1 00:00:00,000 --> 00:00:05,000 Hi everyone, I'm Ajin Abraham, a security researcher and creator of MobSF Project. 2 00:00:05,040 --> 00:00:12,260 This talk is about MobSF, a free and open source tool that helps you to perform security assessment of your mobile applications. 3 00:00:12,280 --> 00:00:19,320 To get started with the project, follow the documentation links and also feel free to join our Slack channel for support. 4 00:00:19,840 --> 00:00:24,380 Use these Docker commands to get a quick instance of MobSF up and running. 5 00:00:25,980 --> 00:00:29,820 MobSF supports both static and dynamic analysis. 6 00:00:29,820 --> 00:00:34,520 Under static analysis, we support Android, iOS and Windows binaries. 7 00:00:34,520 --> 00:00:42,480 We also support SIFT source code, so we support Java and Kotlin for Android and SIFT and Objective-C for iOS. 8 00:00:42,640 --> 00:00:46,640 For dynamic analysis, currently we only support Android binaries. 9 00:00:46,640 --> 00:00:53,160 You can perform dynamic analysis with a Genymotion Android VM or an Android Studio emulator. 10 00:00:54,140 --> 00:00:59,960 MobSF also has REST APIs for your CICD or DevSecOps use cases. 11 00:01:00,320 --> 00:01:02,380 Let's take a look into the tool. 12 00:01:02,380 --> 00:01:09,040 In this demo, I'll be talking about static and dynamic analysis of Android applications with MobSF. 13 00:01:10,180 --> 00:01:18,060 So let's take MobSF and let's drag and drop an Android APK, so that's a binary. 14 00:01:18,060 --> 00:01:20,440 Now you get a report that looks like this. 15 00:01:20,440 --> 00:01:29,040 The scan time is directly proportional to the size of the binary, so the bigger the binary, the more time it will take for the scan to finish. 16 00:01:30,360 --> 00:01:36,000 And if you go to the recent section, it will actually show you the files that you have recently scanned. 17 00:01:36,380 --> 00:01:42,780 So let's do one thing, let's take one of the files so that I can give you a walkthrough of static analysis. 18 00:01:42,780 --> 00:01:45,480 So I'm taking this particular app. 19 00:01:45,640 --> 00:01:51,740 Let's take that and let's take a look into the report. 20 00:01:52,480 --> 00:01:57,540 The static analyzer report have different sections, so we will go through each of them quickly. 21 00:01:57,860 --> 00:02:08,440 On the top, you have the information section where it will actually show you the app scores, the various app scores like average CVSS, the security score, the number of trackers identified from the app, etc. 22 00:02:08,440 --> 00:02:14,560 Then we have the file information section that shows the name of the file, the size, the basic hashes of the file. 23 00:02:14,780 --> 00:02:24,260 And the app information section shows different information about the app, like the package name, the main activity, the version, so on and so forth. 24 00:02:24,380 --> 00:02:33,160 And after that, you have a section that will actually show you the activities, services, receivers and providers, like the number of these components. 25 00:02:33,160 --> 00:02:36,700 These are like the fundamental components of an Android application. 26 00:02:36,860 --> 00:02:40,160 It will also list out what components are exported. 27 00:02:40,400 --> 00:02:49,660 When you talk about exported components, these are the components which can be invoked or called upon by a different app running inside the device. 28 00:02:50,140 --> 00:03:01,460 So if you look at it from an application security perspective, there are certain cases when you do not want a third-party application to access or invoke a particular activity or a service in your application. 29 00:03:01,460 --> 00:03:03,720 So you need to be careful about that. 30 00:03:03,720 --> 00:03:08,660 This needs to be manually investigated and see if this is a possible security issue. 31 00:03:09,300 --> 00:03:16,000 Then comes the scan options, where you can actually do a rescan or you can perform dynamic analysis. 32 00:03:16,000 --> 00:03:17,440 We'll come to that later. 33 00:03:17,580 --> 00:03:24,540 Also, it shows you the decompiled code, where it actually shows you the decompiled Android manifest file. 34 00:03:24,540 --> 00:03:29,040 So that's the decompiled Android manifest XML file. 35 00:03:29,260 --> 00:03:33,180 And then you can also go through the Java source code. 36 00:03:33,180 --> 00:03:35,500 The decompiled Java source code is listed. 37 00:03:35,500 --> 00:03:36,980 All the files are listed. 38 00:03:36,980 --> 00:03:41,720 If you want to search for something inside the file, you can find inside the file. 39 00:03:41,720 --> 00:03:45,720 Like in this case, the string SSL is present in these three different files. 