Hey, guys, welcome back to another episode on How to Hack.
So today we'll learn about reverse engineering, mobile application.
And what we can see over here is that on the left side, I have an Android emulator running.
So do go ahead and download Android studio.
And once you're an Android studio, you would have the ability to access the Android virtual device
manager.
So I have actually set up a video previously on this tutorial.
So do check that out.
So going back into the tutorial today, we can actually screw up.
And of course, there are a couple of applications that we are going to learn about mobile application
penetration testing.
So on the left side of the screen, which you have the emulator, we can click onto Devar.
And in the future, we will also be looking at for in terms of our mobile application hacking series
so I can go ahead and click on Devar.
And once we're in, we'll be presented with this particular homepage.
All right.
So this homepage will allow us the ability to learn about mobile application penetration testing so
we have insecure logging, hot coding issues in secure data storage, input, validation, access control
issues, as well as hot coding issues and invalid input validation issues again.
So all these are great ways for us to learn about mobile application hacking.
And of course, what we are going to learn today is about reverse engineering the application so as
to install applications into these mobile devices.
They usually come as an apk fall.
So once you have the app fall, what we need to do is to convert it into a G, a R fall.
And once you have done the conversion, we can actually view into how the data was actually being stored,
how they could have possibly written the code in which we can view, we can understand it, and after
which we can actually try to launch certain attacks against it because we're able to possibly find vulnerabilities
in association with the mobile application.
So moving forward, what I'm going to do now is I'm going to enter command from.
So once I go to command problem, I can actually see into the folder.
OK, so go ahead and download IDEX tools so the tools will come with the ability to help you do the
conversion.
So over here I can enter.
Ah, so this will list the directory of all the files and folders inside the working directory.
So in case, as mentioned earlier, we have a waps good right.
And we also have Devar that you're seeing on a screen on the left side right now.
So we have the APK fall.
So what are you going to do now is to use DTG and we can enter Decs to J.R..
And once you have the bat fall, so of course, we are running on a Windows 10 computer, we're running
on Linux deals, we have a dust hitch that you can use to do the conversion.
So over here, we have the bat fall.
And what are we going to do now is to input the APK fall to begin the instructions for the conversion.
OK, so over here, what I'm going to do now is to actually enter Devar Dash, Beta Dot.
APK So go ahead, enter in debt, so of course, we have already done the conversion before so I can
use a British force as part of the perimeter to actually go ahead and do the start the conversion so
I can hit enter on debt and it would take a while for it to complete a conversion.
So once we have done that, I can enter again and immediately we can see that we have Devar Dash beta
dash decks to J.R..
J.R., follow over here.
OK, so we got this fall running and all we got to do now is go back into the folder and you want to
open up the jade gooey.
So this allow us the ability to view default and I'm going to go back to the folder so we have the Devar
Desh beta decks to J.R..
J.R., I'm going to drag and drop it into the Java old compiler and immediately we can see all the different
information in relation to this apk.
So I'm going to use the magnifier so it's easier for you to see.
So of course, once we have to modify running, we can see that we have enjoyed that support and we
had Drakkar Awesome Diva.
So I can open that up and we can look at all the different classes, we can look at all the different
classes.
That is part of the mobile application.
All right.
So we can see all these different data.
And very quickly, for example, I can just demonstrate a really quick way of looking at how the code
looks like.
So over here, we have the following example.
So we have the package we have to import.
We have to populate class.
We have the public voit safe credentials, and we can see that you're saving data into the system.
OK, so for example, now I can close the magnifier because we now know how to reverse engineer the
mobile application and look into the source code.
So if I go back into the simulator and if I go into, for example, in secure data storage, part one
and I can enter, for example, the third party service username, say, for example, Arunta, Loy
Yang and I entered a password of one, two, three, four, five, six, seven, eight.
I click on Safe.
OK, so we have thirt party credentials saved successfully and I can go into command prompt OK, so
I can go back to command problem and I can do an ATV shell so that we can gain access into the mobile
application or the mobile phone so we can also do the same for any physical mobile devices.
So do go ahead and try that.
I have tried it before and it is working as intended.
OK, so because for tutorial purposes over a video screen cost of video sharing a recording, so we
are doing it as an emulator.
So going back here we can see the data data and we can enter URLs and we can CD into Jugg her.
So this is the mobile application folder and I get it or else a game so we can look at all these different
folders and directories and file.
So I can KDDI, for example, into shet preferences and I can add or else and here we have an XML fall
so I can enter a and we can look at the timing of this particular file.
We can look at the information of this particular file and we can see when this particular item was
being saved, when this item was actually being accessed, what was the item that was inside this particular
file?
So all I'm going to do is, for example, enter Cat Jacare to this particular file.
I can hit enter on that and we immediately will be able to find out the string password as well as the
string name user.
And of course, we can see the information that we can earlier.
And if I go back into the code, we can find out all this data.
So we got user with a password.
So if I go back to command, prompt user and password, once again, we were able to see those items.
They are being recorded inside the system.
And moving forward is part of the tutorial, we can also look into insecure data storage, too.
So once again, now that we learn about reverse engineering mobile applications, we can look into the
data over here.
So in this case, by observing the source code, we can see that there is a private school like Database
MDB.
So open a create database IDs to create table, if not exist.
And of course, you can also try to do a lock in terms of recreational currents.
And we can look into insert into my users so we can see that they are using some kind of sequel Quarrie.
So we have done a number of tutorials about sequel injection and so on.
So in our case, a lot of applications may also be using a lot of applications, may also be using SQLite
as part of storing data into the mobile device.
So in our case, of course, from what we're seeing here, based on a source code, we are definitely
seeing that.
