Original subtitles

1

Hey, guys, welcome back to another episode on How to Hack.

2

So over here I have Devar application running.

3

And of course, this is an insecure mobile application.

4

And we're going to look at the item number eight, which is on input validation issues.

5

So this is part of a mobile application penetration testing series.

6

And of course, we also have a number of mobile applications that will be testing on.

7

So in this case, of course, we can go ahead and click on input validation issues, part two.

8

All right.

9

So once you click on it, so I'm going to open up the magnifier so that it is easier for you to see.

10

So we can look from the magnifier.

11

OK, so the objective is try to access any sensitive information apart from a web, you or else so improper

12

or no input validation issue arise when input is not filtered or validated before using it.

13

So likewise, whether you're building a Web application or a mobile application or any to client a software,

14

you want to validate what the user is going to input into your system.

15

All right.

16

So over here, we can see that there is an input form and there is a button for us to click view on.

17

So in our case, that's go ahead and enter, for example, a website so I can enter, for example,

18

Loy Yang, young dot com.

19

So I go ahead and click on View and immediately that would begin loading the rest of the site so we

20

can create Web site.

21

All right.

22

So do check out this website loyalism getting dot com to learn all about cyber security.

23

OK, so we got a number of videos and so on.

24

So right now we are doing a lot of focus on mobile application penetration testing.

25

So in the future we could be learning a lot about a stuff.

26

OK, could be on iPhone, could be on laptop Windows, 10 computers, Macintosh OS and many, many artists.

27

So very quickly we can see that this is how it works so we can validate whether we are able to access

28

other files inside the phone by changing the input.

29

So again, we are setting different kind of payloads.

30

So again, on a previous video, we'll look at sequel injection and in this case we can look at the

31

ability to access other files.

32

So one of those is issues with mobile application is that they have so much permissions into a mobile

33

devices like the storage across the entire device that is on SD card or that it is on internal system

34

storage.

35

Many of these mobile application have full access into it.

36

So a vulnerability in the input form will allow the hackers to be able to gain access to these different

37

puff's.

38

So moving forward, what we can do is, of course, I can open up command from.

39

OK, so we got a command problem running over here, so I'm going to put it on to the right site and

40

of course, we have the mobile device on the left site.

41

OK, so I can go ahead and try to go into EDB Shell or my Android debark so that we can understand more

42

about the system structure and what kind of force are accessible because of this particular vulnerability.

43

All right.

44

So I could go ahead and enter Adibi Shell and this would bring us to this shell of the mobile device.

45

OK, so we do have a tutorial and on Droit Duboc Bridge.

46

So do check that tutorial out.

47

So moving forward, what we can do is we can come into data DADAR.

48

So this is the part where all the mobile applications are storing their information on OK, so we can

49

KDDI into Jaka, assume Devar, OK, so we can enter El's for example and we can see into shet preferences.

50

All right.

51

And again, we can see all these different files available for users to access into.

52

And if I do a CD or DOT, I can enter Shell so we can see all these different files.

53

So we have like a follow over here.

54

So you infl around so and so forth and we have the app textures and all these different directories

55

as well.

56

OK, so what we can do is we can change for example, so we can try to move one of the files like you

57

infl into a smaller way for us to type it out inside vulnerable input so we can change this.

58

Let's say for example, five six zero that's changed this to you in full unfold test one.

59

So it's easier for us to access and enter inside a system so we can enter.

60

So we got a file here you infl test one.

61

So what we can do is going back into the mobile application.

62

All I got to do is change a little bit of the command so I can get a fall.

63

All right.

64

So we're trying to access into the system, OK, so we have to fall and we can specify specifically

65

where is the absolute path.

66

So the POV name into default that we are trying to access into so I can enter fall and I can enter,

67

for example, data slash data.

68

So and of course, by Jacare.

69

Jack Ha, Aseem Devar, you in full one, let's see if that works, will we be able to get the details

70

of that particular fall?

71

OK, so go ahead and click on View.

72

And immediately we can see the content in insanities fall around, we'll be able to see a lot of those

73

content across the entire mobile application on a mobile device inside of storage.

74

And what if we try to access and to say, for example, the SD card?

75

So that is an external storage.

76

So, for example, if I CD into SD card, I can enter URLs.

77

And of course, over here at SD card, we do have quite a number of different files and I can enter

78

a list.

79

So this would also show hidden false.

80

OK, so we got a dot unfold.

81

So this is heat info.

82

Are we also able to access heat and false because of this vulnerability?

83

All right.

84

So let's go ahead and try that out and see what we see.

85

OK, let's see what we'll get.

86

So if I go into SD card.

87

Followed by slash dot, you in full dot text, click on View, and once again we're able to see the

88

fall.

89

So if I do a cat you infl not hit enter and it likewise we're getting the same information.

90

OK, so very quickly we are able to view all these different data.

91

We are able to view all this different sensitive critical information inside the mobile device.

92

And of course this vulnerability means that hackers would be able to view into all this critical data.

93

Critical information and input validation has an issue and which means that whether it is a client or

94

the architecture, a client server architecture we have to secure, we have to sanitize a different

95

kind of inputs coming in are coming in from the user into the mobile application.

96

OK, so again, I hope you have learned something valuable in today's tutorial, sort of like share

97

and subscribe to the channel so that you can be kept abreast of the latest cyber security story.

98

Thank you so much once again for watching.