start	end	text
9140	13860	So, I'm Gabrielle. I'm an Offensive Security Advisor at Desjardins.
14020	18180	And I do different things. I'm involved in the community,
18180	20080	on different advisory boards.
20080	22000	I'm not going to bore you too much with this.
22000	24100	I'm going to go straight to the point.
25240	29460	So, what is Android Application Pen Test?
31400	39790	So, I'm pretty sure everyone here knows what a pen test is.
39790	42930	So, I'm not going to make a definition of this.
43210	49410	So, it's a type of pen test that is part of a list that pen testers usually provide.
49690	53010	And so, most of us are generalists.
53010	58030	But usually we can, you know, get an expertise in something.
58030	63710	And so, we can be network experts, we can be mobile experts.
63710	65050	So, it really depends.
65150	70190	And so, Android app is different from other pen tests
70190	74410	because most of the time we will have an executable to analyze.
75070	79490	And so, for example, for web apps, you will have a URL.
79590	84430	But for an external pen test, you will have an IP address.
84530	87970	But for a mobile pen test, we have an executable.
87970	91910	So, we can externalize it or we can dynamically analyze it.
92410	96830	So, yeah, except if you're doing a white box pen test.
96830	99750	So, you will have probably code on other pen tests.
99750	101650	But most of the times, there's not.
101850	104170	Except if you do white box, of course.
110650	114450	So, why? That's a tough question.
114690	121030	Well, even if Google Play carefully chooses the app for the store,
121030	124750	there are still apps that are vulnerable or even dangerous.
124750	131390	Like in July 2022, there was this family of app by Kelly Tech.
131390	137270	It was installed about 3 million times on Android.
137270	140010	And it was a malware family.
140230	144750	So, it was describing users to premium services
144750	149430	without them even knowing they were subscribing to premium services.
149430	155790	And it took around six months to Google to remove it from the app stores.
157290	162190	So, that's partly why.
162190	170730	And also, I'm going to tell you what about Android APIs.
170730	174130	So, why do dev use APIs in the first place?
174130	182970	So, for example, it's a very convenient way to access to remote data.
182970	185690	So, for example, if you want a weather forecast,
185690	189590	if you want social media platforms, if you want cloud storage services,
189590	190990	it's very convenient.
191450	196110	It's also very convenient for third-party integration,
196110	199750	like payment gateways or things like this.
199750	202390	If you want to improve your app performance,
202390	206730	it's also very convenient because it reduces the amount of data
206730	210290	that needs to be transferred between app and server.
210690	214890	And you can also request only the data that you need.
215510	219130	And also, it's a way to avoid code reuse.
219370	222470	So, instead of writing everything from scratch,
222470	225510	you just take code that is already made,
225510	229070	and it's very convenient, and you will save time and effort.
229070	232370	And it's flexible and scalable,
233130	240410	and so it's a way to separate back-end from front-end.
240630	244850	And finally, if you want, you can make your own APIs,
244850	246830	and you can monetize them.
247210	251170	So, a lot of very good advantages.
253210	258530	So, here is the Android application pen test process.
258530	261630	So, first we have to define the scope.
261970	265730	And so, we are going to take care of the legal matters.
265730	268790	So, this is going to be the planning phase, the first one, you can see.
268930	270710	Then you have the reconnaissance.
270710	274030	So, it's as usual in a pen test, there is a reconnaissance phase.
274250	277030	Here, what you can do more than in other pen tests
277030	279270	is that you can check out on Google Play
279270	283010	any infos you can find about the app,
283930	286910	and do some reconnaissance on the company.
287790	290810	And so, then you have the static analysis.
290810	292930	So, you are going to look at the code.
293350	296030	You are going to check for specific elements there.
296030	299650	So, I'm going to go a little more in detail in this later.
299870	301910	And then you have the dynamic analysis.
301910	304370	So, you are going to intercept the traffic
304370	306870	and look for potential vulnerabilities.
307190	309630	And finally, you have the report phase,
309630	315070	where you are going to present and explain the findings you've had.
315070	320270	So, we'll dive into the three here a little later.
324280	327020	So, about the lab...
327020	333500	Okay, the lab installation is probably way bigger than in any other pen test,
333500	335800	because you have this huge setup.
335800	341200	And if you have never done this before, it can be a little overwhelming.
