Now, I have to say before starting this lecture that you do not mix these two things, log in and logging,
right?
I mean, hopefully, you know that already, but logging is about the log messages that are produced
by an application when performing any number of tasks.
Right.
We can also capture important information from the log messages insecure bank application uses Log Dot
D as its method to produce log messages.
All right.
So let's get started.
Open the bytecode viewer.
And let's look at the do log in activity.
Now, there's no law class here, so open the other one.
And let's search it.
Aha, here it is.
The do log in activity produces a debug log message whenever a user attempts to log in using the log
dot the method.
So these logs can be dumped using log cad.
Lorgat is a command line tool that dumps a log of system messages, including stack traces when the
device was an error and messages that you have written from your app with the long glass usually used
by developers to check if the application is working properly.
You see where we're going with this, so let's try to capture these logs.
So first, we'll check the connectivity.
All right, that's not a problem.
Run EDB Lorgat.
And as you can see, there are lots and lots of log messages.
So we need to only get the credentials so we can filter the results.
Although it can be a little complicated, you can always do it with a few Linux commands.
So the command that you see here on the screen, we can get the log message that we want.
The grid command allows us to search plaintext data sets for lines that match a regular expression.
OK, is mostly used for pattern scanning and processing.
So let's log into the app and see the result.
And as you can see, just by filtering, we reached the log message so much easier.
Of course, his command is very complicated and there's alternative solutions to get the credentials
from log messages.
There's a very useful tool that makes this process easy.
It's called PIDE Cat, and it's an excellent log color script, which only shows the log entries for
processes from a specific application package.
In fact, we can even install the Pinkert with the Apte get installed command.
So let's run Pidcock to see if it works.
OK, now we need to supply the target package as a sole argument to Pigot.
Animal, right, pig, cat, and give the package name.
OK, so definitely more useful and a great tool.
So log into the app again.
And what do you know, there's a successful Log-in message and get the credentials.