Original subtitles

1

Hey, guys, welcome back to another episode on How to Hack.

2

So today we'll learn about reverse engineering, mobile application.

3

And what we can see over here is that on the left side, I have an Android emulator running.

4

So do go ahead and download Android studio.

5

And once you're an Android studio, you would have the ability to access the Android virtual device

6

manager.

7

So I have actually set up a video previously on this tutorial.

8

So do check that out.

9

So going back into the tutorial today, we can actually screw up.

10

And of course, there are a couple of applications that we are going to learn about mobile application

11

penetration testing.

12

So on the left side of the screen, which you have the emulator, we can click onto Devar.

13

And in the future, we will also be looking at for in terms of our mobile application hacking series

14

so I can go ahead and click on Devar.

15

And once we're in, we'll be presented with this particular homepage.

16

All right.

17

So this homepage will allow us the ability to learn about mobile application penetration testing so

18

we have insecure logging, hot coding issues in secure data storage, input, validation, access control

19

issues, as well as hot coding issues and invalid input validation issues again.

20

So all these are great ways for us to learn about mobile application hacking.

21

And of course, what we are going to learn today is about reverse engineering the application so as

22

to install applications into these mobile devices.

23

They usually come as an apk fall.

24

So once you have the app fall, what we need to do is to convert it into a G, a R fall.

25

And once you have done the conversion, we can actually view into how the data was actually being stored,

26

how they could have possibly written the code in which we can view, we can understand it, and after

27

which we can actually try to launch certain attacks against it because we're able to possibly find vulnerabilities

28

in association with the mobile application.

29

So moving forward, what I'm going to do now is I'm going to enter command from.

30

So once I go to command problem, I can actually see into the folder.

31

OK, so go ahead and download IDEX tools so the tools will come with the ability to help you do the

32

conversion.

33

So over here I can enter.

34

Ah, so this will list the directory of all the files and folders inside the working directory.

35

So in case, as mentioned earlier, we have a waps good right.

36

And we also have Devar that you're seeing on a screen on the left side right now.

37

So we have the APK fall.

38

So what are you going to do now is to use DTG and we can enter Decs to J.R..

39

And once you have the bat fall, so of course, we are running on a Windows 10 computer, we're running

40

on Linux deals, we have a dust hitch that you can use to do the conversion.

41

So over here, we have the bat fall.

42

And what are we going to do now is to input the APK fall to begin the instructions for the conversion.

43

OK, so over here, what I'm going to do now is to actually enter Devar Dash, Beta Dot.

44

APK So go ahead, enter in debt, so of course, we have already done the conversion before so I can

45

use a British force as part of the perimeter to actually go ahead and do the start the conversion so

46

I can hit enter on debt and it would take a while for it to complete a conversion.

47

So once we have done that, I can enter again and immediately we can see that we have Devar Dash beta

48

dash decks to J.R..

49

J.R., follow over here.

50

OK, so we got this fall running and all we got to do now is go back into the folder and you want to

51

open up the jade gooey.

52

So this allow us the ability to view default and I'm going to go back to the folder so we have the Devar

53

Desh beta decks to J.R..

54

J.R., I'm going to drag and drop it into the Java old compiler and immediately we can see all the different

55

information in relation to this apk.

56

So I'm going to use the magnifier so it's easier for you to see.

57

So of course, once we have to modify running, we can see that we have enjoyed that support and we

58

had Drakkar Awesome Diva.

59

So I can open that up and we can look at all the different classes, we can look at all the different

60

classes.

61

That is part of the mobile application.

62

All right.

63

So we can see all these different data.

64

And very quickly, for example, I can just demonstrate a really quick way of looking at how the code

65

looks like.

66

So over here, we have the following example.

67

So we have the package we have to import.

68

We have to populate class.

69

We have the public voit safe credentials, and we can see that you're saving data into the system.

70

OK, so for example, now I can close the magnifier because we now know how to reverse engineer the

71

mobile application and look into the source code.

72

So if I go back into the simulator and if I go into, for example, in secure data storage, part one

73

and I can enter, for example, the third party service username, say, for example, Arunta, Loy

74

Yang and I entered a password of one, two, three, four, five, six, seven, eight.

