So, I'm Gabrielle. I'm an Offensive Security Advisor at Desjardins.
And I do different things. I'm involved in the community,
on different advisory boards.
I'm not going to bore you too much with this.
I'm going to go straight to the point.
So, what is Android Application Pen Test?
So, I'm pretty sure everyone here knows what a pen test is.
So, I'm not going to make a definition of this.
So, it's a type of pen test that is part of a list that pen testers usually provide.
And so, most of us are generalists.
But usually we can, you know, get an expertise in something.
And so, we can be network experts, we can be mobile experts.
So, it really depends.
And so, Android app is different from other pen tests
because most of the time we will have an executable to analyze.
And so, for example, for web apps, you will have a URL.
But for an external pen test, you will have an IP address.
But for a mobile pen test, we have an executable.
So, we can externalize it or we can dynamically analyze it.
So, yeah, except if you're doing a white box pen test.
So, you will have probably code on other pen tests.
But most of the times, there's not.
Except if you do white box, of course.
So, why? That's a tough question.
Well, even if Google Play carefully chooses the app for the store,
there are still apps that are vulnerable or even dangerous.
Like in July 2022, there was this family of app by Kelly Tech.
It was installed about 3 million times on Android.
And it was a malware family.
So, it was describing users to premium services
without them even knowing they were subscribing to premium services.
And it took around six months to Google to remove it from the app stores.
So, that's partly why.
And also, I'm going to tell you what about Android APIs.
So, why do dev use APIs in the first place?
So, for example, it's a very convenient way to access to remote data.
So, for example, if you want a weather forecast,
if you want social media platforms, if you want cloud storage services,
it's very convenient.
It's also very convenient for third-party integration,
like payment gateways or things like this.
If you want to improve your app performance,
it's also very convenient because it reduces the amount of data
that needs to be transferred between app and server.
And you can also request only the data that you need.
And also, it's a way to avoid code reuse.
So, instead of writing everything from scratch,
you just take code that is already made,
and it's very convenient, and you will save time and effort.
And it's flexible and scalable,
and so it's a way to separate back-end from front-end.
And finally, if you want, you can make your own APIs,
and you can monetize them.
So, a lot of very good advantages.
So, here is the Android application pen test process.
So, first we have to define the scope.
And so, we are going to take care of the legal matters.
So, this is going to be the planning phase, the first one, you can see.
Then you have the reconnaissance.
So, it's as usual in a pen test, there is a reconnaissance phase.
Here, what you can do more than in other pen tests
is that you can check out on Google Play
any infos you can find about the app,
and do some reconnaissance on the company.
And so, then you have the static analysis.
So, you are going to look at the code.
You are going to check for specific elements there.
So, I'm going to go a little more in detail in this later.
And then you have the dynamic analysis.
So, you are going to intercept the traffic
and look for potential vulnerabilities.
And finally, you have the report phase,
where you are going to present and explain the findings you've had.
So, we'll dive into the three here a little later.
So, about the lab...
Okay, the lab installation is probably way bigger than in any other pen test,
because you have this huge setup.
And if you have never done this before, it can be a little overwhelming.
So, I'm going to explain also how to set up
an Android pen test application lab.
So, what do you need?
So, you will need JADX.
So, JADX is going to be useful to decompile the code for analysis.
You can also use an APK tool, which I really like,
because it goes further than JADX.
You can reverse-engineer the APK.
You can make modifications to the code,
and then you can put it back into an APK file,
which is pretty convenient.
You can also use ADB.
So, you are going to be able to interact with the device or VM.
And in our case, I'm going to show you the setup for a VM.
And you have also Android Studio to create the VM.
And you have Burpsheet to intercept the response and the request,
and to analyze the traffic.
So, this is the setup for the lab.
So, how to install.
So, this is made for Ubuntu.
But if you check the resource at the end of the matrix,
you will find the info for other systems.
So, for JADX, you need Java.
And you can use the command on the screen to install Java.
And then you just launch it with ./.jadxgui.
For ADB, you can also use the command on the screen.
It's really, really straightforward.
And for APK tool and Android Studio,
just go to the links and follow the steps.
Like, the documentation is very good,
so you should be all set for this.
So, first now, I'm going to show you a video
on how to set up the emulator.
Okay, if it's working...
Okay, perfect.
Okay, so you can go to Android Virtual Device Manager.
And you can click on Add a Virtual Device.
And so you can choose the hardware you want.
So, depending on what hardware you want to use, really.
So, then you choose it, you click Next.
And then you will have to choose a system image.
So, you have to be careful.
In the Android manifest, you will be able to see the API level.
So, this way you can choose the proper API level,
so that your application actually works
on the device you are going to do.
And you give it a name, and you should be good to go.
So, I had plenty, so I had to take another name.
Like, it's not very creative.
Okay, and then you just click here.
And I'm going to go a little further.
So, it's going to launch.
It takes a little while.
And then you will have a screen that looks like this here.
Okay.
So, next is going to be how to configure BURP.
So, it's another video.
So, you will have to go to proxy options.
You are going to need a certificate.
So, you select DER, but you are going to name it CER.
