Mobile Application Pentesting- Part 2

Piyush Patil
May 17, 2019 · 5 min read

Hardcoding issues

Part -1

This is an important vulnerability because using reverse engineering it would be possible to see that sensitive information. Examples could be access keys, passwords, etc …

Let’s try entering any random string just to see if it allows access or not.

How to download apk from installed application in mobile phone?

adb shell ps | grep -i appname =>get package name

adb shel pm path package_name

adb pull mobile_app_path .

. means downloading mobile app to current directory

mv base.apk diva.apk

Apktool

apktool d diva.apk -o diva

d=>decompile

Now where to look for java code files?

Let’s ask AndroidManifest.xml

AndroidManifest.xml contains

-Specifies properties of the application

-Package Name

-Activities, Services, Broadcast, Receievers etc

-Permissions definitions and usage

-Info on external Libraries

  • Shared UID

The AndroidManifest.xml file tells that the package of the application is jakhar.assem.diva

Going inside the package:-

Once reached to the inner folder /smali/jakhar/aseem/diva, there is the Java source code of all the activities used by the application

Here you can see HardcodeActivity.smali

But smali is hard to understand as compared to java.

Lets try to decompile app and get all code in .java format instead of .smali

JADX

./jadx application.apk -d outputfolder

There will be so many warnings and errors but don’t worry, it doesn’t matter.

cd diva

cd sources/jakhar/aseem/diva

cat HardcodeActivity.java


Hardcoding Issues

Part -2 (Shared Object Files/Libraries)

Let’s try any random vendor key

cd sources/jakhar/aseem/diva

cat Hardcode2Activity.java

In the above image, you can see it created the object of DivaJni class

The access method gets a text using JNI and checks whether the text entered by the user matches or not the valid key.

What is JNI?

Android Native Library

Google develops the Android Native Development Kit (NDK) beside Android SDK. The purpose of NDK is helping developers to build libraries in C or C++. Some of the benefits of using native libraries are:

-Using Native Activities

-Access physical device components like sensors

-Reusing old C or C++ code in Android application

-Building extra fast application when you need high computational features

When the native library built, The Java Native Interface (JNI) handles the communication between the native library and java based code.

Now let’s check the code of class DivaJni.java

cat DivaJni.java

From above code, it is clear that a native library called “soName” is loaded. Libraries will come with the APK file, and they are usually located within the “lib” directory.

Open the apk extracted folder which we did using apktool.

ls * =>list out all the files within each directory.

There are different library files based on architectures. Try to open any one of them .

cat x86/libdivajni.so

We can run strings command on lib file, but then it will be difficult to find access code.

Lets try another way

objdump -s -j .rodata libdivajni.so

.rodata segment=>stores read only data and constant data of the program


Insecure Data Storage

Part -1

Storing important data like password and credit card number needs a secure mechanism. Ordinarily, Developers use file, database or saved setting to store these kinds of data. This works on the website, server-based application and sometimes on mobile application but not always. Suppose another application has root access to the device, the application can read every file or database in the device including sensitive data.

Let’s enter the username as piyush and password as patil.

cat InsecureDataStorage1Activity.java

As the code shows, DIVA uses PreferenceManager to save plain sensitive data. Preferences is an Android lightweight mechanism to store and retrieve pairs of primitive data types (also called Maps, and Associative Arrays).

PreferenceManager saves data in a XML file located in application path. Any application that has a root access can read those sensitive data.

/data/data/<APPLICATION NAME>/shared_prefs/*.xml

adb shell su

cd /data/data/jakhar.aseem.diva/shared_prefs

Piyush Patil

Written by

Reverse Engineering, Penetration Testing( Web, Mobile, IoT, Network, Infra)

Welcome to a place where words matter. On Medium, smart voices and original ideas take center stage - with no ads in sight. Watch
Follow all the topics you care about, and we’ll deliver the best stories for you to your homepage and inbox. Explore
Get unlimited access to the best stories on Medium — and support writers while you’re at it. Just $5/month. Upgrade