40 00:03:46,280 --> 00:03:58,780 Similarly, if you want to search for a particular file name, like if you want to search for activity, the files that contain the word activity, then you can search that here and it will list out all the files that contain the word activity. 41 00:04:01,660 --> 00:04:07,520 Similarly, you can even view the Smiley code corresponding to the binary. 42 00:04:07,520 --> 00:04:11,220 Mobisoft also convert the DEX code into Smiley. 43 00:04:11,220 --> 00:04:15,760 And if you're interested in looking into Smiley source code, you can look into this section. 44 00:04:15,920 --> 00:04:21,080 Like Java source code, you can find inside the files or you can search for a specific file as well. 45 00:04:22,060 --> 00:04:30,920 And this section will also allow you to download the Java source code, the download the Smiley source code, or even you can download the APK itself. 46 00:04:31,240 --> 00:04:34,220 And then comes sign a certificate. 47 00:04:34,220 --> 00:04:48,000 So this section lists out the basic information about the code signing certificate, like the version of the signature, the hash algorithm used, the fingerprint, the issuer identification, so on and so forth. 48 00:04:48,000 --> 00:05:00,060 Also, Mobisoft does some checks on the signer certificate to see if there are any misconfigurations, like whether the app is signed with a debug certificate or if it's actually using a weak hash algorithm, things like that. 49 00:05:00,060 --> 00:05:06,220 So if it detects anything, it will actually show that in the certificate status section with a small description. 50 00:05:06,220 --> 00:05:12,440 So that's actually quite handy when you're analyzing production-ready Android applications. 51 00:05:13,820 --> 00:05:16,720 The next section will list out permissions. 52 00:05:16,720 --> 00:05:22,620 So you can see the table shows the permission that's used by the app, status, info, and description. 53 00:05:22,720 --> 00:05:30,320 So this is something that you can actually use to check and verify that the permissions used by the applications are actually necessary. 54 00:05:30,320 --> 00:05:35,040 Then again, it strengthens the point of least privilege model. 55 00:05:35,040 --> 00:05:38,240 So you should always have an application with the least permissions. 56 00:05:38,240 --> 00:05:41,600 So use only the permissions that are actually required. 57 00:05:41,600 --> 00:05:46,060 Do not provide permissions that are not required by the application. 58 00:05:46,240 --> 00:05:51,740 Also, if you note here, you can see the status as normal, dangerous, and signature or system. 59 00:05:51,740 --> 00:05:57,220 The reason why you see dangerous here is that this is one feature that can be abused. 60 00:05:57,220 --> 00:06:03,380 Let's say this was a third party application and you're doing a black box testing or you're doing a malware analysis. 61 00:06:03,380 --> 00:06:15,220 Then this might be one permission that can be actually abused by the application like using the Bluetooth or like connecting to internet to exfiltrate data and things like that. 62 00:06:15,220 --> 00:06:18,300 So some of the permissions are actually considered dangerous. 63 00:06:18,300 --> 00:06:20,920 It does not mean that the permission is dangerous. 64 00:06:20,920 --> 00:06:22,180 It depends upon the context. 65 00:06:22,180 --> 00:06:27,320 Like if it's a malicious app, then it might be a dangerous permission that the app is actually requesting. 66 00:06:27,320 --> 00:06:32,980 The next section is shared library binary analysis. 67 00:06:33,220 --> 00:06:47,040 So what happens here is if your application is having any native code, for example, if you're using JNI or you're using an SDK which has a native code, then you will have shared objects. 68 00:06:47,140 --> 00:06:50,800 So we do binary analysis on the shared objects. 69 00:06:50,800 --> 00:06:56,880 We check and see if there are some misconfigurations while it's actually being compiled or built. 70 00:06:57,320 --> 00:06:57,900 Things like that. 71 00:06:57,900 --> 00:07:03,600 So if you identify any security issues on the shared object that will be listed under binary analysis. 72 00:07:05,460 --> 00:07:12,880 This section actually give you a quick idea about what this app is capable of doing from looking at the APIs that's actually being used. 73 00:07:12,880 --> 00:07:27,020 It's quite handy if you're doing malware analysis or you're doing, you know, black box pen testing on third party application like it will give you an idea about what are the core functionalities of the app and then you can start your investigation from the critical APIs. 74 00:07:28,520 --> 00:07:31,300 After that you have the browsable activities. 