Mobile Penetration Testing - Android


Testing Environment

Android Emulator

Android Debug Bridge (ADB)
C:\Users\<User>\AppData\Local\Android\Sdk\platform-tools
adb -s <specific device> shell #Specific Device
adb -d shell #Device
adb -e shell #Emulator

Basic ADB command
adb install <apk file>
adb pull <location> 
adb push <file> <location>


Basic Linux command 

cat /proc/version #Kernel version
cat /proc/cpuinfo #Processor Information
ps #Processes

cat /system/etc/permissions/platform.xml #Permission and GID

Information Gathering

Retrieve APK file from Device (Recommended)

adb shell
pm list packages
pm path <package>
adb pull <apk path>

Retrieve APK file from Internet



To check the certificate information
keytool -printcert -file CERT.RSA #C:\Program Files\Java\jre1.8.0_131\bin\keytool.exe

Android Manifest Analysis

1. Activity, Service, Content Provider, Broadcast Receiver are not exported

cat AndroidManifest.xml | grep "<activity\|<provider\|<receiver\|<service" | grep -v "android:exported=\"false\"" | grep "android:name" --color


am start -n <package name>/<activity name>
content query -–uri <URI>


Recommended Value:
android:debuggable="false"
android:allowBackup="false"
android:exported="false"

Reverse Engineering

APK file is just a package for application files


APKTool

apktool d <apk file>



After decompile application using APKTool, we can analyse AndroidManifest.xml file manually

Code Tampering

Before Code Tampering:


After Code Tampering:

change the value of is_admin to "yes"

Compile the application back to APK format

Modified APK cannot be installed into the device unless signed *

Create user button is appeared for admin!

Dex2Jar

d2j-dex2jar <apk file>

A jar file is created after the execution of command dex2jar
The JAR file can be open by JD-GUI

Penetration Testing

Insecure Data Storage

adb shell
cd data/data
ls | grep <keyword>
cd <package name>
find
grep -ir <keyword in file> /

Checking data storage for database, shared preference and internal storage


To download folder and files for analysis 


adb pull <data folder>


SQL file can be open using DB Browser for SQLite

Shared Preference can be open by using any text editor


Automating Android Penetration Testing

Drozer *

Turn on Drozer agent in testing device


Run drozer server in workstation

adb forward tcp:31415 tcp:31415
drozer.bat console connect



Selecting the targeted application and perform initial analysis 

run app.package.list
run app.package.list -f <keyword>
run app.package.info -a <package name>
run app.package.attacksurface <package name>


Attacking exported activities

run app.activity.info -a <package name>
run app.activity.start --component <package name> <activity name>


APICredsActivity accessed directly

Attacking exported content provider

run app.provider.info -a <package name>
run scanner.provider.finduris -a  <package name>
run app.provider.query <URI>



Inserting data into content provider

run app.provider.insert <URI> --<data type> <column name> <value>


Mobile Security Framework (MobSF) *

python manage.py runserver



Browse http://127.0.0.1:8000 and upload APK file
Scan result from MobSF

Permission granted to the application

Manifest and Code issue detected

Java source code
URL detected in the source code




Android Security

Permission
https://www.kaspersky.com/blog/android-permissions-guide/14014/

 10 tips for maximum security
https://www.kaspersky.com/blog/android-maximum-security-tips/6579/


Obfuscate Android Code

build.gradle
android {
    buildTypes {
        release {
            minifyEnabled true
            proguardFiles getDefaultProguardFile('proguard-android.txt'), 'proguard-rules.pro'
        }
        debug {
            minifyEnabled true
            proguardFiles getDefaultProguardFile('proguard-android.txt'), 'proguard-rules.pro'
        }

    }
}


proguard-rules.pro
-dontwarn android.support.v7.**
-keep class android.support.v7.internal.** { *; }
-keep interface android.support.v7.internal.** { *; }
-keep class android.support.v7.** { *; }
Reference:
https://developer.android.com/topic/security/best-practices.html

Popular posts from this blog

Remote Desktop Protocol (RDP) Security

Image
Common Remote Desktop Protocol (RDP) Vulnerabilities Terminal Services Encryption Level is Medium or Low Microsoft Windows Remote Desktop Protocol Server Man-in-the-Middle Weakness Terminal Services Doesn't Use Network Level Authentication (NLA) Only Terminal Services Encryption Level is Medium or Low Vulnerability Assessment: Host Assessment: Remediation: Local Computer Policy/Computer Configuration/Administrative Templates/Windows Components/Remote Desktop Services/Remote Desktop Session Host/Security/Set client connection encryption level Set client connection encryption level to High Note: High: The High setting encrypts data sent from the client to the server and from the server to the client by using strong 128-bit encryption. Use this encryption level in environments that contain only 128-bit clients (for example, clients that run Remote Desktop Connection). Clients that do not support this encryption level cannot connect to RD Se
Read more

