Offensive security on an Android app
Tags: android, security, pentesting, go
Published: 2018-08-06 07:50:11

---
title: Offensive security on an Android app
published: true
description: 7 steps to perform an attack on a system or application and how you can use these techniques to assess the security of your android application
tags: Android, Security, Pentesting, Go
series: Android Security Testing
---

A security attack on a service, application or server can be split into 7 different steps.

1. Reconnaissance
1. Scanning
1. Access and escalation
1. Exfiltration
1. Sustainment
1. Assault
1. Obfuscation

Even if these steps are very clear when we perform an attack on a website or server, we can follow a similar pattern to perform an attack on a mobile application and so assess its security.

----

### 1. Reconnaissance on an Android App

Let’s focus on an Android application for the rest of this post (but the pattern is very similar on iOS).

As soon as you have defined which application you want to test the first steps is to know how the application is working and how the organization that builds it is working as it could then give a great hint to where we should put the efforts in the next steps.

An Android application is basically zipped files. Its extension is “apk”.

----

### 2. Scanning

To start, we must *scan* the app to know how it works internally.
It is very common on Android to do that and Google is helping us assessing the security of our applications with the [Android Debug Bridge](https://developer.android.com/studio/command-line/adb). 
When connected to a computer, the Android Debug Bridge allows us to send commands to the device to perform some actions.
I highly recommend that you *read more* about the possibilities that the Android Bridge offer.
On an Android application, *scanning* is basically setting up the application to debug mode, repackage it and play with it on the device. 
I am using [apktool](https://ibotpeaches.github.io/Apktool/) to do this. You should install it on your device and have a look at the documentation to use apktool.

Then you can access all the information from the storage and check if something valuable has leaked (password, cookies, etc…). It is the [Insecure Local Storage](https://www.owasp.org/index.php/Mobile_Top_10_2016-M2-Insecure_Data_Storage) from the [OWASP Mobile Top10](https://www.owasp.org/index.php/Mobile_Top_10_2016-Top_10).
As we are working on the apk, it is very interesting to *decompile the apk* and have a look at its *source code* and then see if something valuable is available in the codebase, from password, to key, to mechanism to block a user from specific behavior.
I am personally using [Jadx](https://github.com/skylot/jadx) to do that, which is a very popular Dex to Java decompiler.

![Jadx Graphical User Interface](https://camo.githubusercontent.com/2b504e792e3ddb1d95094b44e01ab21e101b6f56/68747470733a2f2f692e696d6775722e636f6d2f6839313749425a2e706e67)

However I prefer the [Command Line Jadx](https://github.com/skylot/jadx#usage) over the Graphical User Interface.

To decompile an Android application using Jadx, you must just run the following command :

```bash
> jadx --deobf ~/app/javaFiles/ ~/insecureApp.apk
```


Once you have the source code and the files from the local storage, you can use [grep](http://pwet.fr/man/linux/commandes/grep) commands to look for specific strings in the files.

```bash
> grep -Eo '(http|https)://["]+' -R .
```

Looking for “admin”, “password” or any internet links can give you a lot of very valuable information.

If you think that your passwords are well encrypted and well preserved by companies, please think again about the massive leaks from Yahoo, Tinder or …
And it is very similar in Android application. Some applications are storing your login and password as plain text in the local storage.

Now that we have the source code, and a debuggable application on the device, we can access it.

----

### 3. Access

![“Credentials.xml” in the “shared_preferences”. Really?!!](https://cdn-images-1.medium.com/max/800/1*3a4V67Ee51qYE71JknMEiA.png)

As you can see in the capture above from one of my penetration testing, as soon as we get to the “shared_preferences” folder through an adb shell, we can see a “Credentials.xml” file. And I can find the login and password stored as plain text in it. 😱
You can think of an app/malware that would ex-filtrate these data from a user’s phone and can then create a login/password database very easily. That is indeed a very critical flaw. 🙅

Something similar is to look at the logs from the device while we are using the application.

```bash
> adb logcat > ~/grep-result.txt
```

And then use grep commands to look for specific strings in the logs.

```bash
> grep password ~grep-result.txt > ~grep-password-result.txt
```
We have looked quickly at the local storage, to continue on the “Access and escalation” step, we are going to look at the network.

----

I am using [mitmproxy](https://mitmproxy.org/) or [bettercap](https://www.bettercap.org/) to look at the network calls between the application and the device.

[Owasp ZAP](https://www.owasp.org/index.php/OWASP_Zed_Attack_Proxy_Project) and [Burp](https://portswigger.net/burp/) are also very popular tools and they have a Graphical User Interface. Choose whichever you prefer.

> Owasp ZAP

![Owasp ZAP](https://www.owasp.org/images/thumb/7/78/ZAP-ScreenShotHelp.png/400px-ZAP-ScreenShotHelp.png.jpeg)

----

> Burp Proxy

![Burp Proxy](https://portswigger.net/sc/UsingBurp_BurpTools_1.png)

----

Let’s consider that we are going to look at the *HTTP requests and responses* to begin with. I will write a post to explain how to get information from https requests.

After you set up you device properly to follow the device’s internet traffic to your computer.

On Android, it is under :
> /Settings/Networks/Wifi/yourwifissid/Modify network/Proxy manual

You just have to install mitmproxy on your computer, launch it and then use the application on your device.

You should see very quickly all the requests and responses from your application.

![Here is a extract of mitmproxy from the Dailymotion application](https://cdn-images-1.medium.com/max/800/1*BkFuwBK6dcsT0Mm_J4vbOA.png)

I love to get all the responses/requests in a file and study later automatically with grep and with Wireshark.

Then you must use your brain and your experience to look for specific strings and try to hack the application.

It depends a lot on the application and its behavior.

----

### Next Steps — 4, 5, 6, 7

I will not cover the 4, 5, 6 and 7 steps as it is not necessary for a security assessment but are used as part of a real attack.

----

*As you can see, a lot of this setup is very similar whatever the application you start assessing.
That’s why I made a Go application that is doing all of this setup and the static attacks automatically*

*It is called “[AndroSecTest](https://github.com/Shosta/androSecTest)” and is available on Github.
{% github shosta/androSecTest %}
It is still work in progress but I hope to release it very soon for the public.*

---

Video produced by [Wild & Secure](https://wildnsecure.com), your consulting firm to all things security and real estate.
If you want to receive weekly quality content about security, subscribe to our newsletter [on our website](https://wildnsecure.com/contact).