Pentesting

Static Analysis With Drozer # Package information # I started by enumerating the permissions declared by the app using the command run app.package.list -f insecureshop: Package: com.insecureshop Application Label: InsecureShop Process Name: com.insecureshop Version: 1.0 Data Directory: /data/user/0/com.insecureshop APK Path: /data/app/~~FIyUrbvYY3VB_X0IA7U5Iw==/com.insecureshop-Az0TW47ZRtrdfG9MlqBcNQ==/base.apk UID: 10110 GID: [3003] Shared Libraries: [/system/framework/android.test.base.jar] Shared User ID: null Uses Permissions: - android.permission.INTERNET - android.permission.READ_EXTERNAL_STORAGE - android.permission.WRITE_EXTERNAL_STORAGE - android.permission.READ_CONTACTS - android.permission.WAKE_LOCK Defines Permissions: - com.insecureshop.permission.READ The IPC attack surface # To evaluate the attack surface exposed via Android’s IPC layer, I ran the command run app.package.attacksurface com.insecureshop, which returned the following output: Attack Surface: 6 activities exported 0 broadcast receivers exported 1 content providers exported 1 services exported is debuggable The exported IPC components give an attacker several entry points into the app.

GOAL: Intercept network traffic in FactsDroid and view/modify the API requests and responses between FactsDroid and the backend server without statically patching the provided APK. The objective is to successfully implement a Man-in-The-Middle (MITM) attack that allows you to manipulate the facts being displayed to the user, potentially inserting custom content or modifying the retrieved facts before they reach the application. Upon installing the app using adb install factsdroid.apk, I immediately see this error message when launching the app: In order to bypass the root check, I injected the Frida anti-root script into my APK: frida -U --codeshare dzonerzy/fridantiroot -f com.