75 00:07:31,760 --> 00:07:39,660 So this section lists out all the browsable activities like all the activities that can be browsed by a particular scheme. 76 00:07:39,960 --> 00:07:44,120 The scheme is a good place to start fuzzing the application. 77 00:07:44,180 --> 00:07:48,040 You can take out the scheme and then append the first string and perform fuzzing. 78 00:07:48,040 --> 00:07:54,700 So you can see how the application or the particular activities behaving with your fuzzing input. 79 00:07:56,080 --> 00:07:58,640 After that comes security analysis. 80 00:07:58,640 --> 00:08:08,840 In security analysis we have manifest analysis where we actually perform a static analysis on the Android manifest files and pull out any insecure findings. 81 00:08:08,840 --> 00:08:13,500 So you can see the issue, the severity and the description corresponding to each issue. 82 00:08:14,160 --> 00:08:16,900 And then moving on, you have the code analysis section. 83 00:08:16,900 --> 00:08:22,860 So this is a section where mobiles have performed a static analysis on all the decompiled Java files. 84 00:08:22,860 --> 00:08:26,100 And if it finds any issues, it will list out the issues. 85 00:08:26,200 --> 00:08:30,380 So it's not just issues, it will also list out informational issues. 86 00:08:30,380 --> 00:08:33,940 It will also list out any good findings as well. 87 00:08:33,940 --> 00:08:47,660 So the table has the issue description, the severity, the CVSS score of the issue, the CW identifier and we also classify the different issue under OWASP top mobile risk. 88 00:08:47,660 --> 00:08:54,280 So you can see a classification identified corresponding to the issue and the files with the findings. 89 00:08:54,380 --> 00:08:56,820 After that you have the file analysis section. 90 00:08:56,820 --> 00:09:03,100 This section will actually list out all the sensitive files like certificates that are hard-coded in the application. 91 00:09:03,100 --> 00:09:10,240 It will also help you to identify any accidentally hard-coded certificates like private keys and things like that. 92 00:09:10,240 --> 00:09:12,370 So that's the file analysis section. 93 00:09:13,120 --> 00:09:16,060 After that we have malware analysis. 94 00:09:16,720 --> 00:09:20,060 Under that we have APK ID analysis. 95 00:09:20,060 --> 00:09:39,380 APK ID looks into the DEX files and tells us the possible behavioral patterns like the kind of compiler being used if an obfuscator was used or does the DEX file has code that corresponds to anti-VM detection or anti-debugging checks, things like that. 96 00:09:39,380 --> 00:09:45,500 So it gives you a good idea about the behavior of the application from code perspective. 97 00:09:46,260 --> 00:09:49,960 And after that we have a section called domain malware check. 98 00:09:49,960 --> 00:09:59,760 So what it does is it actually extracts out all the domains from the binary and checks that against a non-list of rogue or bad domains or IPs. 99 00:09:59,760 --> 00:10:12,580 So we have a database of non-malware related IPs and domains and all the domains inside the binary is actually checked against those to see if it's actually present in that database. 100 00:10:12,580 --> 00:10:18,140 And based on that you have a status that tells if this particular domain is good or bad. 101 00:10:18,140 --> 00:10:22,700 And we also do geolocation on all the domains that's available inside the app. 102 00:10:22,700 --> 00:10:29,460 So you can even plot that to Google Map to see what's the location of the particular IP address. 103 00:10:30,340 --> 00:10:34,060 Alright, now comes the reconnaissance section. 104 00:10:34,440 --> 00:10:40,260 Here, Mobilesoft will actually list out all the URLs extracted from the different source code files. 105 00:10:40,280 --> 00:10:48,200 Similarly, if your application is having Firebase database, Mobilesoft will also extract all the Firebase database URL from the app. 106 00:10:48,200 --> 00:10:52,840 It also performs an additional check to see if the database is exposed to the internet. 107 00:10:52,840 --> 00:11:00,960 And in the next section, Emails, Mobilesoft will extract out all the emails that it found from the source code. 108 00:11:00,960 --> 00:11:03,160 And after that comes trackers. 109 00:11:03,160 --> 00:11:12,620 Trackers are possible SDKs or add-ons that actually do telemetry collection on the application's behalf. 