Android Pentesting: Writeup of DIVA Insecure Data Storage for Parrot OS
Tags: tutorial, android, cybersecurity, pentesting
Published: 2022-05-26 14:46:38

If you've read my previous [writeup](https://dev.to/christinecdev/android-pentesting-writeup-for-the-diva-insecure-logging-and-hardcoding-issues-for-parrot-os-1mo1) where I covered Logging and Hardcoding Issues (1 & 2) on the DIVA APK, then get ready for the next one. I hope you have your tools open, because today we are going to find all the Insecure Data Storage vulnerabilities in the DIVA APK!😁

So the DIVA APK has four sections to test for Insecure Data Storage. [Insecure Data Storage](https://owasp.org/www-project-mobile-top-10/2016-risks/m2-insecure-data-storage) vulnerabilities occur when programmers assume that users, malware, or attackers will not have access to a mobile device’s filesystems and sensitive information that is stored on the device or APK. The problem arises when filesystems are easily accessible. Attackers, or us in this case, can root or jailbreak mobile devices or APK's and view application data - ultimately, sensitive application data.

Without any further lollygagging, let's jump into it!
![1](https://media.giphy.com/media/0DYipdNqJ5n4GYATKL/giphy.gif)

##<u> Insecure Data Storage - Part 1</u>
When we open the Insecure Data Storage - Part 1 section we are met with the following objective: find out where/how the credentials are being stored and the vulnerable code. So, we are expected to find where the credentials are being stored, how it is stored, and the vulnerable code.
![2](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/ngz7juqa5m4lmzmnyt16.png)

Let's first start with inserting information into the form. We get a popup saying that our credentials has been saved,and that's about it. Not much to it, so let's see if we can find where it saved our credentials.
![3](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/w4d4h533odjs7bv527z9.png)

Let's go ahead and pen up JADX-GUI and navigate over to the **InsecureDataStorage1Activity**. From here we can see that our data is being stored in a [SharedPreferences](https://developer.android.com/reference/android/content/SharedPreferences) object. A SharedPreferences object points to a file that contains key-value pairs and provides simple methods to read and write them. Each SharedPreferences file is managed by the framework and can be private or shared. A simple example of using a SharedPreference object is saving the user's preferred background color for the application.
![4](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/zeesmtqdmtmzzmaunwhr.png) ![5](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/vwz46v2ya6c6jz819r32.png)

Usually, the SharedPreference file will be saved under **../data/data/name.company.com/shared_prefs/..** and to access or view this SharedPreference file I will show you two methods: how to access it in Android Studio, and how to access it via the terminal.

### Method One: Android Studio
Open up Android Studio and select the Device Manager bar on the right-side of your window. Then head into the File Explorer and navigate to the following file (**data > data > jakhar.aseem.diva > shared_prefs > jakhar.aseem.diva_preferences.xml**)
![6](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/dwb8phcf9fgu26htu71y.png) ![7](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/a4dj2y9dkmh1yi2pu4gz.png)
 
Double click on **jakhar.aseem.diva_preferences.xml**, and voila, we have access to the data via Android Studio!
![1](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/shj9nmb3ckt1xn5bvq3o.png)

### Method Two: Terminal
Open up your terminal via CTRL + ALT + T and start a adb shell via the **adb shell** command. ADB Shell will allow us to access the device's files and manipulate the device via the terminal. We need to get super-user access, which is ultimate Darth Vader access, by entering to **su** command. 

![1](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/2tywwk6wyvb7u88n6ndi.png)

Let's go ahead and list our files on the device via the ls command, and from here on we can navigate to the directory as we did in Android Studio:
```
cd data
cd data
cd jakhar.aseem.diva
cd shared_prefs
```
![1](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/0mqnj3uvu0z05elzfd5i.png) ![1](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/7pgspz9w1auwtn8chhm2.png)...![1](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/8cqii9rys92j02rco8em.png) ![1](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/j11zlojo1zbwn03cknul.png)
  
Finally, we can read the data by entering the **cat jakhar.aseem.diva_preferences.xml** command. And we're done! 

