So he'd be back in Ubuntu VM.
And now let's play a little bit around with this Android debug bridge.
So therefore I'm having this device over here and I'm plugging this in by USB something I guess you
have not seen before.
Right.
And smartphone being plugged in by a USB.
Okay, so it seems like it has a connection.
Perfect.
Now let's open a terminal and let's execute this command ADB shell and here we can see daemon is not
running and it's being now started on the TCP port 5037.
We can also see daemon has been started successful and we are now on this device walleye I that's the
codename for the pixel two device.
Everything works perfectly fine.
So let's also have look into this service.
If you open a new terminal, we can use nets that with those parameters.
I put this on the left to make this a bit larger.
Let's zoom out.
There we go.
Here we can see we've got something on local host listening.
And this one.
Yes, this is the ADB server right now.
So this one is on is listening on port 5037 on our local host interface.
Let's also observed this connection maybe.
So let's have a look into this one with Wireshark.
Hmm.
Let's see.
We want to listen on this loopback interface.
Oh, yes.
I have to start it with the root privileges.
Let's do this.
All right.
And now if you open a new terminal because you can never have enough of them.
And if you now yeah.
If you're now typing this command adb shell.
So this command will be forwarded to the ADB server, which is sending this to the device which executes
it and provides perspective.
All right.
Let's see.
All right.
And we have seen a lot of packages appear in the background.
Let's have look into them.
Okay.
Let's scroll up.
So here we've got it right now.
And we can do, I guess in right click follow TCP stream.
So then we have it.
And I mean, yes, as already mentioned, it's in text based protocol and there isn't that much going
on over here.
But now you have also seen this right now.
So this one is, I guess, the request and that's the the response.
So we get an okay back.
All right.
Let me see if you're not using this stream.
I mean, we could also use different streams.
Yes.
Then we can see a little bit more action is happening over here.
So within this screen, you also got the second one, a third one in this case.
Okay, I guess.
Yeah, you can you can have look into this one.
Gabby.
He is the result right now.
All right, but for now, enough from this one.
So, yes, we have seen the service running on our on our system.
Now, let's also have look into the service on the device.
Is there really in service running?
So let's figure this out.
P s dash A and I guess, yeah, these are a little bit much.
Let's clear this.
So let's search for ATP and let's also get two lines after and two lines before so that we are not just
having one single line in here and here we have it.
This is the ADB daemon running on this device.
And yes, these are the three components interacting with each other.
So we've got our ADB daemon on this device.
We've got our ADB server I guess already gone, our app server running on local host.
So let's do this once again.
And this one.
And also our ADB binary.
This one over here.
All righty.
Okay, next, let's make this a little bit more challenging.
So let's add another device and then interact with those devices.
Therefore, we are using the emulator.
So let's see which devices we've got available next.
So six.
And this, by the way, was the moment when I realized, oh, we need some root privileges.
And this Nexus five with this Google play store does not have full privileges.
Therefore, I switch to this device, which works perfectly fine during this whole course.
All right, so let's start this one emulator at and then this name.
Okay.
And here we have it right now.
Could if we now open a new terminal and typing in ADB shell, then we're getting an error because we
are now having our device, this one being connected and this emulator and the ADB server does not know
which device we are talking to right now.
So therefore we have to provide the serial number and we can be oops, we can get this with ADB devices.
Got a little bit too exciting right now.
Here we have this perfect.
So this is the serial number of this emulator and this is the serial number of our pixel two device.
So if you want to execute and command on the pixel two device, we have to use ADB dash se serial number
and then for example, shell you, we can see, yes, we are now on walleye, which means this is as
already mentioned, I guess you have heard it quite often.
Right now it's the code name of this pixel two device.
Okay, I stop it right now.
So if you want to execute and command on this emulator, which serial number two we have to use?
Well, it's really this one over here.
So this whole string ADB dash s shell.
There we go.
So now we are on the emulator.
Let's see.
I mean, not sure if you have remembered all those processes and IDs, but this is now the emulator.
Right now we can also see x 86.
Okay.
And this is how we can handle multiple devices.
Now, let's also have a look into an TCP IP connection.
So let's put up our virtual machine, our Android x86 virtual machine and make a connection to this
one.
Because they are we might have some trouble doing this.
And this is something I really would like to show you.
