- Hello, and welcome to the new video of Android Security and
Exploitation by Pentester Academy. My name is Aditya Gupta, and I am your course
instructor for this training series. So, this course is being run on
PentesterAcademy.com as well as securitytube-training.com. So in this
particular video we are going to have a look at the insecure data storage of the
Damn Insecure and Vulnerable Application, also known as "DIVA". So as we have
previously discussed, an Android application can store data in a couple of
ways. So either it can store in the shared preferences, or it can store in databases,
or it can store as a profile, or maybe it can also store on the external storage,
which is usually the SD card, right? So if you come to the Part 4 of the Insecure
Data Storage, it has a similar screen asking us to enter the username and
password. So let's say we enter something, maybe "username1" and "password23." And we
save this particular information. So now if you look over here, there is no
additional file which is created, and if you look at the shared preferences it is
not over here, and also not in the databases. So the other possibility is it
could be in the external storage. Now, in order to check the external storage, you
need to go to "/mnt/sdcard", and if you do an "ls" over here you don't see anything
like a new file or a new created file over here.
But if you do an "ls -la" you see something as a ".uinfo.txt" which has been
recently created, right. So a lot of application developers, what they think is
storing something in the SD card might not be secure, but if they store it with a dot
in the start, making it a hidden file, that might make the file secure, right,
which is not the case. So anyone can simply do an "ls -la" and get to know the
hidden file. And if you simply do a "cat .uinfo.txt" it's the "username1" and
"password23" which is what we entered over here, right? And if we want to look at the
source code, we can check out Insecure Storage - Part 4. And we see that it is
taking the location of the external storage directory and creating a file
called ".uinfo.txt". So either you can reverse engineer the application,
figure out how it is storing the data, or you can try a hit and trial approach,
right?
So that is all for this particular video, and if you have any questions or queries,
fee free to reach out to me at Twitter, @adi1391 or over email, adi@attify.com.
And you can also check out the certifications and the training course at
securitytube-training.com and PentesterAcademy.com. See you in the next
video.