Mobile Application Pentesting- Part 2

Hardcoding issues
Part -1

This is an important vulnerability because using reverse engineering it would be possible to see that sensitive information. Examples could be access keys, passwords, etc …
Let’s try entering any random string just to see if it allows access or not.

How to download apk from installed application in mobile phone?
adb shell ps | grep -i appname =>get package name
adb shel pm path package_name
adb pull mobile_app_path .
. means downloading mobile app to current directory
mv base.apk diva.apk
Apktool
apktool d diva.apk -o diva
d=>decompile
Now where to look for java code files?
Let’s ask AndroidManifest.xml
AndroidManifest.xml contains
-Specifies properties of the application
-Package Name
-Activities, Services, Broadcast, Receievers etc
-Permissions definitions and usage
-Info on external Libraries
- Shared UID
The AndroidManifest.xml file tells that the package of the application is jakhar.assem.diva
Going inside the package:-
Once reached to the inner folder /smali/jakhar/aseem/diva, there is the Java source code of all the activities used by the application
Here you can see HardcodeActivity.smali
But smali is hard to understand as compared to java.
Lets try to decompile app and get all code in .java format instead of .smali
JADX
./jadx application.apk -d outputfolder
There will be so many warnings and errors but don’t worry, it doesn’t matter.
cd diva
cd sources/jakhar/aseem/diva
cat HardcodeActivity.java

Hardcoding Issues
Part -2 (Shared Object Files/Libraries)

Let’s try any random vendor key

cd sources/jakhar/aseem/diva
cat Hardcode2Activity.java
In the above image, you can see it created the object of DivaJni class
The access method gets a text using JNI and checks whether the text entered by the user matches or not the valid key.
What is JNI?
Android Native Library
Google develops the Android Native Development Kit (NDK) beside Android SDK. The purpose of NDK is helping developers to build libraries in C or C++. Some of the benefits of using native libraries are:
-Using Native Activities
-Access physical device components like sensors
-Reusing old C or C++ code in Android application
-Building extra fast application when you need high computational features
When the native library built, The Java Native Interface (JNI) handles the communication between the native library and java based code.
Now let’s check the code of class DivaJni.java
cat DivaJni.java
From above code, it is clear that a native library called “soName” is loaded. Libraries will come with the APK file, and they are usually located within the “lib” directory.
Open the apk extracted folder which we did using apktool.
ls * =>list out all the files within each directory.
There are different library files based on architectures. Try to open any one of them .
cat x86/libdivajni.so
We can run strings command on lib file, but then it will be difficult to find access code.
Lets try another way
objdump -s -j .rodata libdivajni.so
.rodata segment=>stores read only data and constant data of the program

Insecure Data Storage
Part -1

Storing important data like password and credit card number needs a secure mechanism. Ordinarily, Developers use file, database or saved setting to store these kinds of data. This works on the website, server-based application and sometimes on mobile application but not always. Suppose another application has root access to the device, the application can read every file or database in the device including sensitive data.
Let’s enter the username as piyush and password as patil.

cat InsecureDataStorage1Activity.java
As the code shows, DIVA uses PreferenceManager to save plain sensitive data. Preferences is an Android lightweight mechanism to store and retrieve pairs of primitive data types (also called Maps, and Associative Arrays).
PreferenceManager saves data in a XML file located in application path. Any application that has a root access can read those sensitive data.
/data/data/<APPLICATION NAME>/shared_prefs/*.xml
adb shell su
cd /data/data/jakhar.aseem.diva/shared_prefs
