Sunday, 24 August 2014

UrduSecurity Android Hacking

Hello Readers, Whats Up? Hope You all should be fine enough to read this tutorial. As in previous Article I said that i'll demonstrate that how to attack debuggable android applications. So This tutorial is about Finding and Attacking Debuggable Android Applications.

Before i start the procedure Let's collect the requirements.


and as in previous tutorial i told that Android Tamer Have all these tools so no need to be worry just start up your android tamer and if you don't have , get it now.

Checking For Vulnerable Apps

First of all we need to learn that how to check if an app is vulnerable or no. to check this we need to find either the app is debuggable or no. and how to do it? Here comes the Role of UrduSecurity

Just Download the vulnerable apk file from above given link and provide following command in your android tamer's terminal .
  • apktool d Vulnerable.apk

UrduSecurity Android Hacking

after You have done it, You have to Check AndroidManifest.xml File in order to see either the app is debuggable or no. Provide the Following Command to do that.
  • nano Vulnerable/AndroidManifest.xml
and if you see this Line there, android:debuggable="true" , viola This app is vulnerable and you can pentest it.

UrduSecurity Android Hacking

Exploiting the Vulnerable Application

Now that You've got a vulnerable android app, Let's exploit it. start up your android emulator and launch the application. your goal is to change the text Try Again into Hacked By [UrduSecurity]. but first we have to check dalvik vm ports listening on emulator. give following command.
  • adb jdwp
UrduSecurity Android Hacking


okay now we have to find on which port our Vulnerable.apk is listening which you can find again by running the app and enumeratng the ports. Let's assume the app is litening on 1180 port so let's forward to this port and attach our terminal to the app using jdb debugger.

UrduSecurity Android Hacking


Now Let's Check the classes and methods of Vulnerable.apk and as our main class is com.example.debug.MainActivity$1 so we'll be checking the Methods of that class also. see below.

UrduSecurity Android Hacking

Now We have to set a break point at onClick(android.view.View) method so that we can step through it and exploit the vulnerability by debugging the app.

  • stop in com.example.debug.MainActivity$1.onClick(android.view.View)
and then check the position where we are by entering locals in terminal. Finally we have to move next by using the keyword next. see below.

Please click on the app manually to re run the app as jdb don't provide this functionality here.

UrduSecurity Android Hacking

as in above figure , You have to step through all the steps untill you get the desired string, as we remember we have to replace Try Again with Hacked By UrduSecurity, so we found that string here. Now its time to step in the secret = "Try Again" String.

UrduSecurity Android Hacking

and finally its time to give command run , and you'll see that the app will automatically pop up our changed message that is: Hacked By [UrduSecurity]. 

UrduSecurity Android Hacking


Yahooooooo, we just hacked the app. We can do a lot of other intresting stuff like getting a remote shell on victim and so on which we'll show you in later tutorials. Hope You've enjoyed this tutorial.

References

  • infosecinstitute.com
  • androidtamer.com
  • oracle.com
  • askubuntu.com

Android Hacking: Hacking Debuggable Android Apps

  • Uploaded by: Adeel Chaudhary
  • Views:
  • Share

    7 comments:

    1. CLASSIC CYBER HACKS
      How well are you prepared for a Cyber incident or Breach?, Is your Data safe?
      Strengthen your Cybersecurity stance by contacting CLASSIC CYBER NOTCH @ GMAIL DOT COM for a Perfect, Unique, Classic and Professional Job in Securing your Network against all sort of breaches and from scammers as well.
      For we are Specially equipped with the Best hands to getting your Cyber Hack needs met as your jobs will be handled with utmost professionalism.

      We do All type of cyber Jobs such as:
      ☑ TRACKING of GPS location, cars, Computers, Phones (Apple, windows and Android), e.t.c.
      We also Track
      E-MAIL account,(G-mail, Yahoo mail, AOL, Proton mail, etc.)
      SOCIAL MEDIA account, (Facebook, Twitter, Skype, Whatsapp, e.t.c.)

      ☑ RECOVERY of Passwords for E-mail address, Phones, Computers, Social media Accounts, Documents e.t.c

      ☑ INSTALLATION of Spy ware so as to spy into someone else's computer, phone or E-mail address and also Installation of Spy ware software on your individual O.S so as to detect intrusion of any type.
      We also Create and Install VIRUS into any desired computer gadget.

