Langsung ke konten utama

Postingan

OWASP crackme write up ∠( ᐛ 」∠)_ (day 9)

Hi guys ! sorry if have to gone for a while, i have to postponed the 100dayspentesing challenge to finished my bachelor thesis report and it took a lot of time to finish it. So because i have spare time before the final thesis test, i decide to do some stretching again with CTF challenge.

This time i take the the owasp crackme challenge level 01 (you can download it in the following link: https://github.com/OWASP/owasp-mstg/tree/master/Crackmes/Android/Level_01)

LET THE GAME BEGIN !

First of all, you need to setup a machine to install the owasp level 01 apk you can use your own devide or vm (just choose the most comfortable one) and after you decide which one to use, install it with adb utility:

~# adb install UnCrackable-Level1.apk






The above figure is the interface when you opened the installed apk. From first glance you can tell that we only need to find a secret string (so no fancy function that we need to explore).

At this point i just straightly reverse engineer the apk to get t…
Postingan terbaru

Attacking android application activity by repackaging ٩(ↀДↀ)۶ (day 8)

I think that most of the android developer forgot about danger of the open source nature of android application. Because the fact that once their application is posted in any play store in the world. There are no guarantee that anyone could tweak your application.



In this post i will show you how to attacking android application component(activity) by repackaging the application. I hope it will open developer eye about how easy for anyone to change your application structure.

To start the post,

You guys may be familiar with Androidmanifest.xml file in APK file right?!(if you not ? do your research m8)

Long story short the file is the one that responsible for any permission and components use in android application and it pretty much show like this.



as you can see from the following image there are 3 activities contain in the application and all of them cannot be query outside of the application. So what are we going to do? lets try to modify the file as shown below



we change the expor…

Exploiting android clipboard manager └(=^‥^=)┐ (day 7)

who doesn't like to copy pasting?

it is faster and very convenience, right ?

why do you have to type some long line of text over and over again if you can just simply copy and paste it ?

why do you have to remember disss long account number of number if you can just simply copy and paste it ?

well my friend i think you should reconsider you life decision wkwkwkw

In the following post i will show you how any android application could easily just copied your credential.

Android give user a very convenient user interface one of them is have ability to copy and paste any object including text. As developer android you may notice that in order to user the functionality inside your application you could use ClipboardManager functionality.

In order to use ClipboardManager you have to instantiate the object by calling getSystemService():

ClipboardManager clipboard = (ClipboardManager)getSystemService(Context.CLIPBOARD_SERVICE)

to copy value:

ClipData clip = ClipData.newPlainText('da…

Going old fashion: debugging android with JDWP (ง ͡ʘ ͜ʖ ͡ʘ)ง (day 6)

Tampering and reverse engineering android application is always been my favorite activity when i try to do android application pentesting. Using reverse engineering we would able to understand the nature of the application code and tampering is when you try to change the value of the runtime(at debugging state) and capable of change the code flow.

in this blog post i will try to show how to use one of the old tool to do java debugging activity which is JDWP and for the testing app i will use insecurebankv2 application.

luckily JDWP has already been pre installed inside the adb utility. But In order to use jdwp for tampering application, we should do at least couple of things:

1. First we need to know where is the application PID is in order for us to attach into the process.

run ~# adb jdwp (don't execute your application first)


run it again ~# adb jdwp (execute your application)


as you can see from the the second picture the id 1309 is appear when we try to execute the applicatio…

Android memory forensic analysis with LIME volatility ᕙ༼*◕_◕*༽ᕤ (Day 5) (work on progress)

At first i thought that memory forensic is a black magic. Whenever i try to watch someone do memory forensic they do this kinda weird and exotic command to dump the memory and walaaa they got the source of infection. i was like whatttttt the hell is happening ʕʘ̅͜ʘ̅ʔ.

So rather than staying here babbling about how hard is memory forensic why not try it !

in these post i'm going to do memory forensic analysis with infamous LIME framework from volatility.

Before we go to the cool stuff let me explain you briefly about what is memory forensic. Simple enough memory forensic is a process acquiring and analysis of volatile data(RAM). Expert use memory forensic to identify the attack source or malware infection.

That's enough for the theory, lets go to the fun stuff(if you want to know more about memory forensic just google it you dumb dumb!)

we are going to run an application, dump the memory from the android and try to analyze it(Maximum EFFORT !!!!). OKAY! before you do exercise …