75

I click on Safe.

76

OK, so we have thirt party credentials saved successfully and I can go into command prompt OK, so

77

I can go back to command problem and I can do an ATV shell so that we can gain access into the mobile

78

application or the mobile phone so we can also do the same for any physical mobile devices.

79

So do go ahead and try that.

80

I have tried it before and it is working as intended.

81

OK, so because for tutorial purposes over a video screen cost of video sharing a recording, so we

82

are doing it as an emulator.

83

So going back here we can see the data data and we can enter URLs and we can CD into Jugg her.

84

So this is the mobile application folder and I get it or else a game so we can look at all these different

85

folders and directories and file.

86

So I can KDDI, for example, into shet preferences and I can add or else and here we have an XML fall

87

so I can enter a and we can look at the timing of this particular file.

88

We can look at the information of this particular file and we can see when this particular item was

89

being saved, when this item was actually being accessed, what was the item that was inside this particular

90

file?

91

So all I'm going to do is, for example, enter Cat Jacare to this particular file.

92

I can hit enter on that and we immediately will be able to find out the string password as well as the

93

string name user.

94

And of course, we can see the information that we can earlier.

95

And if I go back into the code, we can find out all this data.

96

So we got user with a password.

97

So if I go back to command, prompt user and password, once again, we were able to see those items.

98

They are being recorded inside the system.

99

And moving forward is part of the tutorial, we can also look into insecure data storage, too.

100

So once again, now that we learn about reverse engineering mobile applications, we can look into the

101

data over here.

102

So in this case, by observing the source code, we can see that there is a private school like Database

103

MDB.

104

So open a create database IDs to create table, if not exist.

105

And of course, you can also try to do a lock in terms of recreational currents.

106

And we can look into insert into my users so we can see that they are using some kind of sequel Quarrie.

107

So we have done a number of tutorials about sequel injection and so on.

108

So in our case, a lot of applications may also be using a lot of applications, may also be using SQLite

109

as part of storing data into the mobile device.

110

So in our case, of course, from what we're seeing here, based on a source code, we are definitely

111

seeing that.

112

All right.

113

So what we will do now is we can actually go back into the Android phone, OK?

114

And we can click on to part two.

115

So, again, this is a wonderful application for us to learn all about mobile application penetration

116

testing.

117

So in my case, I can enter, for example, against username Loy Yang Kyung and I can enter the password

118

and I can go ahead and click safe.

119

So we now have the party credentials saved successfully so I can go back into once again command prompt,

120

OK, I can go back into the top folder and can enter URLs and we can go into, for example, KDDI databases

121

and can enter LFS again to look at all the files and folders.

122

So in our case we can see over here we have IDs to make sure we have IDs too.

123

So for example, in our case we may have a challenge trying to understand what kind of fall time it

124

is, because over here we have Devar Notes DB so DOT DB is actually a way for us to view into SQL like

125

files.

126

However, because we have IDs too, which does not have an extension, you may be challenging for us

127

to understand what is the purpose of this file?

128

What are its functions?

129

How is it storing data?

130

So what we can do is to actually enter fall IDs to do so.

131

Over here we can look at fall IDs too.

132

So this is data and of course we can also try to download this particular fall and we can also try to

133

do a cat on it IDs too.

134

And we can say immediately that this is a sequel like format.

135

OK, so now we know that this is actually a sequel light fall.

136

So what we can do next is to actually go into SQLite itself and we can actually enter IDs too.

137

OK, so once we're in, we're able to view the content inside this particular database so we can enter,

138

for example, got tables.

139

All right.

140

So this will list all the tables that are actually in existence within this particular skill form.

141

All right.

142

So this is a light fall idea, too, so we can actually, for example, select all from my user and

143

remember to put a semicolon and immediately we can find out the username as well as the password.

144

All right.

145

So, again, this is another insecure way of storing data inside mobile applications.

146

And, of course, we can enter quitte to exit SQLite.

147

And, of course, moving forward onto part three in terms of insecure data storage activity.

148

So over here once again, because we were able to we were able to reverse engineer the mobile application

149

and we have our insecure data storage here.

150

We can actually look at the information.