All right.
So what we will do now is we can actually go back into the Android phone, OK?
And we can click on to part two.
So, again, this is a wonderful application for us to learn all about mobile application penetration
testing.
So in my case, I can enter, for example, against username Loy Yang Kyung and I can enter the password
and I can go ahead and click safe.
So we now have the party credentials saved successfully so I can go back into once again command prompt,
OK, I can go back into the top folder and can enter URLs and we can go into, for example, KDDI databases
and can enter LFS again to look at all the files and folders.
So in our case we can see over here we have IDs to make sure we have IDs too.
So for example, in our case we may have a challenge trying to understand what kind of fall time it
is, because over here we have Devar Notes DB so DOT DB is actually a way for us to view into SQL like
files.
However, because we have IDs too, which does not have an extension, you may be challenging for us
to understand what is the purpose of this file?
What are its functions?
How is it storing data?
So what we can do is to actually enter fall IDs to do so.
Over here we can look at fall IDs too.
So this is data and of course we can also try to download this particular fall and we can also try to
do a cat on it IDs too.
And we can say immediately that this is a sequel like format.
OK, so now we know that this is actually a sequel light fall.
So what we can do next is to actually go into SQLite itself and we can actually enter IDs too.
OK, so once we're in, we're able to view the content inside this particular database so we can enter,
for example, got tables.
All right.
So this will list all the tables that are actually in existence within this particular skill form.
All right.
So this is a light fall idea, too, so we can actually, for example, select all from my user and
remember to put a semicolon and immediately we can find out the username as well as the password.
All right.
So, again, this is another insecure way of storing data inside mobile applications.
And, of course, we can enter quitte to exit SQLite.
And, of course, moving forward onto part three in terms of insecure data storage activity.
So over here once again, because we were able to we were able to reverse engineer the mobile application
and we have our insecure data storage here.
We can actually look at the information.
So over here in this information, we actually have the creation of temporary file so we can see fall
that create 10 fall.
Now we have you in full Colmar top.
This is the instruction file writer.
Right?
So immediately we can find out all these different data.
So we have all these different data points.
So all we got to do is once again go back to Android phone and we can go to pottery.
I can click on pottery and I can enter the once again the username.
So in this case, Loy Yang Yang and I can enter the password again and once you have that running,
click safe.
All right.
So we have Tea Party credentials saved successfully.
So going back into command from where we have the ADB shell again, we can actually try to find out
where is this file so I can do a keg, I get it or else.
All right.
So immediately we can find out there is this you in full fall?
OK, we have this you in full fall.
I can enter L to give us more information about the disk to false.
So of course over here we have a zero eight twenty one.
So this was a file that was created yesterday and we have twenty two dash twenty two.
So this is the file this created today right now.
So I can actually do a cat you info.
All right.
And we have a couple of false options.
So we will select a latest one as part of the Turrill, which is starting from seven five seven and
go ahead and hit enter on that.
And once again, we're able to find this particular file storing all this data.
So another point that you can try it out on is as you enter your physical Android device or your mobile
phone into the computer, do search and try to locate all this kind of files, because some of these
mobile applications do not have secure coding practices and they may expose all this sensitive data
to the mobile device data storage.
So these are very, very dangerous operations and very insecure way of doing coding.
So going back into our platform, which is the final tutorial for today's class, is we have the insecure
data storage for activity class.
And one thing I want to highlight over here is this particular instruction.
So we have over here fall, fall, equal environment, don't get external storage directory.
All right.
So this is getting external storage directory.
So what you're doing is that you're going to store to fall into an external storage.
So in our case, the external storage is going to be an SD card.
OK, so with that in mind, of course, we also have the unfurl information again.
So what we can do is go back to the mobile device, click under insecure data storage platform, and
once again we can enter the party service username.
So in case I can enter once again, Loy Yang and I can enter the password.
And now with that we can go ahead and click safe.
So once I click save, we have the third party credentials so successfully so we manage to complete
construction.
So another tips or advice I can give you is about reading truly instructions.
So all this items have been executed all the way onto over here to party credentials save successfully
Deming's all the instructions before it is has actually completed successfully, which is why we're
able to see to it party credentials saved successfully.
So everything above it has been completed successfully.
All right.
And over here we can again go back into command prompt.
So over here we have the ATP shell running, which is a connection into the mobile device.
So once we have the connection, all we got to do now is KDDI into SD card.
So this is the absolute path that give us access straight into the external storage.
And I can enter URLs to list all the files and folders.
OK, so we of course, over here we have all this different data and information.
So we got alarms, we go download, we got music and so on, so forth so it can enter l a so OK, so
go ahead and enter on debt.
And what you see here is that we have a dot fall.
All right.
So and over here we only have one particular file.
The rest are all the rectories as you can see.
So we have a separate tutorial on Linux about Linux file navigation file system management.
So do check that all as well, especially if you're if you're new to Linux systems.
So we have a DOT you in for TI.
And of course this was just created r d twenty second of August and dot you info.
He's actually a hidden foe.
It's a way of hiding fall from users being able to access this kind of content.
So by entering more commands or more instructions, we'll be able to look into this particular file.
So remember to put a dash L.A. on it so that we can find all this hidden files as well.
All right.
So all we could do is enter Cat Dot you in full, thought he'd enter and debt.
And once again, we're able to find a username as well as the password.
So once again, I hope you have learned something valuable today as part of a mobile application penetration
testing.
So if you have any questions, feel free to put a comment below and I'll try my best to answer any of
your questions.
So I'll give them to, like, share and subscribe to the channel so that you can be kept abreast of
the latest cybersecurity.
Thank you so much once again for watching.