Now, you do remember the Android manifesto XML file, it contains some well, shall we call them weak
points?
There are exported activities that are shared and accessible with any other app on the device.
We can bypass a login mechanism using this vulnerability, how convenient.
So let's get started.
So make sure that the Android emulator and application server are running.
Open up a new terminal screen.
Change directory to downloads folder.
Run Java dash jar as your command to open the bytecode viewer.
And the APK file from the file tab on the top of the menu.
Open it and you might have to wait for a bit.
So let's have a look at the Android manifest file.
So you might want to search for exported activities.
And we can see the shared activities with the other apps and the device.
So we can use the post login activity to bypass the login mechanism, it's indicated that the activity
is displayed after it posts a login.
So using HDB, I can call this exported activity.
Open up a new tab on the terminal screen and switch the user to route.
So let's check the connection of the Android virtual device.
Yep, it's on the list.
So we can run ADB Shell and start Dashan.
And give the full path name of the post login activity.
A.M. calls the activity manager and performs various system actions, we'll use it to start an activity.
OK, so enter.
Now, let's check the application.
So look at that, we logged in with our credentials.
So this brings us to the post login activity that should only be available after logging and successfully.
Demonstrating that the log in can indeed be bypassed entirely.