151

So over here in this information, we actually have the creation of temporary file so we can see fall

152

that create 10 fall.

153

Now we have you in full Colmar top.

154

This is the instruction file writer.

155

Right?

156

So immediately we can find out all these different data.

157

So we have all these different data points.

158

So all we got to do is once again go back to Android phone and we can go to pottery.

159

I can click on pottery and I can enter the once again the username.

160

So in this case, Loy Yang Yang and I can enter the password again and once you have that running,

161

click safe.

162

All right.

163

So we have Tea Party credentials saved successfully.

164

So going back into command from where we have the ADB shell again, we can actually try to find out

165

where is this file so I can do a keg, I get it or else.

166

All right.

167

So immediately we can find out there is this you in full fall?

168

OK, we have this you in full fall.

169

I can enter L to give us more information about the disk to false.

170

So of course over here we have a zero eight twenty one.

171

So this was a file that was created yesterday and we have twenty two dash twenty two.

172

So this is the file this created today right now.

173

So I can actually do a cat you info.

174

All right.

175

And we have a couple of false options.

176

So we will select a latest one as part of the Turrill, which is starting from seven five seven and

177

go ahead and hit enter on that.

178

And once again, we're able to find this particular file storing all this data.

179

So another point that you can try it out on is as you enter your physical Android device or your mobile

180

phone into the computer, do search and try to locate all this kind of files, because some of these

181

mobile applications do not have secure coding practices and they may expose all this sensitive data

182

to the mobile device data storage.

183

So these are very, very dangerous operations and very insecure way of doing coding.

184

So going back into our platform, which is the final tutorial for today's class, is we have the insecure

185

data storage for activity class.

186

And one thing I want to highlight over here is this particular instruction.

187

So we have over here fall, fall, equal environment, don't get external storage directory.

188

All right.

189

So this is getting external storage directory.

190

So what you're doing is that you're going to store to fall into an external storage.

191

So in our case, the external storage is going to be an SD card.

192

OK, so with that in mind, of course, we also have the unfurl information again.

193

So what we can do is go back to the mobile device, click under insecure data storage platform, and

194

once again we can enter the party service username.

195

So in case I can enter once again, Loy Yang and I can enter the password.

196

And now with that we can go ahead and click safe.

197

So once I click save, we have the third party credentials so successfully so we manage to complete

198

construction.

199

So another tips or advice I can give you is about reading truly instructions.

200

So all this items have been executed all the way onto over here to party credentials save successfully

201

Deming's all the instructions before it is has actually completed successfully, which is why we're

202

able to see to it party credentials saved successfully.

203

So everything above it has been completed successfully.

204

All right.

205

And over here we can again go back into command prompt.

206

So over here we have the ATP shell running, which is a connection into the mobile device.

207

So once we have the connection, all we got to do now is KDDI into SD card.

208

So this is the absolute path that give us access straight into the external storage.

209

And I can enter URLs to list all the files and folders.

210

OK, so we of course, over here we have all this different data and information.

211

So we got alarms, we go download, we got music and so on, so forth so it can enter l a so OK, so

212

go ahead and enter on debt.

213

And what you see here is that we have a dot fall.

214

All right.

215

So and over here we only have one particular file.

216

The rest are all the rectories as you can see.

217

So we have a separate tutorial on Linux about Linux file navigation file system management.

218

So do check that all as well, especially if you're if you're new to Linux systems.

219

So we have a DOT you in for TI.

220

And of course this was just created r d twenty second of August and dot you info.

221

He's actually a hidden foe.

222

It's a way of hiding fall from users being able to access this kind of content.

223

So by entering more commands or more instructions, we'll be able to look into this particular file.

224

So remember to put a dash L.A. on it so that we can find all this hidden files as well.

225

All right.

226

So all we could do is enter Cat Dot you in full, thought he'd enter and debt.

227

And once again, we're able to find a username as well as the password.

228

So once again, I hope you have learned something valuable today as part of a mobile application penetration

229

testing.

230

So if you have any questions, feel free to put a comment below and I'll try my best to answer any of

231

your questions.

232

So I'll give them to, like, share and subscribe to the channel so that you can be kept abreast of

233

the latest cybersecurity.

234

Thank you so much once again for watching.