341600	345400	So, I'm going to explain also how to set up
345400	350920	an Android pen test application lab.
352660	354460	So, what do you need?
356600	361600	So, you will need JADX.
361600	365280	So, JADX is going to be useful to decompile the code for analysis.
365440	368480	You can also use an APK tool, which I really like,
368480	370900	because it goes further than JADX.
370900	373480	You can reverse-engineer the APK.
373480	375840	You can make modifications to the code,
375840	379020	and then you can put it back into an APK file,
379020	380800	which is pretty convenient.
381320	383320	You can also use ADB.
383320	388920	So, you are going to be able to interact with the device or VM.
388920	392160	And in our case, I'm going to show you the setup for a VM.
392920	397500	And you have also Android Studio to create the VM.
397600	402320	And you have Burpsheet to intercept the response and the request,
402320	404100	and to analyze the traffic.
408820	411920	So, this is the setup for the lab.
411920	412920	So, how to install.
412920	414820	So, this is made for Ubuntu.
415140	418440	But if you check the resource at the end of the matrix,
418440	421700	you will find the info for other systems.
422340	424240	So, for JADX, you need Java.
424300	428840	And you can use the command on the screen to install Java.
428860	433320	And then you just launch it with ./.jadxgui.
434020	437440	For ADB, you can also use the command on the screen.
437440	439280	It's really, really straightforward.
439340	442560	And for APK tool and Android Studio,
442560	445240	just go to the links and follow the steps.
445240	447140	Like, the documentation is very good,
447140	450160	so you should be all set for this.
453920	457020	So, first now, I'm going to show you a video
457660	460140	on how to set up the emulator.
467730	471730	Okay, if it's working...
473470	475170	Okay, perfect.
483060	488200	Okay, so you can go to Android Virtual Device Manager.
488200	493160	And you can click on Add a Virtual Device.
493400	496020	And so you can choose the hardware you want.
496020	501900	So, depending on what hardware you want to use, really.
502720	506500	So, then you choose it, you click Next.
506500	509980	And then you will have to choose a system image.
510000	511560	So, you have to be careful.
511760	516260	In the Android manifest, you will be able to see the API level.
516720	519520	So, this way you can choose the proper API level,
519520	522580	so that your application actually works
522580	525000	on the device you are going to do.
528160	531520	And you give it a name, and you should be good to go.
536460	540760	So, I had plenty, so I had to take another name.
540760	542380	Like, it's not very creative.
543680	545840	Okay, and then you just click here.
546000	548120	And I'm going to go a little further.
548120	549880	So, it's going to launch.
549880	551180	It takes a little while.
551180	555200	And then you will have a screen that looks like this here.
559260	560060	Okay.
561180	565060	So, next is going to be how to configure BURP.
565060	566660	So, it's another video.
569700	576260	So, you will have to go to proxy options.
576420	578440	You are going to need a certificate.
579220	584260	So, you select DER, but you are going to name it CER.
584460	586900	And you put it in a place where you remember.
594770	599110	Okay, and then you will have it successfully exported.
599130	601890	And you can drag it and drop it in.
602310	606190	You can actually use ADB, but you can also drag and drop.
606190	608230	It's pretty fast and straightforward.
610430	614910	And so, it's going to be in the phone, but you are going to need to install it as well.
614910	618510	So, you have to go to the settings and security.
625970	633810	And then you have to go to the... from... it's like here.
634470	636150	Install from SD card.
636150	639710	So, don't go to download straight away. Just go to internal storage.
639710	644590	Like, there's a glitch on the video, but it's the one.
644790	646690	And then you go to download.
647890	652730	You give it a name that you will remember afterward.
653610	658390	And you are going to be prompted to make a PIN, so just make a PIN.
659870	663930	So, I always put this off because I don't need it. It's a VM.
664870	668090	And I put a very safe PIN, as you can see.
675680	679580	And yes, I disabled the notification as well, because it can be...
679580	681320	But everything is installed.
683520	686860	And then we can try to see...
686860	693000	First, we need to go to the burp again.
693000	695560	And to add the interface.
695560	698720	So, you are going to need to bind it to a port.
698720	700720	So, remember which one.
700720	704660	I put 8082, but it can be anything that is not busy.
705420	706880	And all interfaces.
706880	711420	So, this way you will be able to intercept all the traffic on 8082.
