root💀senseicat:~#

Hack. Eat. Sleep. Repeat!!!

Project maintained by SENSEiXENUS Hosted on GitHub Pages — Theme by mattgraham

ANDROID PENTESTING

Exporting apk with adb

Using Drozer

image

image

drozer console connect --server <ip-addr>

Syntax-: adb forward tcp:<port> tcp:<port>

image

image

Drozer Console Commands

Syntax-:run app.package.list -f <package>

image

Syntax-:run app.package.info -a <package's identifier>

image

Syntax-:run app.package.attacksurface <identifier>

image

Syntax-:run app.activity.info -a <identifier>

image

image

Syntax-: run app.activity.start --component [identifier] [activity]

image

image

Syntax-:run app.provider.info -a [identifier]

image

Syntax-:run scanner.provider.finduris -a [identifier]

image

Syntax-:run app.provider.query content://[url]

image

run app.provider.insert <content uris> --string pin 1111 --string Password H4ck3d
run app.provider.query content://com.mwr.example.sieve.DBContentProvider/Keys/

image

Syntax-:run scanner.provider.sqltables -a <identifier>

image

Syntax-:run app.provider.query <content uri> --projection "* FROM SQLITE_MASTER where type=’table’;--"

image

run app.provider.query content://com.mwr.example.sieve.DBContentProvider/Keys/ --selection "1 or 1=1"

image

Syntax-:run app.provider.read content://com.mwr.example.sieve.FileBackupProvider/etc/hosts

image

REFERENCE-:

Decompiling apk files

apktool d -rs <apk>

Converting dex files to jar files

d2j-dex2jar <classes.dex>

Use jadx-gui to read decompiled jar file

jadx-gui <classes.jar>

Android Internals 101

What happens when an Android phone boots up

BOOT ROM

Bootloader

Kernel

Init

Zygote and VM

SYSTEM SERVERS

Activity Manager

Android Architecture Build Process

SSL Unpinning with Objection [another approach]

Syntax-:objection patchapk -s <apk's name>

image

image

APK DEBUG PROCESS

Understanding the Java Virtual Machine

Android Virtual Machine

Compilation process

ART over DALVIK

Understanding the whole process

image

image

Signing the apk

image

Java for Android

public class Hello {
	public static void main(String[] args){
    System.out.println("Hello world!!");		
	}
}

//TODO-:

image

public class Hello {
	public static void main(String[] args){
    System.out.println("Hello world!!");
    //Number
    int number = -5;
    System.out.println(number);	
	}
}

long number = 5;
System.out.println(num);

public class Hello {
	public static void main(String[] args){
    System.out.println("Hello world!!");
    //Number
    int number = -5;
    System.out.println(number);
    long num = 5;
    System.out.println(num);
    double myDouble = 2.5;
    //float
    float myFloat = (float) 2.9;
    System.out.println(myDouble);	
    System.out.println(myFloat);
	}
}

char myUnicodeChar =  '\u00A9';
System.out.println(myChar);
System.out.println(myUnicodeChar);

String myString = "Meisma";

Boolean myBool = true;

int a  =  5;
int b  = 10;
double answer =  (double) a / b ;
System.out.println(answer);

String string1 = "Man";
String string2 = "go";
System.out.println(string1 + string2);

Relational and Logical Operators && Conditions


int num = 9;
if (num>10) {
   System.out.println("Greater than 10");
} else {
   Systemm.out.println("Lesser thn 10");
}


switch (num) {
   case 10:
        System.out.println("Wrong");
        break;
   case 9:
        System.out.println("Correct");
        break;
   default:
        System.out.println("LMAO!!!");
        break;				
}

Loops

public class Main {
	public static void main(String[] args) {
		int num = 0;
		while (true) {
			num+=1;
			System.out.println("Hello");
		    if (num == 7) {
			   System.out.println("Life is hard");
		       break;
			}
		}
	}
}

do{
  System.out.println("Milk");
} while (x<5);

import java.util.Scanner;
public class Main {
    public static void main(String[] args) {
        System.out.println("Enter a number: ");
        Scanner myScanner = Scanner(System.in);
        int answer = new myScanner.nextInt(); //nextInt() should be used for a number
        System.out.println("The answer is :" + answer);
    }
}

