Android Pentesting: Writeup of DIVA Access Control Issues for Parrot OS
Tags: tutorial, android, cybersecurity, beginners
Published: 2022-05-29 08:01:54

If you've seen any of my previous [write-ups](https://github.com/christinec-dev/DIVA_APK_Writeups) on the DIVA APK's, you would know that today we are going to cover the last and final section: Access Control Issues. Access Control Issues arise when we, as normal users, can gain access to data that we are not suppose to access either directly or via malicious methods. This is mostly due to poor data/access protection mechanisms put in place by developers. 🤠

Now, with this section there are three parts. Without any further lollygagging, let's jump into it!

![gif](https://media.giphy.com/media/GOQCP2d9LQYBfhO5p8/giphy.gif)

---

## Access Control Issues - Part One
When we open the Access Control Issues - Part 1 section on our device we are met with the following objective: try to access the API credentials from outside the app. This means that instead of just clicking the **View API Credentials** button, we should try and access the credentials on the activity using other methods, such as via the terminal.

![DIVA Access Control Issues](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/gabmb2s4167y5ncnfkww.png)
 
For coverage sake, this is what happens when we do press the View API Credentials button directly. We can see that we get instant access to credentials that we shouldn't have access to!
![DIVA Access Control Issues](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/o2oj5vgt4bi87gilb6gm.png)

Okay, let's start with the fun things. Let's see if we can see what happened in our **LogCat** after we opened the api credentials. LogCat is powerful since it can reveal useful information for us as the attacker, such as the activity that was opened, which we can use to exploit. Open up your terminal using CTRL + ALT + T and enter the following command.

```
adb shell logcat
```
![DIVA Access Control Issues](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/5o2d1fpqnpwehrxxtu1u.png)
 ![DIVA Access Control Issues](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/1lxzav5m6z94722lfmgd.png)
 
We can see that it opens an activity called .**APICredsActivity**. Let's open **jadx.gui** and see if we can see where the activity pulls the credentials from.
![DIVA Access Control Issues](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/74b8ydgsvimmazbybxw6.png)
![DIVA Access Control Issues](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/wx6dr5o2kcp0os99tvgh.png)
  
Okay, so the data is hardcoded. Now that we know which activity is used to store the hardocded api credentials, we can use the terminal to bypass the "View API Credentials" button and show us the credentials directly. In other words, we will start the activity's [Intent](https://developer.android.com/reference/android/content/Intent) directly from the terminal. 👾

```
adb shell am start -n jakhar.aseem.diva/.APICredsActivity
```

- `am`is used to manage the activity.

- `start` is used to start the activity.

- `-n` is used to indicate the name of the activity to open (.APICredsActivity).

![DIVA Access Control Issues](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/71a6axz1d86pe0gmy29o.png)

Hooray! When we go back to our application we can see that we have successfully opened the activity and revealed the credentials without pressing the button!
![DIVA Access Control Issues](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/3gvjh4clgiazk5fp5gcr.png)

---

## Access Control Issues - Part Two
When we open the Access Control Issues - Part Two section on our device we are met with the following objective: try to access the API credentials from outside the app without knowing the pin. This means that we cannot go ahead and just view the registered credentials via the interface, nor can we register new credentials, but we should try and access the credentials on the activity using other methods, such as via the terminal (just like before).
![DIVA Access Control Issues](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/dqkuenw4mt5xsakgymmy.png)

---

For interest sake, this is what happens when we click the **already registered** button:

![DIVA Access Control Issues](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/62xia3y3brfoawc1d8qk.png)
![DIVA Access Control Issues](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/k808e06296o8lhqlmck5.png)
 
We can see that we get immediate access to the API credentials. When we click the register now button, we are prompted to enter a pin after registering. We cannot register, as this feature does not exist! 😆
![DIVA Access Control Issues](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/3m6l43dlvbez7ee46jdt.png)
![DIVA Access Control Issues](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/2zj4hqtrnvwxcruuqt2f.png)
![DIVA Access Control Issues](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/tc222y5pfoe4s41kijkg.png)

---

Okay, as we learnt previously **LogCat** will show us everything we need to know. Let's open up our terminal and run the same command as before.
```
adb shell logcat
```
![DIVA Access Control Issues](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/jhld6yr9xu3d5jtj0j31.png)