712060	715120	And you have to do the setup here.
715560	719480	In the proxy tab, in the settings.
719620	722820	There's a proxy tab, and you change it here.
722820	726540	So, one thing here is to be careful, because you are going to change it.
726540	729660	And the apply button is going to light up.
729840	732400	Don't forget to click it once you have done the changes.
732400	737480	Because if you don't do this, it's not going to remember the changes.
743030	745470	And now we can just check.
745470	750150	So, we check that the intercept is on, and we should be able to intercept traffic.
750150	751610	And that's how it works.
759620	761580	So, that's for...
761580	764380	So, for the example, this is the apps I used.
764380	770300	So, one is called PIVA, which is Purposefully Insecure and Vulnerable Android Application.
770300	773380	And one is called Injured Android.
773380	779620	And so, just a reminder that you need to have the authorization before testing anything.
788000	790720	And next is the static analysis.
790720	794060	So, we are going to check the Android manifest.
794240	796440	And the strings.xml.
796440	798860	We can also enumerate database.
798860	802400	So, there are plenty of tools on GitHub for this purpose.
802660	804980	And, of course, you can check for sensitive data.
804980	807780	Like, I really recommend that you check for sensitive data.
808200	813560	And so, first, I'm going to show you some examples on the Android manifest file.
813960	817820	But before this, I want to show you how to check the code.
818460	822800	So, you can use either JADX or APK tool.
822800	825880	So, if you use JADX... So, this is a command. We saw it before.
825880	829100	And if you use APK tool, you can use this one.
829100	832600	And you will have the decompiled file that will look like this.
837490	844730	And so, when you want to analyze the code for API endpoints...
845530	851370	So, you can search for keywords like HTTP or HTTPS.
851370	856690	You can look for functions or classes that will handle network requests or responses.
856690	858810	So, I will show you an example later.
858810	862190	You can analyze the manifest file.
862390	866230	So, there are going to be metadata about the app.
866230	868430	You can check for declared permissions.
868430	870930	You can check for service and activities.
870990	875930	You can also look for permissions that are related to network communications.
876030	881290	And you can also analyze GES and AIDL files.
881290	888390	So, if it uses WebView or Android interface definition language, which is AIDL.
888390	891650	So, this is going to be used for inter-process communication.
891830	894730	So, you might find API endpoints in there.
894930	899490	And so, I'm going to show an example in GES also in another slide.
901790	904270	So, this is how it's called.
904270	907990	So, this is really an example of the code.
907990	911110	So, you have here an asynchronous task.
911110	913130	I'm sorry with my accent. It's awful.
913430	914350	Asynchronous.
914350	918530	And so, that makes a GET request to an API endpoint.
918530	920150	So, what's an asynchronous task?
920150	925470	It's a way to perform a long-running operation in the background
925470	928230	without blocking the user interface.
928230	931290	So, for example, say you want to load a large file.
931490	934390	You're going to use an asynchronous task.
936450	939750	So, that's the one.
939750	944250	And then, this is how to fetch the API.
945390	952810	So, here we are going to have an Android app that uses WebView to display a web page.
952870	959190	And so, in the web page, we can see that GES communicates with an API to fetch data.
959270	965210	And so, you have JavaScript code here that calls the fetch data function that you can see here.
965230	969530	And it makes a GET request to an API endpoint.
969530	973330	So, this is api.example.com.
973330	975750	So, it's pretty obvious.
976290	980850	So, now I'm going to show you a fun finding.
983150	987750	Fun for Pentester, but not that fun for developers, I'm afraid.
988670	992670	So, you can find hard-coded secrets.
992670	1000210	So, during static analysis phase, you might find hard-coded API keys.
1000210	1002710	I hope you will find less and less of these.
1003250	1009730	And so, in this article, we have an example of this in this article on your left.
1013870	1019270	There are still lots of Android apps that still have hard-coded secrets.
1019270	1024770	And in the video here that I really recommend you watch,
1024770	1027270	Alyssa Knight found...
1027270	1031470	She found a private key with a blank password.
1031870	1034150	So, that's not working either.
1034730	1038550	So, in the next slide, I'm going to show you an example of an API key.
1042020	1048280	And this is in Geo.Android, and so they left us a Google API key.
1050700	1056300	So, you can always check strings for .xml.