Penetration Testing - Network

Image
Manual Vulnerability Assessment TCP/21: FTP Anonymous FTP Enabled anonymous guest TCP/22: SSH nmap -p 22 --script ssh2-enum-algos <ip_address> SSH Weak Algorithms Supported SSH Server CBC Mode Ciphers Enabled ssh -oCiphers=<ciphers> <ip_address> SSH Weak MAC Algorithms Enabled ssh -oMACs=<algorithm> <ip_address> SSH Protocol v1 Supported ssh -1 <ip_address> -v Hardening on SSH Ciphers aes256-ctr,aes192-ctr,aes128-ctr MACs hmac-sha2-512-etm@openssh.com,hmac-sha2-256-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-512,hmac-sha2-256,umac-128@openssh.com TCP/23: Telnet Unencrypted Telnet Server telnet <ip_address> 23 TCP/25: SMTP SMTP Service Cleartext Login Permitted telnet <ip_address> 25 EHLO <ip_address> AUTH LOGIN Mailserver answer to VRFY and EXPN requests * nc <ip_address> 25 EXPN root VRFY root TCP/53: DNS DNS Server Cache Snooping Remote Information Disclosure
Read more

Damn Vulnerable Web Services (DVWS) - Walkthrough

Image
Installation Damn Vulnerable Web Services  (DVWS) is an insecure web application with multiple vulnerable web service components that can be used to learn real world web service vulnerabilities. https://github.com/snoopysecurity/dvws WSDL Enumeration Spider DVWS using Burp Suite and look for service.php Requests processed by SOAP service include  check_user_information ,  owasp_apitop10 ,  population  and  return_price XPATH Injection User Login: 1' or '1'='1 User Password: 1' or '1'='1 Command Injection Original Request parameter value of name is " find "   by default  Edited Request change the parameter value of  name  from "find" to " dir "   Cross Site Tracing (XST) Hint of " The NuSOAP Library service is vulnerable to a Cross-site scripting flaw " is given by DVWS. Exploit is published at exploit DB ( https://www.exploit-db.com/e
Read more

Offensive Security Testing Guide

Image
This cheat sheet is the compilation of commands we learnt to exploit the vulnerable machines. The commands below may not be enough for you to obtain your Offensive Security Certified Professional (OSCP). So... Try Harder! Information Gathering Operating System Windows Interesting Path "Documents and Settings"/Administrator/Desktop file:///C:/xampp/readme_en.txt file:///C:/xampp/passwords.txt file:///C:/xampp/webdav/webdav.txt file:///C:/xampp/apache/conf/extra/httpd-dav.conf file:///C:/xampp/apache/conf/extra/httpd-xampp.conf file:///C:/xampp/apache/logs/access.log file:///C:/xampp/apache/logs/error.log file:///C:/xampp/security/webdav.htpasswd file:///C:/xampp/htdocs/dashboard/phpinfo.php file:///C:/xampp/phpmyadmin/config.inc.php file:///C:/xampp/php/logs/php_error_log file:///C:/xampp/mysql/bin/my.ini C:\Users\<User>\AppData\Local\Temp #Email Address C:\Users\<User>\AppData\Local\Microsoft\Outlook Active Connection netstat -anob #R
Read more

Server Message Block (SMB) Security

Image
Common SMB related vulnerabilities Microsoft Windows SMBv1 Multiple Vulnerabilities SMB Signing Disabled Microsoft Windows SMB NULL Session Authentication Microsoft Windows SMB Shares Unprivileged Access Network Discovery: TCP port 5357 - Web Services on Devices API (WSDAPI) File and Printer Sharing: TCP port 135 - Remote Procedure Call (RPC) TCP port 139 - NETBIOS Session Service TCP port 445 - Server Message Block (SMB) By disable NetBIOS over TCP/IP (TCP Port 139), NETBIOS name discovery will be prevented Microsoft Windows SMBv1 Multiple Vulnerabilities Vulnerability Assessment: NSE script smb-protocols can be used to check if the server supported NT LM 0.12 (SMBv1) . Host Assessment: Get-ItemProperty HKLM:\SYSTEM\CurrentControlSet\Services\LanmanServer\Parameters | ForEach-Object {Get-ItemProperty $_.pspath} Remediation: Set-ItemProperty -Path "HKLM:\SYSTEM\CurrentControlSet\Services\LanmanServer\Parameters
Read more

Host Configuration Assessment - Windows

Image
OS Information Gathering systeminfo wmic computersystem get domainrole 0 - Standalone workstation 1 - Member workstation 2 - Standalone server 3 - Member server 4 - Domain controller secedit /export /cfg cfg.ini > nul net user administrator > netuseradmin.txt auditpol.exe /get /category:* > auditpol.txt netsh advfirewall show allprofiles > firewall.txt net accounts > netaccount.txt gpresult /f /h evid/gporesult.html > nul accesschk /accepteula -q -a * > accesschk.txt *Simplify the process with Scgary ! User Right Assignment type cfg.ini | grep "^SeAuditPrivilege\|^SeCreatePagefilePrivilege\|^SeRemoteShutdownPrivilege\|^SeRemoteInteractiveLogonRight\|^SeEnableDelegationPrivilege\|^SeLockMemoryPrivilege\|^SeDenyNetworkLogonRight\|^SeChangeNotifyPrivilege\|^SeDebugPrivilege\|^SeDenyBatchLogonRight\|^SeCreateGlobalPrivilege\|^SeShutdownPrivilege\|^SeIncreaseQuotaPrivilege\|^SeTrustedCredManAccessPrivilege\|^SeDenyInteractiveLogonRight
Read more