- Hello, and welcome to this new video of Android Security and Exploitation
by Pentester Academy. My name is Aditya, and I am your course instructor for this
entire training series. So in this particular video, we are going to have a
look at the Damn Insecure and Vulnerable Application, which is also known as
DIVA. Now, this is a vulnerable application created by Aseem Jakhar of
Payatu, and made in order to help you understand the different vulnerabilities
in Android applications. Now, a lot of these vulnerabilities is something which
you have already gone through in the Android Security for Pentesters course
by SecurityTube? So, this might act as a learning experience or something
where you can apply what you've already learned in the previous videos into
another vulnerable application? And if you're completely new to Android
security, it is also a good starting point to understand what different kind of
security issues are present in Android applications. Now, apart from DIVA, there
are a couple other vulnerable apps which you can also go through; some of them are
like GoatDroid, InsecureBank, Intrepidus Learner, and so on? So before
moving forward, this entire course is available at securitytube-training.com and
pentester academy.com? So, DIVA is an open-source application and you can
download the source code from this Github URL. Also, you can simply download the
application binary from this shortened URL? So let me just go ahead and
download the application as well as install it on my virtual device.
So this is my Santoku VM. Let me simply SSH into it.
And go to Desktop/PentesterAcademy/. So in this case I have already downloaded the
zip file which contains the DIVA apk. So simply extract it, and I get the apk file
here? Let me also make sure that my Genymotion device is connected. And now
that my Genymotion device is connected, I can go ahead and install the DIVA
apk.
So, this is how the application looks
like. Saying "Welcome to DIVA" and there are a couple of different exercises
ranging from insecure logging to hardcoding issues, insecure data storage,
and input validation, and so on? So there are a bunch of exercises with which
you can play with. So I'll just start with the first one, which is insecure logging.
So, insecure logging actually tells you what different ways in which Android
application logs something sensitive to the Android logcat. Now if you have seen
the videos, you must be knowing that Android maintains a centralized logcat
which is accessible to all the applications on the device. So if an
application developer wants to log something, maybe for debugging purposes,
he can use the Android logcat and log the information over there?
And you as a pentester or security researcher, access that logcat over adb,
or the Android Debug Bridge. Or you can create another application which can read
the logcat? So in this case, let's run this exercise. And it's simply asking
me to run the credit card number. So I'll go in and enter the credit card number.
Obviously this is not my real number. So I can--I've entered the credit card number
over here, and in the meanwhile, I'll just check the logcat for this particular
application. So I can grep for the process ID, and I can do a logcat adding
grep of that particular process ID. So "adb shell ps | grep -i diva", and I get
the process ID of 1676. Now we can do "adb logcat" and grep for 1676. And
try to enter the credit card number. And if you see here, it simply says, "An error
occurred. Please try again later." But if you look in the logcat, you see the entire
message as well as the credit card number. So in this case, the credit card number,
which is a sensitive information, is being leaked through the logcat And this
is what the security vulnerability is. So whenever you build an application, you
should ensure that you're not logging anything sensitive in the production build
of the application. Or if you're using another library, like ProGuard, that
will actually take care of that as well. So that's all for this video, and if you
have any feedback or queries, you can send me email at adi@attify.com and you can
check out the entire course at securitytube-training.com and
PentesterAcademy.com. Thank you.