And you put it in a place where you remember.
Okay, and then you will have it successfully exported.
And you can drag it and drop it in.
You can actually use ADB, but you can also drag and drop.
It's pretty fast and straightforward.
And so, it's going to be in the phone, but you are going to need to install it as well.
So, you have to go to the settings and security.
And then you have to go to the... from... it's like here.
Install from SD card.
So, don't go to download straight away. Just go to internal storage.
Like, there's a glitch on the video, but it's the one.
And then you go to download.
You give it a name that you will remember afterward.
And you are going to be prompted to make a PIN, so just make a PIN.
So, I always put this off because I don't need it. It's a VM.
And I put a very safe PIN, as you can see.
And yes, I disabled the notification as well, because it can be...
But everything is installed.
And then we can try to see...
First, we need to go to the burp again.
And to add the interface.
So, you are going to need to bind it to a port.
So, remember which one.
I put 8082, but it can be anything that is not busy.
And all interfaces.
So, this way you will be able to intercept all the traffic on 8082.
And you have to do the setup here.
In the proxy tab, in the settings.
There's a proxy tab, and you change it here.
So, one thing here is to be careful, because you are going to change it.
And the apply button is going to light up.
Don't forget to click it once you have done the changes.
Because if you don't do this, it's not going to remember the changes.
And now we can just check.
So, we check that the intercept is on, and we should be able to intercept traffic.
And that's how it works.
So, that's for...
So, for the example, this is the apps I used.
So, one is called PIVA, which is Purposefully Insecure and Vulnerable Android Application.
And one is called Injured Android.
And so, just a reminder that you need to have the authorization before testing anything.
And next is the static analysis.
So, we are going to check the Android manifest.
And the strings.xml.
We can also enumerate database.
So, there are plenty of tools on GitHub for this purpose.
And, of course, you can check for sensitive data.
Like, I really recommend that you check for sensitive data.
And so, first, I'm going to show you some examples on the Android manifest file.
But before this, I want to show you how to check the code.
So, you can use either JADX or APK tool.
So, if you use JADX... So, this is a command. We saw it before.
And if you use APK tool, you can use this one.
And you will have the decompiled file that will look like this.
And so, when you want to analyze the code for API endpoints...
So, you can search for keywords like HTTP or HTTPS.
You can look for functions or classes that will handle network requests or responses.
So, I will show you an example later.
You can analyze the manifest file.
So, there are going to be metadata about the app.
You can check for declared permissions.
You can check for service and activities.
You can also look for permissions that are related to network communications.
And you can also analyze GES and AIDL files.
So, if it uses WebView or Android interface definition language, which is AIDL.
So, this is going to be used for inter-process communication.
So, you might find API endpoints in there.
And so, I'm going to show an example in GES also in another slide.
So, this is how it's called.
So, this is really an example of the code.
So, you have here an asynchronous task.
I'm sorry with my accent. It's awful.
Asynchronous.
And so, that makes a GET request to an API endpoint.
So, what's an asynchronous task?
It's a way to perform a long-running operation in the background
without blocking the user interface.
So, for example, say you want to load a large file.
You're going to use an asynchronous task.
So, that's the one.
And then, this is how to fetch the API.
So, here we are going to have an Android app that uses WebView to display a web page.
And so, in the web page, we can see that GES communicates with an API to fetch data.
And so, you have JavaScript code here that calls the fetch data function that you can see here.
And it makes a GET request to an API endpoint.
So, this is api.example.com.
So, it's pretty obvious.
So, now I'm going to show you a fun finding.
Fun for Pentester, but not that fun for developers, I'm afraid.
So, you can find hard-coded secrets.
So, during static analysis phase, you might find hard-coded API keys.
I hope you will find less and less of these.
And so, in this article, we have an example of this in this article on your left.
There are still lots of Android apps that still have hard-coded secrets.
And in the video here that I really recommend you watch,
Alyssa Knight found...
She found a private key with a blank password.
So, that's not working either.
So, in the next slide, I'm going to show you an example of an API key.
And this is in Geo.Android, and so they left us a Google API key.
So, you can always check strings for .xml.
So, it's located in slash res slash values.
And this is a nice way to find things like this.
So, here we have an API key.
But it should be stored securely outside of the app.
And if you find this, you have to report it.
It's obvious, but I prefer to say it.
Okay, so here is a quick video to make search with Jadix GUI.
So, you have this little one tool here.
And you can basically check for anything, and you will find everything in here.
But as we are going to see, there are other ways as well.
You can grab it.
I really prefer this method to grab it.
Because sometimes it's really way more simple to make a grab directly in the decompiled code.
So, with APK tool, you probably have all the decompiled it all and everything.
And you can grab it in the folder where you have all the decompiled code.
And also, if you use MobSF, there's a slash uploads directory.
And you will have a lot of code in here.
And so, you can also grab in this directory if you want to.
And if you want more grab commands, you can check out my Git book.
There's a link here with more tips on grab.
Here are some tools for static analysis.
So, Firebase enum is going to let you find Firebase instances.
And Firebase scan is going to check for misconfigurations.
