- Hello, and welcome to this new video on Android Security and Exploitation by
Pentester Academy. My name is Aditya and I'm your course instructor for this
particular video series. So this course has been run on securitytube-training.com
as well as on PentesterAcademy.com. So this video will cover the Damn Insecure
and Vulnerable Application which is a deliberately vulnerable app created for
the Android platform. And in this particular video we are going to have a
look of the hard-coding issues. So a lot of Android applications hard-code is
something sensitive inside the source code. So if you somehow reverse the
application you will be able to see what kind of sensitive information is there
inside the App source code. It might be something like a API key or a sensitive
URL or crypto algorithm or anything for that sort. So the first step in order to
analyze the hard-coding issue is to reverse the Android application, and you
can reverse it using different tools. You can either use jadx or dex2jar or any
other tool for that matter. So in this particular video I'll go ahead and use
jadx in order to reverse the application. But before that I'll just show you how the
challenge looks like. This is the hard-coding issue part one and it simply
says, "Find out what is the hard-coded and where," and the hint is given,
"Developers sometime will hard-code sensitive information for ease," and it
asks to enter our vendor key. And if I try to enter something it says, "Access
denied!" and a friendly message called, "See you in hell." So what I'll do now is
I'll reverse the application using jadx. I'll just go to downloads jadx bin, and
copy it from Pentester Academy diva-beta.apk to here. And if I look here
I have the jadx as well as the diva-beta.apk. So let me go ahead and use
jadx. So when you run jadx on any apk, it might show you a bunch of different
errors, and most of the times you don't necessarily need to worry about it. So
let's simply wait for the decompilation to complete. And looks like it got finished
even though with errors, but that is fine. So now we can go over to diva-beta, which
was the name of the file. And here you'll see the AndroidManifest.xml as well as the
different packages that were inside it. And since we know that the application
package is jakhar.aseem.diva, we can simply go to jakar/aseem/diva in order to
check out the application source code. And if you do a ls-la over here, you will
notice that there's a application or sorry, there's a activity that is called
HardcodeActivity.java. Now let's simply look at this activity, extends the
AppCompatActivity has onCreate method and there's a access method which most
probably will get activated or invoked when the button is selected. So when I
click this button, it will be calling this access method, and since I don't have the
correct password, it says the, "Access denied! See you in hell." And if you look
at the line just above it, it compares whatever you have entered inside the text
box to a string which is the vendor secret key. So let's try to enter this particular
string, and it says, "Access granted! See you on the other side." And this is how
you can identify the hard-coded security vulnerabilities. And in most of the
applications you'll find some of the other sensitive information being hard-coded
inside the application code. So that was all for this short video, and if you have
any feedback or queries, feel free to reach out to me at adi@attify.com, or
check out the complete video course at securitytube-training.com. Thanks.