1056360	1060900	So, it's located in slash res slash values.
1060900	1064300	And this is a nice way to find things like this.
1064300	1066360	So, here we have an API key.
1066400	1069660	But it should be stored securely outside of the app.
1069660	1072520	And if you find this, you have to report it.
1073100	1076000	It's obvious, but I prefer to say it.
1078590	1086670	Okay, so here is a quick video to make search with Jadix GUI.
1090870	1093870	So, you have this little one tool here.
1093870	1099310	And you can basically check for anything, and you will find everything in here.
1101050	1105470	But as we are going to see, there are other ways as well.
1109530	1111030	You can grab it.
1111850	1115810	I really prefer this method to grab it.
1115990	1121710	Because sometimes it's really way more simple to make a grab directly in the decompiled code.
1121750	1129410	So, with APK tool, you probably have all the decompiled it all and everything.
1129410	1133310	And you can grab it in the folder where you have all the decompiled code.
1133330	1138190	And also, if you use MobSF, there's a slash uploads directory.
1138190	1143190	And you will have a lot of code in here.
1143350	1147570	And so, you can also grab in this directory if you want to.
1147870	1153490	And if you want more grab commands, you can check out my Git book.
1153490	1158970	There's a link here with more tips on grab.
1165150	1168850	Here are some tools for static analysis.
1168850	1174140	So, Firebase enum is going to let you find Firebase instances.
1174610	1179290	And Firebase scan is going to check for misconfigurations.
1179310	1183590	Cloud enum is going to check for cloud instances from different providers.
1183850	1190150	And it's useful to enumerate database or public resources in the cloud.
1190150	1197130	And sometimes, just like we saw before, you can find also AWS secret key.
1197130	1201510	And so, you can try to use it to access resources on AWS.
1201830	1206170	So, it's really also something that's worth mentioning in the report if you find it.
1209610	1211970	So, what to check during the dynamic analysis?
1211970	1218150	So, this is the part where we are going to intercept the traffic with burp and analyze it.
1218150	1223170	So, this is the phase where we are going to check also for tabjacking.
1223390	1226930	So, it's a clickjacking equivalent, but in mobile app.
1226930	1231250	Are you able to capture screens that contain sensitive data?
1232010	1234430	Also, check the AWS top 10.
1234770	1237570	But I'm going to show you some examples.
1241580	1248000	So, first, how to find API endpoint during the dynamic analysis phase?
1248000	1251900	So, these are pretty common endpoints that we can find.
1251900	1257280	But you can also fuzz and use a word list with plenty of API endpoints.
1257280	1260360	This one is just an example, but you can find plenty online.
1260520	1264560	And I really also recommend the Seqlist repository. It's very good.
1267820	1277460	And now, I'm going to show you an example of a vulnerability for an Android application.
1282180	1287260	So, this is not going to be a sensitive app.
1287260	1293580	This is going to be PIVA, but let's pretend for the sake of the example that this is a banking application, for example.
1293580	1298400	So, you go to this page, which should be, let's say, your information.
1299080	1303480	And you go to anywhere else in the phone, and then you go back.
1304960	1308460	And you still see all the information is private here.
1308460	1309880	So, this should not happen.
1309880	1314420	You have a specific function that could let you block this.
1314420	1317320	So, this is a vulnerability that you have to mention.
1317800	1319480	So, this is an example.
1328230	1333870	So, just like with any other pen test, we have automatic tools.
1333870	1336930	So, this does not replace your critical thinking.
1336970	1339650	So, you cannot only rely on those.
1339650	1343910	But you can also use them to gain some time.
1343910	1352070	So, the thing that you have to do, though, is to verify that everything it finds is not a false positive.
1352270	1355810	So, we can use MobSF, but you can also use Quark.
1355810	1360530	So, Quark is going to help you to find common security vulnerabilities in Android.
1360530	1367130	And you can also create a proof of concept, like evidence for tapjacking, for example.
1367130	1369750	So, it's really a good gain of time.
1373270	1379070	And so, these are general tips for common API vulnerabilities to look for.
1379070	1386510	So, we have... the first one is one I have a tendency to find quite often.
1386510	1392030	So, it's when you are able to access to resources that do not belong to you.
1392130	1394510	So, you can check for these vulnerabilities.