110 00:11:12,620 --> 00:11:18,700 Sometimes it can be a privacy concern, so it will list out all the trackers that's used inside the app. 111 00:11:18,740 --> 00:11:25,800 And there's a URL that actually explains what kind of trackers and some analytics with respect to the tracker. 112 00:11:25,860 --> 00:11:29,360 So that's also available from Mobilesoft. 113 00:11:32,420 --> 00:11:35,120 And finally, in this section, we have strings. 114 00:11:35,120 --> 00:11:42,000 So this will actually list out all the hard-coded strings in the binary, especially the ones from the string resource. 115 00:11:42,000 --> 00:11:52,240 So if there is any hard-coded sensitive API keys or any other secrets in the string section, that will be dumped and shown over here. 116 00:11:52,240 --> 00:11:58,780 After that, we have the components, which is nothing but the different components of the application. 117 00:11:58,780 --> 00:12:06,140 It will list out all the activities, services, receivers, providers, and any libraries that's used by this particular application. 118 00:12:07,200 --> 00:12:11,740 Also, it will list out all the files inside the application binary. 119 00:12:12,420 --> 00:12:15,580 And after that, you have the PDF report section. 120 00:12:15,580 --> 00:12:19,660 So this allows you to generate a nice and beautiful PDF report. 121 00:12:19,660 --> 00:12:23,920 So let me generate a PDF report. 122 00:12:23,920 --> 00:12:27,740 And that's the Mobilesoft Static Analysis PDF report. 123 00:12:27,740 --> 00:12:33,440 It gives a PDF report with high-level information about the different findings. 124 00:12:33,660 --> 00:12:42,600 It's quite handy if you want to document your security analysis for audit or for getting mobile application security certifications, etc. 125 00:12:44,680 --> 00:12:54,740 So in order to start Dynamic Analysis, I can click on Start Dynamic Analysis from here, or I can actually perform Dynamic Analysis after Static Analysis. 126 00:12:54,740 --> 00:13:04,600 Like, I can go to one of the Static Analysis reports, and from there, if I go to the Scan Options, I can perform Dynamic Analysis from there as well. 127 00:13:04,600 --> 00:13:06,000 It's up to you. 128 00:13:06,000 --> 00:13:08,380 So I'm clicking Start Dynamic Analysis. 129 00:13:09,860 --> 00:13:22,900 And if I take the console, I can see that there are some operations happening, like ADB restarted, waiting for two seconds, trying to connect to this device, so on and so forth. 130 00:13:23,920 --> 00:13:32,840 So Mobilesoft will automatically prepare the environment, connect to the VM, and then install the APK so that we can perform Dynamic Analysis. 131 00:13:32,840 --> 00:13:42,680 So since I have used Android version 7.0, we are actually seeing a lot of options which are related with Frida. 132 00:13:43,480 --> 00:13:51,860 So here, there's an option called Show Screen, which will cast the device screen to the web interface. 133 00:13:51,860 --> 00:13:55,720 So if I enable that, I will be able to see my screen here. 134 00:13:55,720 --> 00:14:00,300 I can also do some basic operations like touches and clicks. 135 00:14:04,860 --> 00:14:12,800 Now you can remove the Mobilesoft Root CA, which is responsible for intercepting the traffic from the device if you want to. 136 00:14:12,800 --> 00:14:18,120 So that will remove the Root CA, and if you want to install that again, you can click on Install. 137 00:14:19,040 --> 00:14:24,620 The Exported Activity Tester allows you to dynamically test for exported activities. 138 00:14:24,620 --> 00:14:31,720 This helps you to create proof-of-concepts dynamically, and you can verify your findings from Static Analysis. 139 00:14:31,720 --> 00:14:43,600 So I'm clicking Start Exported Activity Tester, and if I take the VM, you can see that an activity is invoked, then closed, another activity is invoked, and closed. 140 00:14:43,600 --> 00:14:51,880 So what happens in the background is Mobilesoft will go through all the exported activities, open them, and take a screenshot of it, and then store it for you. 141 00:14:52,000 --> 00:14:55,080 So that's useful for proof-of-concept generation. 142 00:14:55,080 --> 00:15:06,260 Similarly, if you want to brute-force all the activities, you can perform Start Activity Tester, which is a good way to brute-force non-exported activities forcefully. 143 00:15:07,300 --> 00:15:15,000 Also, you can take screenshots, like if you want to take screenshots of something, you can click on Take Screenshot, that will take a screenshot. 144 00:15:16,580 --> 00:15:25,320 Also, you can see the Logcat stream, so this is the Android Logcat stream from the device, so if you want to debug something, you can look here. 145 00:15:25,380 --> 00:15:27,780 And finally, you have a button called Generate Report. 