‫-: Hi.
‫Within this lecture we are going
‫to continue our reverse engineering process.
‫So far, we have seen the Android manifest
‫and I'm going to continue browsing,
‫over here we see the original folder.
‫We see another Android manifest in this folder.
‫So let me open this file as well.
‫Let me come over here.
‫I believe this is no different than our original one
‫but it always takes a little bit time
‫to have a look at this.
‫So let me see.
‫Yep, it seems like it's the same thing.
‫We can still see the Firestore and Firebase over here.
‫So we are pretty certain
‫that it uses Firebase at this point.
‫So I'm gonna close this down.
‫So over here, we don't have any important file for us,
‫at least right now.
‫So let me continue with the resources folder.
‫So in the resources folder,
‫remember our reverse engineering section,
‫we generally see the files, like XML files
‫and drawables, like images over here.
‫And for the colors and drawables,
‫most of the time we don't see anything interesting
‫for our reverse engineering process
‫but rather, we just want to stick with the other files.
‫As you can see, we see the images,
‫like PNG files, JPEG files.
‫So we can have a look at the layout files
‫to see the activities and other stuff over here.
‫But seeing the activity competence like we use
‫will not do much for us.
‫For example, we can get the feed activity over here
‫but we won't get very much interesting things
‫out of this layout files.
‫What we wanna go for, maybe the menu, I don't know,
‫it's not going to do much for us as well.
‫What I generally look at over here is the values.
‫So remember the values, we have these strings
‫and the other drawables, like other XMLs over here,
‫like drawables XML, public XMLs, styles XML.
‫For example, we can see the different styles
‫that are used in this app
‫but we are generally interested in the strings.
‫So remember strings, we can see some passwords,
‫we can see some values
‫that are crucial for our reverse engineering process.
‫So I'm going to have a look at this strings.xml file.
‫So I'm gonna zoom in a little bit.
‫So if you look over here, you can see the titles,
‫like play services stuff.
‫And at the end of this file
‫there is Google API key and Google app ID.
‫These are Firebase IDs.
‫And over here, we see the project ID
‫which is the thing that we are looking for.
‫So, in fact, at this point,
‫we are done with the reverse engineering
‫because that's the value that we have been looking for,
‫tweetapp-9603f.
‫Of course, this will be different for you,
‫so make sure you find your own.
‫And this is the ID, this is the thing
‫that you need to focus on
‫in order to hack into the Firestore.
‫And we are going to do that at the end of the section.
‫We are going to hack into the app, hack into the server,
‫at the end of the section.
‫But just to give you an idea, just for you to comprehend
‫why we are looking for this value,
‫I'm just going to do a little bit demonstration over here
‫to get all the data, to get every value on the database
‫with a single line of command.
‫You don't have to do that right now.
‫I'm going to explain the command that I'm using over here
‫in a great detail at the later lectures.
‫But just for you to see, just for you to understand,
‫I'm just going to do this.
‫So I'm gonna copy this tweetapp-960 and stuff from here.
‫And remember, this is different for you
‫and it's perfectly normal.
‫Every Firebase app gets a unique ID.
‫So this is how Firebase servers
‫actually understands the app.
‫So let me clear this and find my command over here.
‫So I'm looking for this command.
‫I'm going to explain this command later on.
‫I'm using something called curl over here
‫and I'm going to use this ID,
‫so I'm going to copy this one.
‫So let me bring this down.
‫And rather than this,
‫I'm going to give in my own ID over here
‫and just paste the ID that I have copied over here.
‫Now, again, don't worry about this command,
‫I'm going to explain why this works
‫or why it works in some cases.
‫And as you can see, we managed to get the data.
‫Now, in fact, we, we hacked this application
‫with single line of command.
‫So right now, I have all the data in the app's database.
‫All I did was to reverse engineer it a little bit actually,
‫just have a look at the values XML and the Android manifest,
‫and we managed to get into the database.
‫So later on, we are going to see how this works,
‫why this works and we will see actually
‫how to delete the data if we want.
‫And we're gonna do that at the end of the section
‫because we are going to see if this doesn't work,
‫if you cannot get the project ID for some reason,
‫from APK tool, then there are a couple
‫of other alternative ways in order for you to use,
‫like network listening.
‫And you can use network sniffing or network listening
‫for other kind of purposes as well.
‫So it's good thing for you to learn.
‫It's a good skill for you to comprehend
‫if you want to be a mobile ethical hacker.
‫So that's what we are going to do
‫at the rest of these lectures.
‫Let's meet in the new lecture.