on durin naming.

52

OK, so over here, going back into the command prompt, all you got to do is enter.

53

For example, you can enter EDB Shell and start Desh End and all you got to do is copy exactly what

54

you saw earlier from the activity lock.

55

OK, so you go with Desh and followed by Jacare.

56

A seam got divorced Argott API Kretz activity.

57

So go ahead and hit enter on that.

58

And immediately on the left side of the mobile device we can see that we managed to invoke the activity

59

from ADB.

60

All right.

61

So once again, I hope you've learned something valuable in today's tutorial.

62

You have any questions?

63

Feel free to leave a comment below and I'll try my best to answer any of your queries.

64

Stromatolite share.

65

Subscribe to the channel so that you can be kept abreast of the latest cybersecurity.

66

Thank you so much once again for watching.