So let's put this up.
Okay.
So here we have the virtual machine now up and running.
And if you want to make a connection to this one, we need to have the IP address and this could be
already the first issue.
So this virtual machine is using an network adapter.
In my case, I have set this to NUT.
And if you want to connect to the virtual machine from our Ubuntu VM, we need to be in the same subnet.
So please make sure that both machines are sharing the same network adapter.
It could be nat or it could be also host only.
This doesn't really matter.
It just has to be the same.
All right.
Okay.
After eliminating this error, we can now fetch this IP address from this virtual machine.
So how can we do this?
Well, there's already an installation being installed which assists us on this.
So if we if we track this upwards, then we can see we've got a terminal emulator.
And this one is super handy because this one is really a terminal on our Android x86 virtual machine.
So we can now use the command, for example, IP address and then we get those interfaces.
And here we can see we've got an loopback interface and the IP address should be normally being assigned
to this w lan zero interface.
And the sounds now a little bit ridiculous because it's in virtual machine.
How could this one have wi fi.
And yes, it does not have wi fi access or not real by fi access, but it's using an virtualized wi
fi to connect to the network adapter.
So in my virtualization, I have chosen a network adapter from Type Nut and this one is now providing
a virtual wi fi for this virtual machine.
All right.
Maybe not, but I would suggest let's have a look into this one.
Okay.
So let's get into the whole menu upwards, one again and then within settings.
Let's see.
Okay.
With the network and internet, we can now see wifi has been turned off so it cannot work this way.
Let's enable it.
All right, let's enable it here and now.
It's searching for wi fi networks, but of course, not one around us.
So the physical networks here, we can now see it has found in virtual network.
So let's connect to this one.
Okay.
So now we can see it's connecting and obtaining IP address.
Perfect.
So this one is now using a virtual wi fi, which is using the network adapter to communicate with the
outside world in case of not why if you're using an host adapter to at least communicate with one network
interface.
All right.
Okay.
So perfect.
This means we should now have an IP address.
Let's see.
Back to the terminal.
Let's repeat the last command.
There we go.
We can see 172 16, 240 and 133.
If everything works out, then we should just remember the last three numbers over here, because we
should be in the same subnet because we're using the same network adapter on our Ubuntu VM.
So we just have to remember the last octet of this IP address over here.
One, three, three.
Let's get back to the Ubuntu VM and then finally, let's make our connection to this one.
So we have to log in once again.
Okay.
And now let's see.
ADB devices, we still got our device and this emulator.
And now if we are using if config, yes, we are within the same subnet.
So we can now use ADB connect one seven tools 16 to 140 133.
So this one is the IP address of our Ubuntu VM and 133 is the IP address of our Android x86 virtual
machine.
All right.
Let's see.
And we are now being connected.
Nice.
If we are executing ADB devices once again here we can see we've got now three devices.
This one, our Android 80 6 p.m., our emulator, our device.
All right.
So now we have been three devices attached to this one.
Yeah, let's make this a bit larger.
Okay, let's clear the screen.
All right.
So now if you want to make a connection to our Android x86 virtual machine, what is the serial number?
I mean, we are having the IP address and it seems like import in here.
Is the IP address really the serial number?
Well, let's find out.
ADB shell.
No, not this way.
ADB desh se serial number and then the command.
Let's see, 3 to 1.
Perfect.
Now we've gotten a different prompt x 86 perfect.
So now we've got the third prompt right now and this is now the prompt for our virtual machine, our
Android virtual machine.
We can verify this by typing in if config because here we should get the IP address of our virtual machine,
which is one, three, three.
Let's see.
And yes, we have it perfect.
So this is how we can interact with all the devices.
But to be honest, this makes things unnecessarily complex.
So what I like to do is having one device attach two to this machine where I'm working with.
And yeah, it's, it's not really required most of the time to have multiple devices at the same machine
right now.
All right.
But nevertheless, you are now well prepared to interact with everything.
Okay, perfect.
Then let's get back.
Okay.
So we have seen the inner working of ADB.
We have also seen how to handle those connections.
Oh, yeah.
One thing which is also pretty cool if we enable or allow this access to in certain device, for example,
this device, you remember this pop up, this one.
Yes, you do, of course.