      ☑ CRACKING Websites, any desired gadget it computers or phones, CCTV Survelance camera, Data base (of both Private and Govt organization, such as Schools, Hospitals, Court houses, The FBI, NSA) e.t.c....

      NOTE:
      Other Jobs we do are:
      ☑ We provide Private Investigator service
      ☑ Clearing Criminal records of diverse type
      ☑ Binary Options fraud Recovery
      ☑ Bitcoin Mining
      ☑ Issuing of Blank ATM cards
      ☑ And many more... etc.

      We assure you that your Job will be attended to with care and efficiency as it will be handled by the Best professional hands in Cyber literacy.
      We also have a forum where you can get yourself equipped with Advanced hacking Knowledge..

      CLASSIC CYBER HACKS gives you the Best service in the Hacking world as our Success rate is Top Notch

      Be sure to 📱 💻 us via E-mail @

      Classic cyber notch at gmail dot com

      any time, any day to get the Best Professional hands involved in putting a smile on your face.
      We're Classic Hacks

      Signed,
      Collins .A.

      ReplyDelete
      Replies
      1. Hello everyone..

        I'm selling US leads. Details in leads are:

        Full Name
        SSN
        DOB
        Phone Numbers
        Address
        City
        State
        Zip
        Residential Status
        Account Number
        DL number
        Emails

        All leads are genuine & fresh, I will provide you samples for checking if u want.

        Dealing in almost all types of leads:

        SSN Leads
        Dead Fullz
        Premium Leads
        Mortgage Leads
        Bank Account Leads
        Employee Leads
        Business Leads
        Home Owners Leads
        DL Leads
        Emails Leads
        Phone Numbers Leads

        Each lead will b cost $1

        Also cvv Fullz available track 1 & track 2 with pin.

        Interested person contact, scammers stay away, sampling is free of cost.

        email > leads.sellers1212@gmail.com
        Whatsapp > +923172721122
        Telegram > @leadsupplier
        ICQ > 752822040

        Delete
    2. Hello everyone..

      I'm selling US leads. Details in leads are:

      Full Name
      SSN
      DOB
      Phone Numbers
      Address
      City
      State
      Zip
      Residential Status
      Account Number
      DL number
      Emails

      All leads are genuine & fresh, I will provide you samples for checking if u want.

      Dealing in almost all types of leads:

      SSN Leads
      Dead Fullz
      Premium Leads
      Mortgage Leads
      Bank Account Leads
      Employee Leads
      Business Leads
      Home Owners Leads
      DL Leads
      Emails Leads
      Phone Numbers Leads

      Each lead will b cost $1

      Also cvv Fullz available track 1 & track 2 with pin.

      Interested person contact, scammers stay away, sampling is free of cost.

      email > leads.sellers1212@gmail.com
      Whatsapp > +923172721122
      Telegram > @leadsupplier
      ICQ > 752822040

      ReplyDelete
    3. Hello all
      am looking few years that some guys comes into the market
      they called themselves hacker, carder or spammer they rip the
      peoples with different ways and it’s a badly impact to real hacker
      now situation is that peoples doesn’t believe that real hackers and carder scammer exists.
      Anyone want to make deal with me any type am available but first
      I‘ll show the proof that am real then make a deal like

      Available Services

      ..Wire Bank Transfer all over the world

      ..Western Union Transfer all over the world

      ..Credit Cards (USA, UK, AUS, CAN, NZ)

      ..School Grade upgrade / remove Records

      ..Spamming Tool

      ..keyloggers / rats

      ..Social Media recovery

      .. Teaching Hacking / spamming / carding (1/2 hours course)

      discount for re-seller

      Contact: 24/7

      fixitrogers@gmail.com

      ReplyDelete
    4. Hi All!

      I'm selling fresh & genuine SSN Leads, with good connectivity. All data is tested & verified.
      Headers in Leads:

      First Name | Last Name | SSN | Dob | Address | State | City | Zip | Phone Number | Account Number | Bank NAME | DL Number | House Owner

      *You can ask for sample before any deal
      *Each SSN lead will be cost $1
      *Premium Lead will be cost $5
      *If anyone wants in bulk I will negotiate
      *Sampling is just for serious buyers

      Hope for the long term deal
      For detailed information please contact me on:

      Whatsapp > +923172721122
      Email > leads.sellers1212@gmail.com
      Telegram > @leadsupplier
      ICQ > 752822040

      ReplyDelete

     
    Copyright © HACK | Designed by Muhammad Adeel | Founder UrduSecurity