Original subtitles

1

Hey, guys, welcome back to another episode on How to Hack.

2

So today we'll be discussing again about reverse engineering, a mobile application and looking into

3

the source code to be able to find out more information about the application and sometimes even being

4

able to get the username, password, credit card details and all these different details.

5

So over here on the left side, I have a mobile phone running.

6

And what we can do is we can open up this particular application.

7

So we actually have this app called Devar that has been installed on duty, mobile phone, so I can

8

go ahead and open it up.

9

So once I open it up over here, we have input validation issues, button one.

10

So of course, this is part of a mobile application penetration testing series.

11

And of course, clicking on to input validation issues, Part one will be able to enter a specific name

12

to search for it.

13

So from the previous video, we actually went through how we could actually do a sequel injection directly

14

into the system.

15

So, for example, over here I can actually use a magnifier so it is easier for you to see.

16

So of course, from the objective, we can see that we are trying to access to user data without knowing

17

any of the user name.

18

And of course, the user provided a hint for us to learn about mobile application penetration testing

19

directly again, this mobile application.

20

So, of course, we can go ahead and enter the user name.

21

So in our case that we can enter, for example, Atman.

22

So once I hit Etman, I can go ahead and click on Search and we'll be able to look at the username,

23

password and credit card details.

24

So of course, from the previous video, we actually learn about putting SQL injection into the mobile

25

application in order to gain access into the data.

26

So in our case, I can enter, for example, single quote or one equal one followed by semicolon.

27

So I go ahead and click on Search and it will review to us all of those usernames, passwords and all

28

those data directly inside the system.

29

OK, so that is provided.

30

The input query is subjective and vulnerable to SQL injection, but what if the mobile application is

31

not vulnerable to sequel injection?

32

So what we will need to do is to reverse engineer the mobile application.

33

So on the right site.

34

So as recommended on the members only video.

35

So under decs tools we actually learn about how we could actually break down the apk fall into our fall

36

and be able to view into the source code.

37

So what we can do now is to actually go ahead and use the function to help us do the conversion of the

38

file so D to J dash decks to JRA.

39

So there's also a S.H. for you if you're on Linux system.

40

So all you got to do is enter the APK file.

41

So in our case we got Devar Dash Beta apk so go ahead and hit enter on deck.

42

All right.

43

So we can use a double dash force.

44

And he'd enter a net, so that will begin the conversion process.

45

So once the conversion process is complete, it will be able to get a fall as being specified over here.

46

So we got Devar Dash beta dash decks to J.R..

47

J.R., so go back into the folder and scroll all the way down.

48

And of course, over here we have a number of tutorials for you.

49

So we are going to learn more about ops go droit, especially in terms of the Falgoust as well as financial.

50

OK, so we'll be going through those details later on.

51

And what we can see over here is that we have over here to follow.

52

All right.

53

So we got Devar Desh, Beitar Desh decks to J.R., J.R..

54

So this is the fall.

55

And we have also downloaded as part of our previous video, one of the previous videos about mobile

56

application penetration testing.

57

So we actually have jadi guey so we can open this up.

58

All right.

59

So once we have it running, all we got to do is track the Devar Dash beta dash decks to J.R., J.R.

60

into the DJAVAD compiler.

61

So once you have done that on the left side, we can look at the more information about this J.R. fall.

62

So we have Jacare Devar.

63

So go in, opened it up and we can look at all the different classes.

64

So we have API credentials, access, control.

65

And of course, the one thing that we want to look at is the open up the sequel injection activity.

66

So go ahead and click open on that.

67

And over here we can immediately find more information.

68

So we have schoolie I we have the drop table.

69

If exists equal our user LLC would actually and would actually create a table.

70

All right.

71

So once you have dropped the table, it would create a table.

72

And we have the user variable character, a variable character and credit card variable character.

73

And immediately we can find all three user records inside this mobile application directly by viewing

74

the source code.

75

It has been hot code.

76

It so hot code it sent into these skillfull.

77

And that is how we actually gain access to those credentials where we will actually trying to do the

78

sequel injection.

79

All right.

80

And of course, in our case, by being able to break down the jar file or the epic fall, we can gain

81

direct entry into the source code and know exactly what kind of file, what kind of data is being stored

82

or created insight to system.

83

So once again, I hope you've learned something valuable in today's tutorial.

84

And if I have any questions, feel free to leave a comment below and I'll try my best to answer any

85

of your questions.

86

Stromatolite sharing.

87

Subscribe to the channel so that you can be kept abreast of the latest cybersecurity tutorial.

88

Thank you so much once again for watching.