So this is some kind of acceptance that this laptop is being allowed to connect to this device and these
information are being stored on our local system and also on our device.
So within the home directory we've got the hidden directory.
Let me show this to you, but don't tell anyone.
Okay?
So if you press control h, then we can enable or see all those hidden directories.
They've got a dot in front on a linux system.
Let's hit control h once again that no one sees them.
Okay, so now if you are entering this android directory, which should be also available on your system,
then we can see we've got ADB key and ADB key pop.
So let's print this file out maybe.
And this one is now the public key of our ADB key.
So it sounds a little bit complex, but this is simply just asymmetric crypto.
I know simple and crypto in one sentence.
Are you crazy?
But I also do not want to start talking about cryptography right now.
So this is in topic.
I'm talking about within the man in the middle section when we have to look into https right now, I
just want to show you.
Okay, we are having here in public key and we are also having the corresponding private key.
So let's also print this one out.
And this, by the way, it should keep private.
I mean, for me right now, it's way too late.
But you should keep your your private key private, because if someone has this key, this person can
connect to those devices.
I mean, right now, for me, it's not a big deal because these are testing devices or emulators running
on my local system.
But if you're using a private phone, which I also do not recommend, but if you're using it, then
this could be really bad if you lose this key.
So someone with an USB cable or also on the same network can get access to your device.
So keep your private key, please private and do it.
Not the way I do right now.
So just forget about this, okay?
So this is now my ADB key, and we can also verify this key on the device.
So let's see ADB devices.
Let's take this emulator.
ADB Shell.
I'm sorry, ADB s serial number shell.
Now we need root privileges because certain directories cannot be accessed from from the ADB shell context,
which is user ID 2000.
So we need root privileges.
For example, this data data directory here, we get permission denied.
Getting root on our Nexus device is no problem.
We simply type in ACL and we're good to go.
Okay.
Now we can also enter those directories and within data, I guess misc adb.
Yes, yes.
Here we can see we've got now this file ADB keys, let's print this out because this time it's not my
private key.
Of course, this time it's the public key.
So if you compare those two, let's do this once again.
ADB key pop.
Yes.
Okay.
So if we now compare those two stories real quick or let's print out once again.
There we go.
Then we can see these are identical because the public key is being stored on the device.
And by having the private key, we can verify that this connection, everything works fine.
Cryptographic magic happens in the background.
If you are interested in this topic, I will explain this in the HTTPS section.
How Asymmetric Cryptography Works Right now.
Starting this course, we are not interested in doing some cryptography, right?
Yes.
Okay.
So we have also seen this one.
And I guess let's have finally and look into some useful commands of ADB and then we are going to go.
I hope this video hasn't become that long, but yeah, let's see that I do not miss something.
Oh yes.
Did before what?
In reverse.
But first, let's have a look into this one.
Yes, let's pull the smartphone a little bit more.
Right.
Okay.
Let's scroll up.
Let's see what we have here.
Yes.
We've got a lot of commands, so.
And this is the Syria command.
Things we have already seen OC devices also something we have seen connect also forward and reverse.
We will have to look into in reverse example.
All right.
Yes.
Five transfer, push and pull.
This one is this one is important.
So if you want to interact with this device, we need to push and pull files to it.
So app and download files to it.
And this can be done with push and pull.
So for example, let's see and this is a test.
So now we have created a new text file.
Test.
And if you want to upload this to our smartphone, we can use ADB push test.
This is our local file and now we need to specify the destination where we want to upload it.
I make this a little bit larger, then you can see it better.
Okay, so the only two directories which are available on the smartphone which can be accessed easily
from our host system without root privileges, are the SD card and the temp directory.
The SD card is the more interesting one because this one holds all your photos, videos, music downloads,
all this kind of stuff, and this is in its public available directory.
So we can we can use this.
By the way, do not get confused by SD card name, SD card.
It's not in physical SD card.
SD card is the EMC which stands for.
Embedded multimedia card.
Yes, this way.
So this is simply just an chip which acts like an SD card, and therefore it has this name over here.
So it's not a physical SD card.
This one is your internal memory of the smartphone.
All right.
So this is the way to upload this file.
And once again, if you are just having one device connected, then it's it's a little bit easier.
But now we have to use the SE and then the file we want to upload.
Oh sorry.