146 00:15:27,780 --> 00:15:33,640 This is the option that tells Mobilesoft, let's stop all the analysis and generate a report. 147 00:15:33,960 --> 00:15:37,100 You have to press that when you're done with your analysis. 148 00:15:37,100 --> 00:15:43,840 Now, talking about dynamic analysis, Mobilesoft does not provide an option for automated dynamic analysis. 149 00:15:43,840 --> 00:15:49,480 It only provides an interactive environment for semi-automatic dynamic analysis. 150 00:15:49,880 --> 00:15:55,140 The reason being, Mobilesoft does not know what the business logic of your application is. 151 00:15:55,140 --> 00:16:02,060 It does not know about the username, the password fields, and how to fill them, and what other data it should provide. 152 00:16:02,060 --> 00:16:11,500 So in order to get the most out of Mobilesoft dynamic analysis, you need to manually go through the different business logic and flaws of the application. 153 00:16:11,700 --> 00:16:17,280 And in the background, Mobilesoft will perform security analysis on these different flaws. 154 00:16:17,280 --> 00:16:19,680 You can see the activity log in here. 155 00:16:19,760 --> 00:16:23,480 Also, if there is any errors, that will be listed under the Errors tab. 156 00:16:24,500 --> 00:16:28,280 Now below that, there is some Frida scripts related option. 157 00:16:28,280 --> 00:16:34,020 You will see a default section, which will actually show you the default Frida scripts that are loaded with Mobilesoft. 158 00:16:34,020 --> 00:16:35,720 We have API monitoring script. 159 00:16:35,720 --> 00:16:39,360 This script will monitor all the critical APIs at runtime. 160 00:16:39,360 --> 00:16:45,060 We have the SSL pinning bypass script, which is responsible for bypassing SSL pinning. 161 00:16:45,380 --> 00:16:47,960 Then there is a root detection bypass script. 162 00:16:47,960 --> 00:16:51,660 If your application is performing root detection, it will bypass that. 163 00:16:51,660 --> 00:16:56,700 Similarly, it will also bypass debugger checks using the debugger check bypass script. 164 00:16:56,700 --> 00:17:01,980 So these are some useful default scripts that loads with Mobilesoft by default. 165 00:17:01,980 --> 00:17:04,280 If you do not want any of them, you can uncheck them. 166 00:17:04,280 --> 00:17:07,360 Otherwise, you can have them by default. 167 00:17:08,720 --> 00:17:11,740 And after that comes the auxiliary section. 168 00:17:11,740 --> 00:17:13,280 We'll come to that later. 169 00:17:13,480 --> 00:17:21,640 So in order to start dynamic analysis, the first thing that you need to do is start instrumentation. 170 00:17:21,640 --> 00:17:28,540 You can see that your application will get loaded here and it will be instrumented by Mobilesoft. 171 00:17:28,540 --> 00:17:34,300 If you look into the console, you can see the application has spawned. 172 00:17:34,300 --> 00:17:39,960 We can see a couple of Frida scripts being loaded and some messages that are coming from the Frida scripts. 173 00:17:40,720 --> 00:17:51,360 So once you instrument the app with Frida, in order to see the output generated by these scripts, you can look into the console or the best place to look into is Frida Live Logs. 174 00:17:51,640 --> 00:17:55,880 Frida Live Logs will show all the output from the different Frida scripts. 175 00:17:56,160 --> 00:18:03,660 So if you're running a custom Frida script or if you're writing a custom Frida script and if you want to see the output, this is the place that you need to look into. 176 00:18:04,640 --> 00:18:09,720 Once you click on Start Instrumentation, you should be navigating through the different floors of the app. 177 00:18:09,840 --> 00:18:15,900 I'm actually going through the different floors of the app so that Mobilesoft can actually perform security analysis in the background. 178 00:18:27,780 --> 00:18:30,820 Now you can see that I've done some operations in here. 179 00:18:30,820 --> 00:18:38,360 Okay, so one another thing that I want to show is that if you scroll up, you'll see a new field called Live API Monitor. 180 00:18:38,420 --> 00:18:43,180 So this button will be enabled only if you instrument the app. 181 00:18:43,180 --> 00:18:51,460 So once you instrument the app, you can see the Live API Monitor, which will capture all the API calls that are happening at runtime. 182 00:18:51,460 --> 00:19:15,120 Once inside the API Monitor, you can see the API name, the class, the method that was called at runtime, the arguments passed to the method, the result, if there was any, the return value, if the method returns a value, and then called from, which actually shows from where that method was actually called. 