![1](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/qxiy2t0iezoxkgn6gc75.png)
 
**<u>So, in summary, we were able to find the following:</u>**
- **Where**: shared_prefs > jakhar.aseem.diva_preferences.xml
- **How**: SharedPreferences() object

##<u> Insecure Data Storage - Part 2</u>
When we open the Insecure Data Storage - Part 2 section we are met with the following objective: find out where/how the credentials are being stored and the vulnerable code. So, we are expected to find where the credentials are being stored, how it is stored, and the vulnerable code.
![1](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/tyncprj3sbz3u8m6thtc.png)

Let's first start with inserting information into the form. We get a popup saying that our credentials has been saved,and that's about it. Again, not much to it, so let's see if we can find where it saved our credentials.
![1](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/rtoh9oazeavhnwv62ggb.png)
 
Open up JADX-GUI and navigate over to the **InsecureDataStorage2Activity**. From here we can see that our data is being stored in a [SQLiteDatabase](https://developer.android.com/reference/android/database/sqlite/SQLiteDatabase) object - so we will be looking for a database file!
![1](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/2hy44l7fjthmdbd7v52h.png)![1](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/6lzhnfmlkm9f4uk6mmys.png)

Usually, the SQLiteDatabase database files will be saved under **../data/data/name.company.com/databases/..** and to access or view this database file I will show you two methods: how to access it in Android Studio, and how to access it via the terminal.

### Method One: Android Studio
Open up Android Studio and select the Device Manager bar on the right-side of your window. Then head into the File Explorer and navigate to the following file (**data > data > jakhar.aseem.diva > databases**). From here we can see numerous database files, but just looking at the name we can deduce that "ids2" (id) will be more valuable to look at than "diva notes". So, let's have a look at **ids2**.
![1](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/u1qndzbv28qj2jgq4ib6.png)![1](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/viyy6buergwq9x2ttc94.png)
  
Right click and **save ids2** to a place on your desktop that you feel comfortable with. Once saved, open up your browser and head over to [SQLite Viewer](https://inloop.github.io/sqlite-viewer/) so that we can view the contents of our database. Pop in your ids2 file. We can see that there are two tables. 
![1](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/mg5xa6fx2ct56kuj7a0s.png)

Let's open the **myuser** table. We can now see our credentials! 
![1](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/e9nsph1k652ky80n0xp2.png)

### Method Two: Terminal
Open up your terminal via CTRL + ALT + T and start a adb shell via the **adb shell** command. From there on we can go:
```
su
cd data
cd data
cd jakhar.aseem.diva
cd databases 
```
![1](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/xlqxxtisks99etm0208e.png)
  
When we list the files in our databases directory, we can see that the **ids2** file is there. To read it, we need to first enter the **qlite3** command (_enter it by typing sql and hit TAB and enter_). 
![1](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/wohf0lt8jky3lqo0c8gi.png)![1](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/mh8s600rdxxzfjmebkxh.png)
 
From there on we need to open up the ids2 database file via the **.open ids2** command. If we list all the tables via the **.tables** command we can see that myuser is one of them. We can then "cd" into the myuser tables via the **.tables myuser** command.
![1](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/2hozavwx9ca898gnv8ir.png)

To read the contents of the myuser table, we can simply say **.dump myuser**, and congrats, you've successfully cracked that bad boy open! 😎
![1](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/bgaypt0fqlho0vkb68yy.png)
 
**<u>So, in summary, we were able to find the following:</u>**
- **Where**: databases > ids2
- **How**: SQLiteDatabase mDB

##<u> Insecure Data Storage - Part 3</u>
When we open the Insecure Data Storage - Part 3 section we are met with the following objective: find out where/how the credentials are being stored and the vulnerable code. So, we are expected to find where the credentials are being stored, how it is stored, and the vulnerable code.

![1](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/h7yyzy35xcbyoqdtng1i.png)

Let's first start with inserting information into the form. We get a popup saying that our credentials has been saved,and that's about it. Again, not much to it, so let's see if we can find where it saved our credentials.

![1](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/otxqqiiqud04fhpve5v8.png)
 
Open up JADX-GUI and navigate over to the **InsecureDataStorage3Activity**. From here we can see that our data is being stored in a [FileWriter](https://developer.android.com/reference/java/io/FileWriter) object that is being stored as **uinfotmp** - so we are looking for a file with a (tmp) ending.
![1](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/ohkssj9b606x5xxd4e98.png)![1](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/uk3svkscotl72iv4uzv8.png)

The FileWriter tmp file will be saved under **../data/data/name.company.com/..** and to access or view this uinfo file I will show you two methods: how to access it in Android Studio, and how to access it via the terminal.