The command push then the file you want to upload and then the destination where we want to upload it
to OC 3 to 1 push OC.
If you now performing ADB Shell once again, I guess I will unplug it in just a moment.
So let's see.
Okay, I really will unplug it in in really just a moment.
So now we are on the emulator and within the SD card.
Yes, we can see we've got now this text file.
Let's print it out.
Okay.
If you now want to download and file, for example, this great three, we can use ADB pull.
Let me clean this up a little bit that you can see it a little bit better.
Okay.
So now
let's see, let's make a new directory or that's already one that's let's go into this one.
Okay, let's delete those old pack reports.
Okay.
Now we want to download and file which exists on the smartphone to this directory over here and therefore
we can use ADB pull.
And now we have to define the source which is now the file source on the smartphone.
So in this case it's within slash SD card and then this one, for example, Grape and G.
And now we need to define the destination where we want to download this file.
In this case, it's the current directory once again.
Okay.
Let's repeat this whole command.
Okay.
Let's open the directory.
There we go.
So now we have downloaded five from the smartphone to our system.
So this is super handy and we will use this quite often during this course.
So the SD card is some kind of free zone where we can store files and app and download from them from
the whole system.
All right.
Okay.
Back to the help.
Let's see.
Okay.
Push and pull.
Inside something.
We have already seen the subway to install applications.
Back report, also something we have seen and travelled back via protocol.
This is something we will handle in the debugging session.
It's pretty at the end of this course.
Lock it.
This is also pretty important.
So the lock at it's the device lock and this is something you should keep open all the time during an
analysis of an application.
So what I do is running Logcat, then opening the application, playing around with this one, and after
shutting down the application, I will close this locket.
So I will start this into an separate file and then investigate this.
You will find a lot of useful information in there.
For example, user credentials, app tokens, or you can also assist if you want to circumvent some
security features.
For example, certificate pinning.
If the developer has implemented such an security feature, sometimes some useful information being
printed out to this device lock and this can be absolutely helpful in bypassing.
It sounds crazy and to be honest, it also is also things like user credentials or token.
Those information shouldn't be stored in the device lock even if it's not possible anymore to read this
out by third party applications.
All right.
And then very tight.
But this is just for user Deepak builds.
Keagan is generating a new public private key payer for our ADB.
Let's see.
Sideload reboot.
This may be also cool.
We can use Reboot to boot this device into uncertain state, for example, into bootloader or recovery.
This is super handy if we perform some rooting of this device because we can put this into the bootloader
and then flash certain partitions and boot from them afterwards if those security features has not been
enabled.
So we need to unlock things like this, but this will wipe data from the device and make things complex.
Okay, so so you can play around with this one, but you need to be very careful that you do not break
your device already.
Okay.
I also provide you some additional information in the cheat sheet.
So there you will find and let's say most likely safe way to perform some actions.
Okay.
And then we've got a B rule.
So this was a thing, I guess ten years ago.
So we can use ADB Root to restart the ADB daemon with root privileges.
Let me show this to you.
So what I do right now is I unplug this device and I also power of the virtual machine that it's getting
a little bit more easy.
Okay, so now we should only have one device.
Let's see.
But a machine seems to be still powered off.
But yeah, we can also do ADB killed server and then ADB Shell once again.
All right this will automatically start the server and we can see.
Perfect.
We are now connected to this one.
Oops, sorry.
Okay, so if you're now doing an id, we can see why we are accessing the adb shell as uid 2000, which
is the shell access.
All right.
If we now execute this command ADB root and then we can see the ADB demon on this device will be restarted
with root privileges, which means if you are now doing an ADB shell, be instantly have root privileges
in this one.
At the first view, it seems to be not a big deal because we had root privileges anyway.
We could connect to this device and then perform a Q and execute our command.
So yes, this is possible, but having this ADB demon running as root enabled some some more convenient
options.
For example, if we directly want to pull an and file which is within the data data directory, for
example, if you are not having this ADB demon running as root, we cannot execute this command directly
from our host system.
We first have to log in, getting root privileges, copying this file to the sdcard, and then downloading
it from the SD card.
So three or four steps are being involved during this process.
Having the ADB demon running as root, we can simply use it directly from our command line on our host
system.
So this makes things a lot easier, but it can be also a little bit tricky sometimes because having
certain detections, like root detections, this is something you might overlook.
