Hack Your Way Out

  Note*: To install & run the tools mentioned in this blog, check my blog in the above video description. Most Android applications are written in Java. Instead of the Java code being run in Java Virtual Machine (JVM) like desktop applications, in Android, the Java is compiled to the  Dalvik Executable (DEX) bytecode  format. For more recent versions of Android, the Android Runtime (ART) is used. Smali is the human readable version of Dalvik bytecode. SMALI is like the assembly language.  Smali Instruction set. To get the Smali from DEX, you can use the baksmali tool (disassembler) Check List: 1. Run apkleaks to find leaked credentials, and validate the credentials using nuclei token-spray. 2. Use apktool to reverse-engineer the apk. And check the following things: 3. Check: /assets and /res/raw 4. Check : Manifest, (it is like the table of contents): for “External storage”, “intents” 5. Use “ls -a”, to view hidden files when browsing directories. 6. Inotify (ino...

  In order to target APIs, you must first be able to find them.APIs meant for consumer use are meant to be easily discovered. Typically, the API provider will market their API to developers who want to be consumers. So, it will often be very easy to find APIs, just by using a web application as an end-user. The goal here is to find APIs to attack and this can be accomplished by discovering the API itself or the API documentation. Bug Boundy Methodology, Tools & Resources Start by defining a clear objective, such as exploiting a remote code execution (RCE) vulnerability or bypassing… adithyakrishnav.blogspot.com Reconnaissance Passive Reconnaissance It is obtaining information about a target without directly interacting with the target’s systems. Google Dorking Firstly, google search for “<app name> API”. intitle:” api” site:”google.com” inurl:”/api/v2" site:”google.com” inurl:”/api/v1" intext:”index of /” inurl:json site:”google.com” intitle:”index.of” intext:”api.t...