String string = new myScanner.next();

import javax.swing.JOptionPane;

import javax.swing.JOptionPane;
public class Main {
	public static void main(String[] args) {
	  String first_name;
	  first_name = JOptionPane.showInputDialog("FirstName");//showInputDialog
	  System.out.println(first_name);
	}
}

import javax.swing.JOptionPane;
public class Main {
	public static void main(String[] args) {
	  String first_name,second_name,full_name;
	  first_name = JOptionPane.showInputDialog("FirstName-: ");//showInputDialog
	  second_name = JOptionPane.showInputDialog("SecondName-: ");
	  //full_name
	  full_name = "Your name is "+ first_name + " " + second_name;
	  JOptionPane.showMessageDialog(null,full_name);
	  System.exit(0);
	}
}

JOptionPane.showMessageDialog(null,full_name,"Name",JOptionPane.INFORMATION_MESSAGE);

ERROR_MESSAGE
PLAIN_MESSAGE
QUESTION_MESSAGE
WARNING_MESSAGE

import java.util.Random;

public class Main {
	public static void main(String[] args){
		System.out.println("Random numbers");
		Random random = new Random();
		int number = random.nextInt();
		System.out.println(number);
	}
}

int number = random.nextInt(20); //The argument 20 is the limit

public class Main {
	public static void main(String[] args) {
		//Arrays in java
	     String[] students = {"Meisam","Zombies","Daddy","Great","Deadbeat"};
		 System.out.println(students[0]);  
	}
}

public class Main {
	public static void main(String[] args) {
		 //Arrays in java
	         String[] students = new String[5]; //Defining the amount of memory
		 students[0] = "Meisam";
		 students[1] = "Sarah";
		 System.out.println(students[0]);  
		 
	}
}

public class Main {
	public static void main(String[] args) {
		//Arrays in java
	     String[] students = new String[5];
		 students[0] = "Meisam";
		 students[1] = "Sarah";
		 students[2] = "Sarah";
		 students[3] = "Sarah";
		 students[4] = "Sarah";
		 for (int i=0; i<5; i++) {
			 System.out.println(students[i]);
		 }
		 
	}
}

public class Main {
	public static void main(String[] args) {
		//Arrays in java
	     String[] students = new String[5];
		 students[0] = "Meisam";
		 students[1] = "Sarah";
		 students[2] = "Sarah";
		 students[3] = "Sarah";
		 students[4] = "Sarah";
		 System.out.println("[+] Array's length is : " + students.length);
		 for (int i=0; i<students.length; i++) {
			 System.out.println(students[i]);
		 }
		 
	}
}

Object Oriented Programming

public class Phone {
	String name;
	int phoneNumber;
	int userSignature;
	String userModel;
	String imeiString;
}

public class Main {
	public static void main(String[] args) {
		Phone iphone = new Phone();//Creating an instance of a class
		//Attributes
		iphone.name = "Iphone 11"; 
		iphone.phoneNumber = "08109978500";
		//Accessing the field of a class
		System.out.println(iphone.name);
	}
}

public class Phone {
	String name;
	String phoneNumber;
	//Creating a methodd
	//If you don't want to return any value, use the keyword void as seen below
	public void printString(String trackName) {
		System.out.println("Playing track :" + trackName);
	}
}

iphone.printString("Bahubali");

public class Phone {
	String name;
	String phoneNumber;
	//Use of access modifiers
	public String model = "SM-1234";

System.out.println(iphone.model);

public class Phone {
	String name;
	String phoneNumber;
	//Use of access modifiers
	private String model = "SM-1234";
	//Creating a methodd
	//If you don't want to return any value, use the keyword void as seen below
	public void printString(String trackName) {
		System.out.println("Playing track :" + trackName);
	}
	public void accessPrivateField() {
		System.out.println(model);
	} 
}

public class Phone {
	private String name;
	String phoneNumber;
	//Use of access modifiers
	private String model = "SM-1234";
	//Creating a methodd
	//If you don't want to return any value, use the keyword void as seen below
	public void printString(String trackName) {
		System.out.println("Playing track :" + trackName);
	}
	public void accessPrivateField() {
		System.out.println(model);
	}
    //set class field 'name'	
	public void setName(String name){
		this.name = name;
	}
	//return class field name	
	public String getName() {
		return this.name;
	}
}

public class Main {
	public static void main(String[] args) {
		Phone iphone = new Phone();//Creating an instance of a class
		//Attributes
		//iphone.name = "Iphone 11"; 
		iphone.phoneNumber = "08109484844978500";
		//Accessing the field of a class
		//System.out.println(iphone.name);
		iphone.accessPrivateField();
		iphone.printString("Bahubali");
		iphone.setName("Iphone 22");
		//System.out.println(iphone.name);
		System.out.println(iphone.getName());
	}
}