183 00:19:15,120 --> 00:19:20,660 So this method was called from base64.java at line number 494. 184 00:19:20,660 --> 00:19:31,040 This is a helpful feature that allows you to identify the API calls which are made at runtime, what are the arguments being passed, from where are they being getting called, things like that. 185 00:19:31,040 --> 00:19:32,100 Quite useful. 186 00:19:32,220 --> 00:19:36,460 From the Dynamic Analyzer, you have access to Frida Code Editor. 187 00:19:36,500 --> 00:19:41,720 So if you want to write custom Frida scripts, you can write in here and you can just click on Start Instrumentation. 188 00:19:41,720 --> 00:19:46,620 You also have a set of pre-built scripts that comes with MobileSub. 189 00:19:46,620 --> 00:19:48,300 These are some helper scripts. 190 00:19:48,380 --> 00:19:51,680 So if you want to load a script, you can click on that and click on Load. 191 00:19:51,680 --> 00:19:53,960 That will load the script contents in here. 192 00:19:53,960 --> 00:20:01,380 And once you have the contents in here, you can just click on Start Instrumentation, and that will instrument the app and load it with your custom script. 193 00:20:02,060 --> 00:20:04,140 Now we will talk about auxiliary scripts. 194 00:20:04,140 --> 00:20:11,100 So these are some very useful scripts that you can use while you are performing dynamic analysis of an Android application. 195 00:20:11,100 --> 00:20:13,780 Let's start with Enamorate Loaded Classes. 196 00:20:13,780 --> 00:20:19,080 As the name suggests, it will enamorate all the classes loaded at runtime. 197 00:20:19,080 --> 00:20:21,440 So let's click on Start Instrumentation. 198 00:20:23,960 --> 00:20:25,780 Our app is loaded. 199 00:20:25,880 --> 00:20:31,740 Now if you look into Frida Livelogs, you can see the classes that are loaded at runtime. 200 00:20:31,740 --> 00:20:38,780 So if you need to understand what are the classes loaded by the application at runtime, you can make use of this auxiliary script. 201 00:20:39,660 --> 00:20:40,200 Okay. 202 00:20:40,200 --> 00:20:44,680 Similarly, there is another auxiliary script called Capture Strings. 203 00:20:44,680 --> 00:20:48,580 What it does is it tries to capture all the strings at runtime. 204 00:20:48,580 --> 00:20:50,680 So let me start instrumentation. 205 00:20:52,920 --> 00:20:54,680 My app is running. 206 00:20:54,680 --> 00:21:00,500 Let me go through different flows so that there are possible strings in here. 207 00:21:05,490 --> 00:21:06,730 Yep. 208 00:21:06,730 --> 00:21:09,630 Now let me look into the Frida Logs. 209 00:21:09,950 --> 00:21:15,940 And you'll see that there are a couple of strings being caught by this auxiliary script. 210 00:21:18,580 --> 00:21:20,650 Now let's see Capture String Comparison. 211 00:21:20,650 --> 00:21:26,910 So this is a useful auxiliary script that will capture all the string equal comparisons. 212 00:21:26,990 --> 00:21:29,070 Let's instrument the app. 213 00:21:33,600 --> 00:21:39,840 Then let's go through some flows, hoping that there are some string comparisons happening. 214 00:21:42,320 --> 00:21:50,380 Now if I click on Frida Livelogs, you can see all the string comparisons that happened at runtime. 215 00:21:50,400 --> 00:21:57,500 Like that's the first argument, that's the second argument, and the comparison returns false because they are not equal. 216 00:21:57,500 --> 00:22:07,480 So this is also one quite handy feature when you are playing CTFs where you actually want to capture the flag, where the flag is actually getting compared with the user input and things like that. 217 00:22:07,480 --> 00:22:09,040 So it's quite useful. 218 00:22:09,160 --> 00:22:13,540 Now we have an auxiliary script called Enumerate Class Methods. 219 00:22:13,540 --> 00:22:16,460 Like the name suggests, it will enumerate all the methods of a class. 220 00:22:16,460 --> 00:22:22,460 For example, if you have a class and you want to know what are the methods supported, you can give that here. 221 00:22:23,440 --> 00:22:26,700 And then let's click on Start Instrumentation. 222 00:22:29,610 --> 00:22:36,330 And if you look at Frida Livelogs, you can see the different methods supported by the class. 223 00:22:36,330 --> 00:22:41,330 So it will get all the methods and implementations of the class java.io.file. 224 00:22:41,330 --> 00:22:50,190 Again, this is actually quite handy if you're trying to dig into third-party classes where you do not have documentation available on what are the methods available. 