Now, in this lesson, we will continue with a vulnerability in the login mechanism.
Sometimes developers add a temporary account, were a method for testing purposes and then forget to
remove them before publishing the app.
Who would do that?
Let's get started.
So first, let's make sure that Android emulator and the application server are running.
Now let's take a closer look at the perform log-in method of the Lorgat activity that's launched when
the login button is selected.
So the perform log in is a method that creates a new intent, which launches the do log in activity
and then passes the credentials entered by the user as the parameters to this activity.
So we'll go with this activity.
Hmmm, where's the dialogue in activity?
Yup, it is.
But what we're actually looking for isn't here, so let's check the others.
Ah, here is a very interesting method called post data.
So this method is used to send the login credentials to the server.
Now, hopefully you can see here that if we enter the username dev admin and then the credentials would
be sent to a different endpoint called slash dev login.
And that's how we can log in successfully.
Let's go ahead and check it out.
Enter Deve admen for the username without a password.
What do you think we logged in without a password and yeah, that's really fun.
It can be exhilarating to.