‫-: Hi. Within this lecture we are going to sign our APK
‫and we are going to install it in our emulator.
‫And finally we are going to see how to read content
‫from Charles proxy.
‫So far we have changed the content of our APK.
‫We have manipulated the manifest file
‫and we have added some network configuration file
‫and now it's time to create an APK.
‫Actually, we have created the APK but we didn't sign it
‫so we couldn't actually install it on our emulator.
‫So what I'm gonna do, I'm going to sign this
‫and I'm going to move this on my desktop first
‫and I'm going to use the previous method
‫that we have seen in this course.
‫Remember we use Jar Signer in order to sign this.
‫And in order to do
‫that you can actually use Windows comment prompt as well.
‫But JDK should be installed on your computer
‫I believe by now you know how to do this.
‫Okay, so let me show you something.
‫If we come over here to google.com
‫and just search for Android sign APK commands line
‫you will see the commands that we have been using so far.
‫There are millions of results over here.
‫You can even get these steps
‫and instructions from Stack Overflow like this.
‫But again, I'm going to copy
‫and paste this key tool and jar signer
‫in my notes and in the resources of this lecture
‫so that you can just copy it and use it on your own.
‫So that's exactly what we are trying to do.
‫Remember we are using key tool
‫in order to generate a key, okay?
‫That's key store file, actually key store extension
‫and then we use Jar Signer
‫in order to use that key store file to sign our APK.
‫Now remember there are a lot of other options as well.
‫Like you can even download an APK for JAR signing.
‫You can search Google Play for signing APKs
‫or Jar Signer and you will find a lot
‫of results, just download it and use it.
‫But I'm going to do what we have been doing so far.
‫So I'm going to open my notes like this, okay?
‫And let me make this a little bit bigger here
‫and I'm going to use this on my Turmo.
‫And again, you should go to desktop
‫in order to use it because your APK should be
‫on desktop or where will you put your APK?
‫Just make sure you go
‫to that folder in order to use these comments.
‫And we're going to run those comments one
‫by one and don't forget to change their related places
‫like the APK name over here.
‫So I'm going to first create this key star.
‫It will ask me for a password.
‫I'm just going to give one and if you type it
‫and hit enter it will just accept it, but you won't see it
‫in the screen because of the security reasons, remember?
‫Okay? And again, type the same password one more time.
‫It will ask you for your credentials
‫and some other information as well.
‫You're more than welcome to just skip those
‫or give some false information like this.
‫But when you see this no you should say yes
‫and I accidentally put in a like this.
‫Okay, so let me do this one more time and here you go.
‫It says no and I will say yes
‫because it asks me if this is correct or not.
‫Okay, so here is my key store file.
‫Now I'm going to use this key store file.
‫I'm going to use the jar signer tool
‫in order to sign this APK.
‫So I'm still in desktop, I'm still
‫in the same place with my APK.
‫And remember you have to change the name
‫from here if you have another name in your APK.
‫So mine is APK debug and I'm gonna go
‫for it like this and it will ask me for my password, okay?
‫And I will give the password that I have chosen
‫and it's unable to open the JAR file.
‫Let's see, yeah, I believe I have misspelled it.
‫As you can see it's called APK debug in the comment
‫but it's actually app debug.
‫So make sure you get this right, like this app debug.
‫And I'm going to try one more time.
‫It will ask me for my password.
‫I'm going to give it and let me see.
‫Yep, here you go.
‫Now the APK is actually signed, so I can install this
‫on my emulator and do what I have to do.
‫Here you go.
‫Now it's installed on my emulator.
‫So this is manipulated APK.
‫We will be able to use the certificate that we
‫have installed before from Charles proxy.
‫Okay, and let me close everything down
‫and let me open Charles.
‫So here we go.
‫So let's try to start the recording and SSL proxy.
‫Now as you can see, both of them are running.
‫Okay. Make sure you see the start and stop
‫and make sure you include everything over here
‫and make sure you changed the proxy in the settings as well.
