- Hello, and welcome to the new video of Android Security and
Exploitation by Pentester Academy. My name is Aditya and I am your course
instructor for this entire training series. So, in this video, we are going to
have a look at the access control issues of the "Damn Insecure and Vulnerable
Application." So, access control issues simply means that the application is not
able to authorize or correctly validate the access of a particular user. So
someone with insufficient authorization or insufficient access can also view the
protected content with this vulnerability, right. So if we have a look at the
application, which is the "Access Control Issues -1", it says, "You are able to
access the API credentials when you click the button. Now, try to access the API
credentials from outside the application." So if we click on this button, we are able
to access the API credentials, and that's perfectly working fine. But we want to
access the API from outside the application. And we know that we can use
something like an AM or activity manager, which we have already seen in the
Android for Pentesters course, and use it to invoke a particular activity, or
maybe to launch a browser, or maybe to invoke a intent filter, and so on.
So first of all, let's go and have a look at the Android manifest for this
application. So, if you look at the Android manifest, and search for
"Access"... So this is the "Access control 1 activity" and we have the "API Creds
Activity", which has the intent filter of "VIEW_CREDS".
Now we have already discussed what an intent filter is in the earlier course
videos, right? So all we want to do is invoke the API credentials activity by
simply using this particular intent filter. So let's simply go ahead and copy
this and use "adb shell am -a" and the intent filter. Let's see if it works.
And if you click on "VIEW_CREDS" it
doesn't work. So "adb shell -a jakhar.aseem.diva. VIEW_CREDS", right?
Looks like I missed a "start" over here, so "am start -a". And now if you see, we
have access to the API credentials from outside the application. And this is how
you can use an intent filter with the activity manager, or AM. So that's all for
this short video. In the upcoming videos we are going to have a look at several
other access control issues and a couple more issues, right? So if you have any
feedback or queries, feel free to reach out to me at adi@attify.com, and do check
out the certification at securitytube-training.com. See you in the
next video.