Original subtitles

1

Hey, guys, welcome back to another episode on How to Hack.

2

So today we'll be discussing and learning about mobile application security, so otherwise could be

3

called as mobile application penetration testing.

4

So we're testing the mobile application that our install into your phone.

5

So over here in our case, we actually have a mobile phone running on the left side.

6

So this is an Android device being followed up by Android studio.

7

And on the right side, we have command from running and of course, in command prompt.

8

We want to learn about Android debark breech.

9

So we have a full tutorial on that that you can check out as part of a YouTube channel to go ahead and

10

subscribe to the channel so that you can learn all about cyber security.

11

So moving back to the tutorial, we can enter, for example, EDB for mobile devices.

12

So this will isdell all the devices that are attached to your computer, whether they are attached to

13

USB emulation or even wirelessly.

14

So we can see all the devices that are connected to your EDB.

15

And on the left side, I actually have an mobile device running and we actually have an application

16

called Deiva.

17

So if I scroll up and I go into this particular application over here, I can open it up and we actually

18

have the application and this is a vulnerable mobile application that we can do our vulnerability analysis

19

on, that we can do our penetration testing on.

20

So this is a wonderful way for us to learn about mobile application security and how we can secure this

21

data.

22

So what we're going to learn over here as we review through the data, we have insecure logging, hot

23

coding issues in secure data storage and so on and so forth, including input validation series.

24

And we can actually look at, for example, in secure data storage.

25

So the whole idea about this insecure data storage lies with one of the problems of how data is being

26

stored inside the mobile device, truly mobile application.

27

And one of those issues is that a lot of this mobile application stores data in plain text, in clear

28

text inside the storage device.

29

So as a result of that, whoever has access into the mobile applications storage will have the ability

30

to actually view all those data.

31

All right.

32

So, for example, over here, I can enter the third party service username.

33

I can enter tests, for example, and I can click on the third party service password.

34

So you can think of this like logging in to your banking app.

35

You can think of this like logging into the e-commerce mobile application you have.

36

So in some sense, when you have the same login, they would actually have to see your password somewhere.

37

I'll be able to save some kind of token inside your device in order to inject that back into the application

38

authentication server.

39

So as a result of that, when you click save, we have that data being saved.

40

So we have the credential being safe inside the system.

41

And when I go back into the Android box breach.

42

So, for example, if I enter the following, I can enter EDB full of my shell.

43

So this would give us access into the system so I can enter, for example, who am I?

44

So we are looking at Unix or Linux commands so I can actually exit on this so I can enter route.

45

Do we start as route OK and we can enter EDB Shell again and we can enter.

46

Who am I.

47

So in this case we are now accessing the Android device as route and we can try to examine what kind

48

of data they are.

49

So I can KDDI into slash data, slash data, enter URLs so we can actually see all the information over

50

here, so we can see all the applications.

51

So one particular folder stands out.

52

So that is actually on there, over here.

53

So let me just bring up the command prompt for you so we can see over here we have Chunka assume, Devah,

54

so we can see into Jaka assim devah hit enter on debt and PTR else again and we can see all the information

55

regarding the directory.

56

So we have all four different directories.

57

We have cache code cache databases, we have the data app.

58

OK, so we can actually look at all this information.

59

We have share preferences so we can actually tried to KDDI, for example, in shet preference hit enter

60

on debt and through less special a to do a listing and we can see that there is an XML file.

61

So what happened is that a lot of mobile application could be storing those data in XML format or Ezekial

62

Light.

63

So Ezekial, I will do that as a separate tutorial in the future about how we can examine those data.

64

So over here we have an XML fall and all you got to do is do a cat to read a particular file hit.

65

Enter on that and we can immediately.

66

Find out the information of the string name.

67

OK, so we have the password and we have the user and both of these was tests.

68

So we actually entered Tess and Tess for our string password as well as string user.

69

So immediately we can retrieve those data inside of storage of the mobile device.

70

So very quickly we could actually view and access a lot of those critical data, personal information

71

inside the mobile device.

72

So moving forward, I can actually do a changed directory back then.

73

I can CD into databases and I can enter again and we can see all this different information here.

74

So we have Devar notes, we have dot DB Desh S M Dash, WHL IDs too, and all these different data.

75

So the question to ask is, are we able to budos information?

76

So can we do a Cat Vigano study?

77

What can we see from those results?

78

What about deaths as heat and turn that?

79

What about Desh WHL?

80

What kind of data can we find?

81

And over here, OK, over here we can see we have some information.

82

We have exercise, alternate days running expense, spent too much on home theater, holiday idogawa

83

or MSM.

84

So we realize this.

85

We have not actually log in into the mobile application yet.

86

We are also able to view those data inside the mobile application of those data that are used by the

87

mobile application to provide information and update through the mobile application.

88

OK, so with that, we have come to the end of today's tutorial and I hope that you've learned something

89

valuable.

90

So if you have any questions, we have to leave a comment below and I'll try my best to answer any of

91

your questions submitted like subscribe to the channel so that you can be kept abreast of the latest

92

cybersecurity.

93

Thank you so much once again for watching.