Author Archive

Android Penetration Testing (PenTesting Android Apps)

October 18th, 2011 No comments

A report by McAfee for last quarter states that the
‘Count of new Android-specific malware moved to number one, with J2ME (Java Micro Edition), coming in second while suffering only a third as many malware.’ In simple words if you own a Android phone, the chances of it being compromised is 2.5 times more than any other platform.

With industry reporting so many new android exploits and malwares, it is becoming a tedious job for developers to secure their applicaitons. With nearly all IT companies having expertise in Web penetration Testing solutions, they have started building solutions for Mobile Penetration testing. But whats the need of creating a different solution for mobile apps testing? Isn’t it same as web applicaiton testing? If you consider ‘Thin client’ mobile apps, the answer is yes. For thin client mobile apps, penetration testing is almost same as that of Web application testing. But If you consider ‘Thick Client’ or ‘Native Mobile Apps’ which gets installed into the device, the penetration testers have to add some more test cases and the testing environment needs a bit of tweak.
If we compare Web penetration Testing and Mobile PT, what exactly is the difference?? One of the major difference is that the user in the case of Web applicaitons do not have access to the files of application (php,asp,jsp files) whereas in the case of mobile, user has access to the application as it is installed in the device itself. All of the platforms provide some kind of databases for those applicaitons to store data(SqlLite3 in Andoid). In case of web, applicaitons only have privilages to store data temporarily using cookies or cache. One more major drawback with mobile apps is that they can be reversed very easily, whether it’s a dex(android), jar/jad(j2me) or a sis(Symbian).
For Penetration testing of Android Application we have to mainly consider the following things ;-

* Settings up the PT lab/Environment.
In this you will learn about how to setup the test environment using emulator,proxy tools. Using these proxy tools you can force emulator to pass the traffic via a proxy. But this setting only works for browser inside the emulator. For apps to work with proxy you need some different environment setting which is discussed in detail. Click here to read more..

* Using debugging tools like ADB,DDMS.
Using debugging tool like ADB you can run commands on emulator and device itself to perform any kind on action. You can get the shell,view the files stored, databases,install new apps, uninstall apps,pull and push files from the device. DDMS in just a GUI version of ADB. To get more detail about all this click here.

* Reversing Apps.
One of the major drawbacks with Mobile apps is that they can be Reversed. We have many opensource tools for reversing android apps like apktool,baksmali,dex2jar. Click here to read more about this.

Thanks for Watching.. Next article will be on “Deep Dive into Android Malwares”

Using Adb and DDMS for Android Penetration Testing

October 18th, 2011 No comments

Android Debug Bridge (adb) is a versatile command line tool that lets you communicate with an emulator instance or connected Android-powered device. It is a client-server program that includes three components:

* A client, which runs on your development machine. You can invoke a client from a shell by issuing an adb command. Other Android tools such as the ADT plugin and DDMS also create adb clients.
* A server, which runs as a background process on your development machine. The server manages communication between the client and the adb daemon running on an emulator or device.
* A daemon, which runs as a background process on each emulator or device instance.
To view the Best available description about ADB visit
To see how adb can be helpful for Penetration testing of Android apps watch the video embedded below.

Reversing and Spoofing Android Applications

October 18th, 2011 No comments

One of the major drawbacks with Mobile apps is that they can be Reversed. If we look at the Android app architecture, it contains a source code which is developed by user. That source code is compiled and finally created as a ‘.dex’ file which is the dalvik executable. This ‘.dex’ file can be compared with ‘.jar’ file of java. Dex file clubbed with the resources files are archived to become a APK file. So this apk file is just a archive file similar to a zip file whose contents can be extracted using any archive explorer tool like winzip or 7-zip. After extracting files from an apk file you’ll get a ‘classes.dex’ file which contains the actual code of the application. This dex file can be reversed using my opensource tools like Baksmali(click here to download), dex2jar , apktool.
The video attached below will show you how we can use baksmali tool to decompile and compile the application again. The one thing which gets eliminated by this process is the Application signature. After compiling the application we need to add signature to it so that it can be installed on a device or emulator.



Hope you enjoyed it!!
We’ll upload some more tutorials for dex2jar and apktool pretty soon!!

Making your Gmail and Google account more secure

September 15th, 2011 1 comment

Making your Gmail and Google account more secure – A 5 point checklist.

Have you ever gave a thought what will it be like, if our Gmail or Google accounts password is compromised?? For a person like me who keeps backup of all important document, research papers, links, photos (the ones you cannot keep on home computer too :-) ) and nearly everything on the Google cloud. Most of us have no idea where and in what form my data is stored there but still I trust Google more then my personal laptop. We use so many applications like Gmail, Google docs, Picasa, Orkut but hey all share your same Google accounts password, and if that gets compromised it’ll be like tsunami for us, and with the number of hackers (including the ethical ones :-) ) growing in this world, the probability of it becomes pretty high. People can hack using a
network level attack, or using a poor password recovery options or if you think you are too intelligent to use your vehicle name or girlfriend/boyfriend name as password, your hacker friend will not take much time to prove that you a ‘@#$#@$’.
Well coming to the point, “How to make your Gmail and Google accounts more secure”. There is no special trick or hack to do so. It’s just that Google has provided you many features and options to do so; you have to use them in right way. Here is the check list of options you should use, to insure that your google accounts is safe enough.