We can see that it returns the .**APICreds2Activity** activity that opened the API credentials layout when we launched the section layout.Let's head into **JADX-GUI** and open up this activity to see what we can find in the source code.
![DIVA Access Control Issues](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/jui1do21oiycim143q9n.png)

As we can see, this value was also hardcoded - but this time there is a difference. We can see that we need a pin to access the credentials, whereas previously we had direct access. We will need to bypass this pin check.
![DIVA Access Control Issues](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/nlr7pikj7t8sp0nk6qgf.png)

Okay, from here on we need to disable our authentication checks so that we can just view our ./APICreds2Activity activity without having to do a pin check. I recommend having a look at this [ADB Command List](https://gist.github.com/Pulimet/5013acf2cd5b28e55036c82c91bd56d8) before you continue. Go back to your terminal and enter the following command:
```
adb shell am start -n jakhar.aseem.diva/.APICredsActivity -a jakhar.aseem.diva.action.VIEW_CRED2 --ez check_pin false
```

- `am`is used to manage the activity.

- `start` is used to start the activity.

- `-n` is used to indicate the name of the activity to open (.APICredsActivity).

- `-a` is used to view our credentials. It's syntax elaborates better: -a <ACTION>. 

- `--ez check_pin false` is used to bypass the checks made by the application at the receiving side so we don't need a pin.

![DIVA Access Control Issues](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/lruwaekc0p2jcv4mohrc.png)

And as easy as 123, when we head back to our application we can see that our activity launched. We have completed our activity objective!
![DIVA Access Control Issues](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/5lrftea5d07bnbz23gus.png)
 

---

## Access Control Issues - Part Three
When we open the Access Control Issues - Part Three section on our device we are met with the following objective: try to access the private notes from outside the app without knowing the pin. This means that we cannot go ahead and just create a pin to access the notes, but we should try and access the notes using other methods (not necessarily by launching the activity as prior), such as via the terminal (we know Christine, we know). 

![DIVA Access Control Issues](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/h4x84rghwdszfql52a1v.png)
 
---

For interest sake, this is what happens when we **register a pin** (I entered a basic 1234 pin):

![DIVA Access Control Issues](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/d9miq4xbwl7wnrz1e1ct.png)
![DIVA Access Control Issues](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/jzut2prpsqw91igxzbox.png)
![DIVA Access Control Issues](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/qkqs2ufoumfy8xrda3pa.png)
   

---

Let's open up our terminal and see what activity our **LogCat** reveals to us. 

```
adb shell logcat
```
![DIVA Access Control Issues](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/r9tjjowlgp5mnj8q0dim.png)
![DIVA Access Control Issues](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/mqgek9punbyzbb79q7xb.png)

We can see that it logs two activities, ./**AccessControl3Activity** and ./**AccessControl3NotesActivity**. Let's open up our **JADX-GUI **and have a look at both.

![DIVA Access Control Issues](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/8g6ooe8zyo5djp3kiswu.png)
![DIVA Access Control Issues](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/5ih3e7zt506i1edy7idj.png)

We can see our AccessControl3Activity stores our pin via a **SharedPreferences** object, which we covered way back when. When we enter the pin saved in shared_prefs, it launches the AccessControl3NotesActivity activity which validates this pin before showing the notes via a **query(NotesProvider.CONTENT_URI)** [content query](https://developer.android.com/guide/topics/providers/content-provider-basics). This content provider will dump all of the notes, and allow us to meet our objective.

We can _dump_ this [content provider](https://stackoverflow.com/questions/27988069/query-android-content-provider-from-command-line-adb-shell) via the following command in our terminal:
```
adb shell am content query --uri content://jakhar.aseem.diva.provider.notesprovider/notes/
```
![DIVA Access Control Issues](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/aqg90dcn1sdol3acpu1d.png)
 
Thus we have accessed all the notes from outside of the application, without having to register for a pin or launch the activity as before.
![DIVA Access Control Issues](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/l48uv1csj7a1jdr4mu7u.png)
 
---

## Conclusion
Congratulations, you have successfully completed all the sections of the DIVA APK! 🥳

![gif](https://media.giphy.com/media/vvz5AVSb96m0FY9XFb/giphy.gif)

I hope this was easy enough to follow/understand. If you have recommendations on any cool tools, techniques, or tutorials that I too can follow feel free to leave them below and I'll check it out! 😊

(Pull this on my [GitHub](https://github.com/christinec-dev/DIVA_APK_Writeups) for future reference)