225 00:22:50,190 --> 00:22:56,970 So you can easily, you know, obtain all the methods and implementations of third-party classes. 226 00:22:58,450 --> 00:23:00,910 Now we have Search Class Pattern. 227 00:23:00,910 --> 00:23:06,850 So this feature allows you to search for a particular class at runtime using pattern. 228 00:23:06,950 --> 00:23:13,070 Like for example, you are actually analyzing an Android application and it has a custom SSL pinning code. 229 00:23:13,070 --> 00:23:18,610 And the default SSL pinning bypass that comes with mobile stuff is not detecting it. 230 00:23:18,610 --> 00:23:24,710 You might want to investigate and find out what is the custom code responsible for SSL pinning. 231 00:23:24,710 --> 00:23:28,230 So for that, you can use the class pattern search. 232 00:23:28,230 --> 00:23:32,150 Like you can search for class names that have SSL in it. 233 00:23:32,150 --> 00:23:34,910 So if I just instrument the app. 234 00:23:38,950 --> 00:23:44,270 And check the logs, I can see that pattern matches found. 235 00:23:44,270 --> 00:23:47,250 So these are the classes which are string SSL in it. 236 00:23:47,250 --> 00:23:52,570 So with this auxiliary script, you can easily find and filter out classes based on a particular pattern. 237 00:23:55,030 --> 00:23:58,790 And finally, we have something called Trace Class Methods. 238 00:23:58,790 --> 00:24:03,970 This is another useful and handy feature that allows you to trace class methods. 239 00:24:03,970 --> 00:24:13,610 Like for example, if you have a class and if you want to see what are the methods of the class that are invoked at runtime, what are the arguments passed, what's the return value. 240 00:24:13,610 --> 00:24:15,910 Similar to that of API monitor. 241 00:24:15,910 --> 00:24:25,030 But if you want to do that on a custom method, you can actually provide The class name here so that it will trace all the class methods. 242 00:24:25,110 --> 00:24:26,430 Let's put a class. 243 00:24:26,430 --> 00:24:34,670 So let's use Java.lang.string And then let's instrument the class. 244 00:24:41,520 --> 00:24:44,540 Let's try to go through one of the flow. 245 00:24:49,680 --> 00:24:52,480 Let's look into the Frida Live logs. 246 00:24:53,260 --> 00:25:02,220 And you can see that class tracing all the method implementation of Java.lang.string There was this method called hashCode. 247 00:25:02,220 --> 00:25:06,520 This was the argument and that's the return value. 248 00:25:07,440 --> 00:25:14,840 Similarly, it also called equals and that was the argument and that's the return value. 249 00:25:14,840 --> 00:25:17,460 And you can see other methods in this particular class. 250 00:25:17,460 --> 00:25:25,700 And this helps you to isolate monitoring to a particular class like what are the methods of a particular class that are being called at runtime. 251 00:25:26,180 --> 00:25:30,580 What are the arguments being passed, what's the return value and things like that. 252 00:25:30,580 --> 00:25:36,940 Now that you have explored most of the features of Dynamic Analyzer, let's see how we can generate a report. 253 00:25:36,940 --> 00:25:39,800 For that, click on generate report. 254 00:25:43,520 --> 00:25:49,280 So this is a report generated after dynamic analysis of an Android application. 255 00:25:49,280 --> 00:25:53,180 Here under information section, we have API monitor view. 256 00:25:53,340 --> 00:26:00,400 You can see all the APIs that were captured at runtime, their arguments, return value, the caller function, etc. 257 00:26:02,160 --> 00:26:06,720 And you also have Frida logs view, which will show all the Frida logs. 258 00:26:08,960 --> 00:26:11,380 And you have startHttpTools. 259 00:26:11,380 --> 00:26:12,880 We'll come to that later. 260 00:26:12,880 --> 00:26:17,880 You can also see the raw Frida API monitor logs. 261 00:26:18,140 --> 00:26:20,220 That's a JSON log. 262 00:26:21,080 --> 00:26:24,360 Similarly, you can see the raw Frida logs. 263 00:26:26,200 --> 00:26:28,320 You can see the raw HTTPS traffic. 264 00:26:28,320 --> 00:26:32,220 So if there was any HTTPS traffic, that will be shown here. 265 00:26:32,220 --> 00:26:35,780 Since there was no traffic generated, there is nothing in here. 266 00:26:36,300 --> 00:26:38,740 Again, logcat logs. 267 00:26:40,120 --> 00:26:42,300 The dumpsys logs. 268 00:26:43,040 --> 00:26:44,840 And the application data. 269 00:26:44,840 --> 00:26:47,740 So if you click on that, it will ask you to download a file. 270 00:26:47,740 --> 00:26:51,080 And that file consists of the application data. 271 00:26:51,080 --> 00:26:55,160 That's the data that is created by the application inside the device. 