1.) Use a secure connection when signing in – Google uses https by default but to make sure that Google uses https always, use the
“Always use https” option in “Browser connection:” under “General” Tab in Settings of your Gmail.

This will make sure that your user credentials are passed in encrypted form which will prevent network level attacks.

2.) Change your password regularly – With ’123456′ as the most commonly used password in this world you should start using a combination of numbers,characters, and case-sensitive letters for your password and avoid dictionary words. (Even if your dear one’s name is not there in dictionary avoid using such passwords :) )

3.) Update your account recovery options – Make sure that your Recovery email address is correct and you are still using it. It’s
really important as I have seen a case where a person’s recovery email id was never used and expired, which was available for anyone to take. Make sure to add your mobile number as Google can send you a recovery code via SMS, which can very handy. Last recovery option is the ‘Secret Question’ which is only available if you have not signed in during past 24 hours. The answer to the security question should be hard for others to guess, so better choose a difficult secret question and make sure you yourself remember the password :-) .

4.) Turn on 2-step verification - This option adds up one more factor of authentication (Two factor authentication) to your Google accounts. Two factor authentication implies the use of two independent means of evidence to assert an entity, rather than two iterations of the same means. Usually “Something one knows”, “something one has”, and “something one is” are useful simple summaries of three independent factors. For 2-step verification Google uses a verification code which is time specific. If you Turn on this option for your Google accounts, each time you try to login, a Google verification code will be asked(You can remember it for a computer). The next question may be how to get this verification code?? The answer is that Google provides many ways to get this verification code. You can install a mobile application to access this code, or Google can send you a SMS containing the code, and the last option is that you can print some static codes and keep then someplace accessible, like your wallet. You can turn on 2-step verification using this link “”. Try to subscribe to all the ways from which you can get your verification code as not all are accessible everytime. For example there may be a case where in you have subscribed to SMS as a way of accessing verification code, in this case if you forget to take your mobile somewhere you will not be able to access your google account.

5.) Keep monitoring your account details – Check the lists of websites that are authorized to access your Google account data. Go to My Account > Authorizing applications and sites. You’ll see the list of all third-party sites you’ve granted access to. If you see a website to which you think you have not granted the access, immediately revoke the access for that site. Second thing you should monitor is the ‘Last Account Activity’. At the bottom right of your page you’ll see ‘Last account activity’ with a link for details. By clicking on that link you can monitor, how many sessions are presently open with Access type, location and time of access.

Don’t forget to visit Google security tips and Gmail security checklist from Google for further information.
Reference :
Google security tips :
Gmail Security Checklist :
Two-Factor Aunthentication from Wikipedia

Categories: Application Security Tags:

Setting up proxy for apps in android emulator

August 16th, 2011 3 comments

Proxy for Android apps not working even after u tried all proxy settings in emulator? Is your android proxy setting only working for browser not for apps in emulator?

In some of the previous posts( we saw how to setup a proxy for android emulator using settings available in emulator itself. The problem with that approach is that it works only for the browser, it does not work with the apps installed inside the emulator. As I couldn’t find any solution for this problem in android emulator I thought of finding a work around to perform this task. One workaround I found is that we should use the base machine itself to capture the packets which emulator (the apps in emulator) is sending.

We can use many network analyzer tools like wireshark etc to capture and analyze the packets but using these tools you can only capture the packets, there is no option to tamper the packets at runtime. If there is a requirement in which you just have to capture the packets and analyze them wireshark will suffice the needs. But if you want to tamper the request and response(which we normally do using Paros/fiddler in web applications) you need to have a tool which can capture network packets and has a capability to intercept and tamper them.

Read more…

Setting up proxy for android emulator

August 8th, 2011 3 comments

Facing some issues in setting up a proxy from android emulator??

This article will tell you the steps you need to follow to set up the proxy for android applications using emulator.  For this you require three basic things i.e “Machine Connected to internet”,”Android SDK”,”Proxy Tools (Paros, Fiddler, Burpsuit etc)”. If we are ready with all these software, the first step is to setup the proxy server using any of these tools like paros, fiddler, burpsuit etc. I’ll show you how to do it with paros.

In paros go to Tool>>Options>>Local proxy and enter the address( for localhost) and port number(e.g. 8080) on which you want your proxy server should listen. Please refer to the screenshot below for the options page in paros.

Android Proxy Paros Settings

Android Proxy Paros Settings

Read more…

Reading your Mind

July 31st, 2011 1 comment

This is a small mind reading game. You have to think a Number between 1 and 63 (including 1 and 63). Some lists will be shown to you and you have to tell me the in which of the lists your number appears and i’ll tell you the number which is there in your mind.
Read more…

Application Security – The Basics

July 28th, 2011 2 comments

The Institute for Security and Open Methodologies (ISECOM) defines security as “a form of protection where a separation is created between the assets and the threat”.
Security in general has many categories, it can be the security of physical assets like Home, Airport, Infrastructure, or some kind of political security like Human security, national security or computer security which itself  has many categories.

Read more…

Client Side Exploits Using PDF

July 28th, 2011 No comments

Switch to our mobile site