Creating a constructor

public Phone(String name,String phoneNumber) {
		this.name = this.name;
		this.phoneNumber = phoneNumber;
		this.model =  "SM-1234";
	}

SuperClass Animal-:

public class Animal {
	private String name;
	private String typeA;
	private int legNumbers;
	private Boolean hasTail;
	
	public Animal(String name,String typeA,int legNumber,Boolean hasTail) {
		this.name = name;
		this.typeA = typeA;
		this.legNumbers = legNumber;
		this.hasTail = hasTail;
	}
	
	public void setName(String name) {
	    this.name = name;
	
	}
	public void setTypeA(String name) {
	    this.typeA = typeA;
	
	}
}

public class Bird extends Animal {
	public Bird(String name,String typeA,int legNumber,Boolean hasTail){
	super(name,typeA,legNumber,hasTail);
	}
}

//Bird
public class Main{
	public static void main(String[] args) {
		//Instatiating our Bird class
		Bird phoenix = new Bird("Bangis","Parrot",10,true);
		//Setting a Name
		phoenix.setName("Hawk");
		//Accessing the superclass function
		System.out.println(phoenix.getName());
	}
}

public class Bird extends Animal {
	private int wings;
	public Bird (String name,String typeA,int legNumber,Boolean hasTail,int wings){
	super(name,typeA,legNumber,hasTail);
	this.wings = wings;
	}
	public void canFly() {
		if (this.wings > 0) {
			System.out.println("[+]Can fly");
		} else {
			System.out.println("[+]Cannot fly");
		}
	}
	public void setWings(int wings) {
		this.wings = wings;
	}
	public int getWings() {
		return this.wings;
	}
}

Animal class-:

public void eat(String food) {
		System.out.println(this.name + " eats " + food);
	}

Bird Class-:

@Override
	public void eat(String food) {
		super.eat(food);
	}

public void canFly() {
		if (this.wings > 0) {
			System.out.println("[+]Can fly");
		} else {
			System.out.println("[+]Cannot fly");
		}
	}
	public void canFly(int wings){
		if (wings > 0) {
			System.out.println("[+]Can fly");
		} else {
			System.out.println("[+]Cannot fly");
		}
	}

final String x = "Sleep";
x = "sleep";
System.out.println(x);

image

ArrayList

import java.util.ArrayList

ArrayList<String> names = new ArrayList<>();

names.add("Meisam");
names.add("Sarah");

names.get(0);

names.size();

names.contains("Shayla");

names.remove("Value");

names.indexOf("Shayla");

names.isEmpty()

MAP

import java.util.Map;

//<> contains the  data type for the key and value
Map<String,String> contacts = new HashMap<String, String>();

contacts.put("Meisam","08109978500");

contacts.get("Meisam");

contacts.size()

contacts.remove("Meisam");

contacts.containsKey("Me");
contacts.containsValue("08109978585858558");

for (type var : array) {
    statements using var;
}

Static keyword - Inner Classes

public class Student {
	public static String name;
	private int id;
	private String falseName;
	public Student(int id,String falseName) {
		this.id = id;
	}
	public void setName(String name){
		this.name =  name;
	}
	public void setId(int id){
		this.id =  id;
	}
	public void setFalseName(String falseName) {
		this.falseName = falseName;
	}
	public String getName(){
		return this.name;
	}
	public int getId(){
		return this.id;
	}
	public String getFalseName(){
		return this.falseName;
	}
}

public class Main {
	public static void main(String[] args) {
		Student student = new Student(10,"Sarah");
	    student.setName("Lame");
		System.out.println(student.getName());
		 
	}
}

Student.name =  "Kris";

public class Student {
	private int id;
	private String name;
	
	public class innerClass {
		private int innerId;
		private String innerName;
		
		public innerClass(int innerId,String innerName) {
			this.innerId = innerId;
			this.innerName = innerName;
		}
	}
}

Student.innerClass inner = new Student().new innerClass(1,"Name");

Nox emulator adb not connected

Installing frida-server

Running frida to spawn executable

frida --codeshare sahabrifki/okhttp3-obfuscated---ssl-pinning-bypass -f  "package-name" -U

Bypass Okhttp3 with multiple ssl pinning script

frida --codeshare akabe1/frida-multiple-unpinning  -f  "package-name" -U

image

adb push cacert.cer /data/local/tmp/root.cer

Nox_adb.exe location