272 00:26:55,700 --> 00:27:06,280 And then we have the Frida API monitor, where we will list out the different critical APIs or methods that were called at runtime. 273 00:27:06,540 --> 00:27:11,240 We have the class name, the method, the arguments, the caller activity, etc. 274 00:27:11,240 --> 00:27:16,660 So this is more of a nice representation of what you have seen in API monitor view already. 275 00:27:17,000 --> 00:27:19,520 And then you have the results from exported activity tester. 276 00:27:19,520 --> 00:27:24,120 So if you run the exported activity tester, that will invoke all the exported activities. 277 00:27:24,120 --> 00:27:25,680 Take a screenshot of that. 278 00:27:25,680 --> 00:27:28,840 So this is something that you can use in your proof of concept. 279 00:27:28,840 --> 00:27:34,220 In this particular case, you can see that this particular exported activity has some sensitive information. 280 00:27:34,600 --> 00:27:39,140 Also, if you have run activity tester, you will see similar results in here. 281 00:27:39,140 --> 00:27:43,280 And if you have taken any screenshot, that will be shown here. 282 00:27:43,680 --> 00:27:47,600 And then we have malware analysis, which has domain malware check. 283 00:27:47,600 --> 00:27:50,260 So these are the domains which were captured at runtime. 284 00:27:50,800 --> 00:27:52,700 And then there is clipboard dump. 285 00:27:52,700 --> 00:27:57,160 So if the application copies anything to the clipboard, that will be shown here. 286 00:27:57,160 --> 00:27:59,960 So we dump the device clipboard. 287 00:28:00,500 --> 00:28:03,640 Similarly, all the URLs, emails. 288 00:28:03,920 --> 00:28:06,080 And then we have file analysis. 289 00:28:06,080 --> 00:28:10,860 Here it will list out all the SQLite database created by the application inside the device. 290 00:28:11,000 --> 00:28:16,420 You can go through the database and it will dump the contents of the database. 291 00:28:19,660 --> 00:28:26,260 Similarly, you can read the XML files or the shared preference files created by the application inside the device. 292 00:28:29,340 --> 00:28:31,740 And there are other files as well. 293 00:28:31,880 --> 00:28:34,140 And finally, you can download or print the report. 294 00:28:34,140 --> 00:28:38,640 So that's a walkthrough of different sections of Android dynamic analysis report. 295 00:28:43,830 --> 00:28:46,290 And finally, you can use HTTP tools. 296 00:28:46,290 --> 00:28:48,470 Let's click on start HTTP tools. 297 00:28:50,310 --> 00:28:54,270 Now you can see that all the captured traffic is actually visualized here. 298 00:28:54,270 --> 00:28:56,430 So you can see the request response pair. 299 00:28:56,430 --> 00:29:03,590 Now if you want to repeat this request to a specialized security tool like Burpsuite, you can use the send to fuzzer option. 300 00:29:03,890 --> 00:29:06,430 So before doing that, let's run Burpsuite. 301 00:29:13,810 --> 00:29:15,850 Let's go to the proxy tab. 302 00:29:16,030 --> 00:29:19,090 And then obtain the proxy IP and port. 303 00:29:19,090 --> 00:29:22,210 So the proxy is on localhost 8080. 304 00:29:22,570 --> 00:29:28,670 So before repeating the traffic, just make sure that your proxy tool is not on intercepting mode. 305 00:29:28,690 --> 00:29:32,110 So let's go to intercept tab and turn off intercept. 306 00:29:32,470 --> 00:29:41,530 Now if I click on send to fuzzer, it will show this model with a field to enter the proxy IP and port. 307 00:29:41,570 --> 00:29:45,570 So in our case, the proxy IP is localhost 8080. 308 00:29:45,750 --> 00:29:48,450 So let's click on repeat request. 309 00:29:49,470 --> 00:29:51,910 So that will repeat the request. 310 00:29:51,910 --> 00:29:54,110 You can see the progress in the console. 311 00:29:54,110 --> 00:29:57,550 So you can see that a couple of requests are repeated here. 312 00:29:57,550 --> 00:30:02,490 And if you go to the proxy, you can see that the requests are populated over here. 313 00:30:02,490 --> 00:30:10,150 And from here, you can use the specialized tool like Burpsuite to perform web application or API specific security tests. 314 00:30:10,370 --> 00:30:16,410 I would like to give a shout out to our active collaborators, Maghafi, Mattan and Vincent. 315 00:30:16,410 --> 00:30:31,730 Also, I would like to thank all the major contributors who had helped us with the various product features, like Netguru team who helped us with the iOS SIFT support, Dominic, Amrita, Shanil, Maxim, Abhinav, Shuksan and Ekstaban. 316 00:30:32,150 --> 00:30:35,730 If you have any questions, you can contact me over email or Twitter. 317 00:30:35,730 --> 00:30:36,690 Thank you.