- Hello all and welcome to the Android Security and Exploitation training series
by PentesterAcademy. I'm Aditya. I'm your course instructor for this entire training
series. So you can check out the certifications at
securitytube-training.com and you can also view the entire course at
pentesteracademy.com. Now, in the previous video, we had a look at the access control
issues and we were able to invoke the activity containing the API and the key
using the intent filter and the activity manager, right. So in this particular
example or this particular issue which is the access control issues part II. It asks
for whether you want to view the TVEETER API credentials and if you click on
register now and click over here, it asks for a pin, right. And it asks you to
register at website and login with that particular pin, right. So the objective is
you're able access the third party app API credentials after you have registered,
right. Now, you can register and the vendor gives you a pin, but what you want
to do is access the API credentials from outside the app without knowing the pin,
and this is quite similar to what we did in the previous video. So let's try this
same example. Let's try the same method for this particular example as well. So
this particular one is access control issues part II and if we look at the
AndroidManifest.xml and we have the access control 1 activity and the access control
2 activity where the intent filtering is VIEW_CREDS2 instead of simple VIEW_CREDS.
So let's try to do use this. So adb shell am start -a
jakhar.aseem.diva.action.VIEW_CREDS2. And let's see what happens with the
application. Let me go to the home screen, then try this out and now as you see, it
brings me to an enter pin screen rather than showing with the actual API key. So
there is a kind of protection here which you'll need to bypass. So if you look at
the source code for this particular exercise, you'll notice that it checks for
another parameter which is called check pin or chk_pin. And if it is true, it asks
you to register at a particular website and login with that pin, but if the check
pin is set to false it tells you the API key and the password. So all we need to do
is invoke this intent filter along with an extra parameter. So you can do it with
either AM which we did earlier and adding an extra parameter to it or you can also
use Drozer in this case in order to launch an intent filter as well as parse in an
additional argument to it. So you can know more about Drozer in the training videos.
So there, we have discussed in detail what Drozer is, how do we start it, how do we
do a basic exploitation even scripting and so on. So you an check out
securitytube-training.com in order to check out all those details. So we'll
start Drozer and I check out the activity names for this particular package
jakhar.aseem.diva. Now, if you notice there're three different activities. One
is the main activity and then you have the APICreds activity which was the previous
exercise and now you have the APICreds2 activity. So what we'll do over here is,
we'll start the APICreds2Activity along with an extra check pin boolean set to
false. Since in the code, you can check that the check pin variable is actually a
boolean, so you can set it to false and launch the APICreds2Activity. So let's do
run, app.activity.start--component and simply copy this one along with the
package name which is jakhar.aseem.diva and parsing in extra data which is check
pin. So extra boolean check pin set to false. And if let's see if this works or
not. Before this, let me just go back, create the application, then launch this.
Let's delete this, didn't work. So let's see where we went wrong when I'm activity
start. So, sorry about the short interruption. So the chk_pin that we asked
still trying. There is a string located inside the strings.xml. And if you look at
this source code which is at this github URL, you can go inside the app and
navigate to source, main, resources, then values and here you'll find the
strings.xml. And if you open the strings.xml and simply scroll down, say
maybe, okay, so here it is. So if you look over here, there's a string with a
tag of chk_pin and the actual string is check_pin, so the check_pin is what we
need to use inside our statement. So let's try to launch the activity. So
app.activity.start --component jakhar.aseem.diva which is the package
name and then the activity name is APICreds2Activity, parsing in an extra
boolean of check pin false. And if you look over here, we have the API key as
as well the user name and password. So this how you use Drozer in order to start
an activity along with parsing extra variables to it. So that's all for this
video. If you have any feedback or queries, reach out to me at adi@attify.com
And if you want to check out the complete course videos, you can go to
securitytube-training.com or you can get a subscription at petesteracademy.com. See
you in the next video.