### Method One: Android Studio
Open up Android Studio and select the Device Manager bar on the right-side of your window. Then head into the File Explorer and navigate to the following file (**data > data > jakhar.aseem.diva**. From here we can see that our file is there, labeled as something similar to uinfoxxxxxxxxxxxxtmp.

![1](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/b4avl90hvwh828phd6jm.png)![1](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/llihopuprd3xwis8oqlu.png)  
  
Double click your **uinfotmp** file. You can now read the data!
![1](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/5d8fyeffmeapvey849y6.png)

### Method Two: Terminal
Open up your terminal via CTRL + ALT + T and start a adb shell via the **adb shell** command. From there on we can go:
```
su
cd data
cd data
cd jakhar.aseem.diva
```

![1](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/g6xrkpyyja35ywu91gcr.png)
 
When we list the files we can see our uinfotmp file. To read the contents of the uinfotmp file, we can simply say **cat uinfoxxxxxxxxxxxxtmp** (replace uinfoxxxxxxxxxxxxtmp with your filename), and you are set! 

![1](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/pd7105c3pxwm1xjl3k5l.png)
 
**<u>So, in summary, we were able to find the following:</u>**
- **Where**: jakhar.aseem.diva > uinfotmp
- **How**: FileWriter(File)

##<u> Insecure Data Storage - Part 4</u>
When we open the Insecure Data Storage - Part 4 section we are met with the following objective: find out where/how the credentials are being stored and the vulnerable code. So, we are expected to find where the credentials are being stored, how it is stored, and the vulnerable code.

![1](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/8h8f06ufjmfy9fzjwjph.png)

Let's first start with inserting information into the form. We get a popup saying that our credentials has been saved,and that's about it. Again, not much to it, so let's see if we can find where it saved our credentials.

![1](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/eri6pxldfvbg87xtlwdt.png)
 
Open up JADX-GUI and navigate over to the **InsecureDataStorage4Activity**. 
![1](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/315najz6o96dwiwtfjad.png)

From here we can see that our data is being stored in something called [Environment.getExternalStorageDirectory()](https://developer.android.com/reference/android/os/Environment). No worries, this only means that it is saving our file as **.uinfo.txt** to our devices' SDCard. 
![1](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/t9ox9bz94gsmhnfi4n3q.png)

The SDCard will be saved under our root directory. I will show you how to access this file I via two methods: how to access it in Android Studio, and how to access it via the terminal.

### Method One: Android Studio
Open up Android Studio and select the Device Manager bar on the right-side of your window. Then head into the File Explorer and navigate to the following directory: **sdcard**. From here we can see that our file is there, labeled as **.uinfo.txt**.
![1](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/tok51p2d77sql9h2d8bc.png)![1](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/0l86fx6s53tiuu45xij2.png)
  
Double click your .**uinfo.txt** file. You can now read the data!
![1](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/hpc5i4bzowu8wqnr0ddb.png)
 
### Method Two: Terminal
Open up your terminal via CTRL + ALT + T and start a adb shell via the **adb shell** command. From there on we can go:
```
su
cd sdcard
```
![1](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/m5rhezug0vdlqruhpdhc.png)
 
When we list the files we can see our .uinfo.txt file. To read the contents of the .uinfo.txt file, we can simply say **cat .uinfo.txt**. Now we know all it's dirty little secrets!
![1](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/o32a5mhbc1b1b27jiy3v.png)

**<u>So, in summary, we were able to find the following:</u>**
- **Where**: sdcard > .uinfo.txt
- **How**: FileWriter(File)
   
Congrats, we have finished the third section of the DIVA APK! I hope this was easy enough to follow/understand. I'll see you next time with Section 4: Input Validation Issues.😊

If you have recommendations on any cool tools, techniques, or tutorials that I too can follow feel free to leave them below and I'll check it out!

(Pull this on my [GitHub](https://github.com/christinec-dev/DIVA_APK_Writeups/tree/main/Insecure%20Data%20Storage) for future reference)