So therefore I'm not going to use this during this course, but feel free to do this to to restart your
ADB daemon with root privileges.
Then you can directly access those files.
Okay.
All right, then.
Let's see.
Let's clear the screen.
ADB help once again.
Okay.
Look at root.
We can see restarting the GB server with USB or TCP IP, but this is not really required.
If you're performing and connect, it's automatically switching to TCP IP Kill server, also something
you have already seen or seen right now.
This simply restarts the server and this is the most recommended troubleshooting guide.
So if you encounter some issues with ADB, simply run ADB kill server and then ADB shell once again.
So restarting the server, turning it off and on again resolves so many problems in case if you still
encounter some other issues.
I have provided you a whole list about errors and then corresponding solutions in the cheat sheet.
So please have a look into this one.
And of course you can also write me if you if you encounter something new.
All righty.
Okay.
So regarding to ADB, I guess we have covered most options right now.
Let's have a final quick look into the reverse, into ADB reverse that this topic is a little bit better
to understand because if you have seen reverse, you also get a better understanding of what forward
means and maybe also getting better understanding what's the difference between those two.
Because for me, it took quite a while until I realized what they are doing.
Okay, so let's see.
Let's stay in this directory and let's create a little website which we can then forward to this smartphone
over here.
Enabling and service from our Ubuntu VM to the smartphone requires ADB reverse enabling and service
on the smartphone to our local machine requires ADB forward.
So let's create inside and then let's see how reverse works and then I guess we are good to go.
Okay, so let's create an index XHTML and now I need some insane HTML skills.
So that type.
All right, let's run this web server.
So.
Python 3 a.m. and then HTTP server.
Now we're having an HTTP server running on our interfaces on Port 8000 and.
You can see perfect ADB, reverse, reverse, wonderful side.
So now let's make this service available to the smartphone.
I mean, it's listening right now to all interfaces, but we could also limited this to local host.
Okay, how can we do this?
Well, if you're using ADB reverse and then TCP because it's in TCP protocol, let's say one, two,
three, four and then TCP 8000.
Yes.
And this means if you're making a connection to localhost on the smartphone on port.
One, two, three, four.
This one will be reversed to this one.
So it will appear on our smartphone, this web server which is running on Port 8000 OC.
Let's see.
We've got no parole, but we've got that view.
This should also work.
Okay.
Let's open HTTP 1 to 7 001 and then one, two, three, four.
So this should print out our website which is running on our ubuntu VM to the smartphone.
Let's see.
3 to 1.
Yes.
I already see those requests and we can see reverse.
And we have no title.
But we can see.
Yes, this is the page.
So this is what reverse means and for what is simply the other way around, for what enables import
or service, which is available on the smartphone to our system over here.
Okay.
All right.
I know it already got late, but let's sum this up with a short slide and then you finally reserve your
first bet.
Okay, so let's do this real quick.
Okay.
Here, I have summarized some important commands ADB installer to install an application, push and
pull to interact with files on our local system, uploading them to the smartphone vice versa.
ADB input touch something we have already seen.
What is also pretty cool is ADB input, text and swipe.
So ADB input text will automatically fill out this form filled with the text we provide via this termina
adb logcat.
Something you should always keep running during your analysis, adb, shell IP and so on.
I mean, that's the shortcut if you want to easily retrieve the IP address from the Virtual Machine
Back report.
Also something we have already seen and which is also pretty cool.
I mean, that's the easiest way to get the the HCI snoop log file.
So the Bluetooth low energy log from this device for many devices, it would be connect if you want
to make an TCP IP connection.
So wi fi for real devices or our virtual machine and also ADB backup, this one will backup our applications.
Any corresponding data in there?
It depends on the developer what is being included, but sometimes this can also lead to security issues.
If you can simply fetch the the secrets of this user account based on a backup.
All right.
Now, after all your patients, I'm absolutely grateful and I'm super happy to provide you your first
bet.
There you go.
Oh, there you go.
So this is the end of our installation process and from now on we will do some really amazing app hacking.
And to be honest, we have already seen some cool tricks.
So the touch or a Bluetooth, low energy, but the next things, they will be way cooler.
So this is something I definitely promise to you.
All righty.
So I'm looking forward to see you in the next chapter.