‫So when I come to my security with app I, I'm going to try
‫and log in with my previously created account
‫Or I can even sign up, or something like this.
‫Okay? So if I say sign in, there is a network error.
‫As you can see, it doesn't sign me in.
‫It doesn't log me in.
‫So there is a timeout, but if I come over here
‫I can see the fire store google.com over here.
‫So let me filter this result by running fire over here.
‫And as you can see there are a couple
‫of things like fire store console, fire store.
‫So I'm going to try and see
‫if I can actually go to any HTTPS websites.
‫So google.com seems to be working
‫so there is nothing wrong with Charles proxy itself.
‫So we are having some difficulties regarding our app.
‫So I'm going to try one more time
‫and it still gives me some timeout.
‫So if you experience any problem like that
‫make sure you stop the SSL proxy like this, okay?
‫And then try to sign in or sign up ,to go into the feed
‫because we need the collection name eventually anyway, okay
‫maybe we got the Firebase ID by now
‫but we didn't get the collection name.
‫Now if you started again
‫and try to edit a tweet for example
‫maybe we will experience another time out over here.
‫But we are inside of our feed activity
‫so maybe we got what we need by now.
‫But in order to be sure
‫I'm going to try this a couple of more times.
‫Like I'm going to stop the SSL proxy over here
‫and I'm going to tweet what we have written so far.
‫Okay? And I'm going to get this data
‫in my tweet activity like that.
‫I'm going to start SSL proxy again.
‫I'm going to try and yeah, it still works as you can see.
‫You can start and stop
‫from here and I'm going to add another tweet,
‫at least attempt to add another tweet.
‫It'll gimme time out one more time.
‫If I get there, maybe we can stop the SSL proxy
‫and just tweet it and then start the SSL proxy later on.
‫You you're gonna have to improvise a little bit.
‫You're gonna have to try this a couple of more times
‫in order to be sure that you are getting a lot of data so
‫that you can analyze them later on.
‫Okay, so far we have gathered some data, maybe we can come
‫over to the sequence tab and search for fire star.
‫Okay, and analyze the results.
‫Now we have done a lot of tests, maybe they were successful
‫maybe they were not.
‫We are going to see
‫if we managed to get the data that we need.
‫So over here we see the request
‫going to and coming from fire store.
‫And if you click one of these post and connect things
‫you can see the details on the bottom of this tool.
‫As you can see.
‫Now I'm going to look for mainly post request
‫because when you try to send some information to a server
‫it generally goes with a post request.
‫So that's what I'm trying to do over here.
‫So as you can see, I'm looking
‫for post requests and I'm clicking on them
‫and I'm trying to see the content of those.
‫So for example, over here we have a post request and I'm
‫if I go to contents of this request
‫I can see the tweet app dash 9 6 0 3.
‫So as you can see,
‫this is trying to write and this is trying to listen.
‫And over here we even see the collection name
‫like this, tweets.
‫So as you can see
‫we actually managed to get the fire base ID
‫and we actually managed to get the collection name as well.
‫So we have been looking for the tweets
‫and we have been looking for this ID.
‫So maybe you can think that yeah
‫we got this from the APK tool as well.
‫And that is correct.
‫However, there may be some time that you will
‫experience some kind of a disruption in your process.
‫Like maybe you cannot get easily the collection names
‫or the fire base IDs inside of your APK de-compiled folders.
‫So it's essential that you learn the skill.
‫It's not even only for failure based hacking.
‫You can use this network snipping in order to
‫understand what is going on in the back end of
‫an app so that you can try to understand the
‫URL of the server so that maybe you can check
‫for if there's something wrong with the server or not.
‫So this is a very good skill,
‫this is a very good practice for you.
‫And now since we are pretty certain that we know
‫the collection name and we know the Firebase ID
‫it's time for us to hack into that server
‫and see if they're appropriately configured or not.
‫Let's do that in the next lecture.