1394570	1400950	You can use the link to the OWASP top 10 here to find the more vulnerabilities that you can look for.
1401490	1407530	And for more details on API pen test, there's also a link to my Git book here as well.
1408370	1414610	And so, one thing to be careful is the context.
1414690	1423190	Because sometimes you are going to find a vulnerability that is going to be exploitable in the context of a web application, but not of a mobile application.
1423190	1434830	So, if we take CORS, for example, it's a mechanism that will allow a web app to make a request to a different origin than the one from which the application was served.
1434850	1443250	So, it will allow you to prevent malicious website to access sensitive information from other websites.
1443250	1450050	So, it's not applicable to an Android application because it's not in a web browser context.
1450050	1458910	But, if the Android application interacts with a web service or an API that implements CORS, then it could be vulnerable.
1458910	1467510	So, the context is really important and I would recommend that if you have a doubt, just still report it, but as informational.
1473290	1478270	Another general tip is to use a checklist.
1478770	1483470	So, you can use a checklist to have all the checks for OWASP top 10.
1483470	1490210	So, it's really convenient because you have the most common vulnerabilities we have in the wild.
1490330	1497170	There is an amazing tool that works for this. It's called MindAPI. You have the link here. It's by David Sopas.
1497170	1502610	It's very, very good and it does good work as a checklist.
1503670	1512710	And also, you have a snippet here of a checklist from the book that you can see here, Black Hat GraphQL.
1512710	1519550	And it's for API pen test, for GraphQL API pen test.
1519590	1523530	And you can find it in the book of Nick, Alex, and Dolev Pari.
1523790	1527970	And so, there are also multiple advantages to using a checklist.
1528030	1532630	Like, it's a way to make a consistent and standardized pen test.
1532970	1538290	It's a way also to make sure that you are going to cover every aspect of your target.
1538290	1540930	And also, it helps you stay organized.
1540930	1546930	And you will have also a detailed record of your testing activities, which is really, really convenient.
1546930	1550090	Because sometimes you might forget what you have tested.
1550090	1554350	Believe me, it happens. I have a tendency sometimes to test multiple times.
1554350	1557030	So, this is why I stick on a checklist.
1557310	1560890	And it makes you more efficient and it helps you gain time.
1561110	1563450	So, I really recommend this.
1563450	1570890	And you can also make your own checklist if you don't feel like anything here is good.
1570890	1574530	You can just make your own and do your thing.
1578530	1580870	Okay, how to report.
1583900	1587280	So, this is the usual structure of any pen test report.
1587280	1591560	You have the executive summary and you have the part vulnerability report.
1591560	1595600	The second part vulnerability report can also be used for bug hunters.
1596420	1602080	So, the executive summary is going to be for the executives of a company.
1602160	1614340	So, it's going to need a high-level explanation, no technical details, and a global posture on why findings and attack combination could impact the company.
1615980	1621500	So, I'm going to show also an example of the vulnerability I mentioned before.
1621780	1624020	So, here we have the severity.
1624020	1628920	So, you change it according to the context and to the application.
1629420	1632480	And it can be higher or lower.
1632700	1634480	And the general description.
1634720	1638580	So, then you have this general description until input.
1638580	1640720	And then you have the context.
1640720	1642720	The context is also very important.
1645320	1652260	And this is also where you put your evidence, the request and the response.
1655090	1659530	And then, here are the remediation steps.
1659530	1665370	So, it can be more detailed than this, but the slide is quick.
1665370	1668650	But you can put way more details than this.
1668650	1680570	And you have also resources that you can provide for people who are going to correct a vulnerability to actually have references that they can rely on, which is really helpful.
1684440	1686000	And that's it.
1686000	1690460	So, you can get the slides and all the resources here.
1690460	1696100	So, I didn't put together a list of resources because it would have been like 10 slides.
1696100	1698420	So, you can find them all here.
1698520	1700000	It's going to be easier.
1700000	1701980	And it's organized and everything.
1709680	1715400	And also, I did an article on Pentest Magazine.
1715400	1717240	And I also did a blog post.
1717240	1721340	So, the article is 29 USD, but the blog post is free.
1721400	1723420	So, if you want to check it out.
1725100	1732040	And if you want to check what you remembered from this presentation, there's also a quiz that you can do.
1739680	1740780	Thank you.
1740840	1742120	Thank you, everyone.