Cloud enum is going to check for cloud instances from different providers.
And it's useful to enumerate database or public resources in the cloud.
And sometimes, just like we saw before, you can find also AWS secret key.
And so, you can try to use it to access resources on AWS.
So, it's really also something that's worth mentioning in the report if you find it.
So, what to check during the dynamic analysis?
So, this is the part where we are going to intercept the traffic with burp and analyze it.
So, this is the phase where we are going to check also for tabjacking.
So, it's a clickjacking equivalent, but in mobile app.
Are you able to capture screens that contain sensitive data?
Also, check the AWS top 10.
But I'm going to show you some examples.
So, first, how to find API endpoint during the dynamic analysis phase?
So, these are pretty common endpoints that we can find.
But you can also fuzz and use a word list with plenty of API endpoints.
This one is just an example, but you can find plenty online.
And I really also recommend the Seqlist repository. It's very good.
And now, I'm going to show you an example of a vulnerability for an Android application.
So, this is not going to be a sensitive app.
This is going to be PIVA, but let's pretend for the sake of the example that this is a banking application, for example.
So, you go to this page, which should be, let's say, your information.
And you go to anywhere else in the phone, and then you go back.
And you still see all the information is private here.
So, this should not happen.
You have a specific function that could let you block this.
So, this is a vulnerability that you have to mention.
So, this is an example.
So, just like with any other pen test, we have automatic tools.
So, this does not replace your critical thinking.
So, you cannot only rely on those.
But you can also use them to gain some time.
So, the thing that you have to do, though, is to verify that everything it finds is not a false positive.
So, we can use MobSF, but you can also use Quark.
So, Quark is going to help you to find common security vulnerabilities in Android.
And you can also create a proof of concept, like evidence for tapjacking, for example.
So, it's really a good gain of time.
And so, these are general tips for common API vulnerabilities to look for.
So, we have... the first one is one I have a tendency to find quite often.
So, it's when you are able to access to resources that do not belong to you.
So, you can check for these vulnerabilities.
You can use the link to the OWASP top 10 here to find the more vulnerabilities that you can look for.
And for more details on API pen test, there's also a link to my Git book here as well.
And so, one thing to be careful is the context.
Because sometimes you are going to find a vulnerability that is going to be exploitable in the context of a web application, but not of a mobile application.
So, if we take CORS, for example, it's a mechanism that will allow a web app to make a request to a different origin than the one from which the application was served.
So, it will allow you to prevent malicious website to access sensitive information from other websites.
So, it's not applicable to an Android application because it's not in a web browser context.
But, if the Android application interacts with a web service or an API that implements CORS, then it could be vulnerable.
So, the context is really important and I would recommend that if you have a doubt, just still report it, but as informational.
Another general tip is to use a checklist.
So, you can use a checklist to have all the checks for OWASP top 10.
So, it's really convenient because you have the most common vulnerabilities we have in the wild.
There is an amazing tool that works for this. It's called MindAPI. You have the link here. It's by David Sopas.
It's very, very good and it does good work as a checklist.
And also, you have a snippet here of a checklist from the book that you can see here, Black Hat GraphQL.
And it's for API pen test, for GraphQL API pen test.
And you can find it in the book of Nick, Alex, and Dolev Pari.
And so, there are also multiple advantages to using a checklist.
Like, it's a way to make a consistent and standardized pen test.
It's a way also to make sure that you are going to cover every aspect of your target.
And also, it helps you stay organized.
And you will have also a detailed record of your testing activities, which is really, really convenient.
Because sometimes you might forget what you have tested.
Believe me, it happens. I have a tendency sometimes to test multiple times.
So, this is why I stick on a checklist.
And it makes you more efficient and it helps you gain time.
So, I really recommend this.
And you can also make your own checklist if you don't feel like anything here is good.
You can just make your own and do your thing.
Okay, how to report.
So, this is the usual structure of any pen test report.
You have the executive summary and you have the part vulnerability report.
The second part vulnerability report can also be used for bug hunters.
So, the executive summary is going to be for the executives of a company.
So, it's going to need a high-level explanation, no technical details, and a global posture on why findings and attack combination could impact the company.
So, I'm going to show also an example of the vulnerability I mentioned before.
So, here we have the severity.
So, you change it according to the context and to the application.
And it can be higher or lower.
And the general description.
So, then you have this general description until input.
And then you have the context.
The context is also very important.
And this is also where you put your evidence, the request and the response.
And then, here are the remediation steps.
So, it can be more detailed than this, but the slide is quick.
But you can put way more details than this.
And you have also resources that you can provide for people who are going to correct a vulnerability to actually have references that they can rely on, which is really helpful.
And that's it.
So, you can get the slides and all the resources here.
So, I didn't put together a list of resources because it would have been like 10 slides.
So, you can find them all here.
It's going to be easier.
And it's organized and everything.
And also, I did an article on Pentest Magazine.
And I also did a blog post.
So, the article is 29 USD, but the blog post is free.
So, if you want to check it out.
And if you want to check what you remembered from this presentation, there's also a quiz that you can do.
Thank you.
Thank you, everyone.