book

Hacking Android

by Mohammed A. Imran, Srinivasa Rao Kotipalli

July 2016

Beginner to intermediate

376 pages

7h 37m

English

Packt Publishing

Read now

Unlock full access

eBooks, discount offers, and moreWhy subscribe?
What this book covers

Downloading the example codeErrataPiracyQuestions
Installing the required toolsJava
Real deviceApktoolDex2jar/JD-GUIBurp Suite
DrozerPrerequisitesQARK (No support for windows)Getting readyAdvanced REST Client for ChromeDroid ExplorerCydia Substrate and IntrospySQLite browserFridaSetting up Frida serverSetting up frida-clientTesting the setupVulnerable appsKali Linux
Checking for connected devicesGetting a shellListing the packagesPushing files to the devicePulling files from the deviceInstalling apps using adbTroubleshooting adb connections
What is rooting?Why would we root a device?Advantages of rootingUnlimited control over the deviceInstalling additional appsMore features and customizationDisadvantages of rootingIt compromises the security of your deviceBricking your deviceVoids warranty
Determining boot loader unlock status on Sony devicesUnlocking boot loader on Sony through a vendor specified methodRooting unlocked boot loaders on a Samsung device
Prerequisites
Installing recovery softwaresUsing OdinUsing Heimdall
Basics of Android appsAndroid app structureHow to get an APK file?Storage location of APK files/data/app//system/app//data/app-private/Example of extracting preinstalled appsExample of extracting user installed apps
ActivitiesServicesBroadcast receiversContent providersAndroid app build process
ART – the new Android Runtime
UID per appApp sandboxingIs there a way to break out of this sandbox?
Introduction to Android appsWeb Based appsNative appsHybrid apps
Mobile application architecture
OWASP Top 10 Mobile Risks (2014)M1: Weak Server-Side ControlsM2: Insecure Data StorageM3: Insufficient Transport Layer ProtectionM4: Unintended Data LeakageM5: Poor Authorization and AuthenticationM6: Broken CryptographyM7: Client-Side InjectionM8: Security Decisions via Untrusted InputsM9: Improper Session HandlingM10: Lack of Binary Protections
DrozerPerforming Android security assessments with DrozerInstalling testapp.apkListing out all the modulesRetrieving package information
Identifying and exploiting Android app vulnerabilities using DrozerAttacks on exported activitiesWhat is the problem here?
Running QARK in interactive modeReportingRunning QARK in seamless mode:
What is data storage?Android local data storage techniquesShared preferencesSQLite databasesInternal storageExternal storage
Real world application demo
NoSQL demo application functionality
Backup the app data using adb backup commandConvert .ab format to tar format using Android backup extractorExtracting the TAR file using the pax or star utilityAnalyzing the extracted content for security issues
Different types of mobile apps and their threat model
Mobile application architecture
Setting up Burp Suite Proxy for testingProxy setting via APNProxy setting via Wi-FiBypass certificate warnings and HSTSHSTS – HTTP Strict Transport SecurityBypassing certificate pinningBypass SSL pinning using AndroidSSLTrustKillerSetting up a demo applicationInstalling OWASP GoatDroidThreats at the backendRelating OWASP top 10 mobile risks and web attacksAuthentication/authorization issuesAuthentication vulnerabilitiesAuthorization vulnerabilitiesSession managementInsufficient Transport Layer SecurityInput validation related issuesImproper error handlingInsecure data storageAttacks on the database
Attacking application componentsAttacks on activitiesWhat does exported behavior mean to an activity?Intent filtersAttacks on servicesExtending the Binder class:Using a MessengerUsing AIDLAttacking AIDL servicesAttacks on broadcast receiversAttacks on content providersQuerying content providers:Exploiting SQL Injection in content providers using adbQuerying the content providerWriting a where condition:Testing for Injection:Finding the column numbers for further extractionRunning database functionsFinding out SQLite version:Finding out table names
Automated Android app assessments using DrozerListing out all the modulesRetrieving package informationFinding out the package name of your target applicationGetting information about a packageDumping the AndroidManifes.xml fileFinding out the attack surface:Attacks on activitiesAttacks on servicesBroadcast receiversContent provider leakage and SQL Injection using DrozerAttacking SQL Injection using DrozerPath traversal attacks in content providersReading /etc/hostsReading kernel versionExploiting debuggable apps
What is Frida?PrerequisitesSteps to perform dynamic hooking with Frida
Accessing sensitive local resources through file schemeOther WebView issues
What do Android malwares do?
Writing a simple reverse shell Trojan using socket programming
Writing a simple SMS stealerThe user interfaceCode for MainActivity.javaCode for reading SMSCode for the uploadData() methodComplete code for MainActivity.javaRegistering permissionsCode on the serverA note on infecting legitimate apps
Static analysisDisassembling Android apps using ApktoolExploring the AndroidManifest.xml fileExploring smali filesDecompiling Android apps using dex2jar and JD-GUIDynamic analysisAnalyzing HTTP/HTTPS traffic using BurpAnalysing network traffic using tcpdump and Wireshark
How to be safe from Android malwares?
MitM attacks
Bypassing pattern lock using adbRemoving the gesture.key fileCracking SHA1 hashes from the gesture.key fileBypassing password/PIN using adbBypassing screen locks using CVE-2013-6271

Overview

Hacking Android is your step-by-step guide to exploring and securing Android devices with advanced techniques.

What this Book will help me do

Perform offensive security testing specific to Android applications.
Establish an Android security lab for professional testing or experimentation.
Understand Android operating system internals and find vulnerabilities.
Employ Android rooting techniques and recognize their implications.
Defend against real-world attack scenarios targeting Android apps.

Author(s)

Mohammed A. Imran and None Rao Kotipalli are seasoned professionals in Android security and application testing. They bring years of hands-on experience in analyzing Android applications and leveraging pentesting techniques. Their practical insights aim to empower readers with the know-how to understand and test Android security comprehensively.

Who is it for?

Hacking Android is ideal for developers, QA professionals, and security analysts at beginner to intermediate experience levels. If you have a foundation in Android programming and are keen on diving into its security aspects, this book is for you. It's also suitable for professionals looking to understand and mitigate vulnerabilities in Android apps. Gain the knowledge to enhance your skills and contribute to securing mobile platforms.