Hello everyone, welcome back again! In today's article, we're delving into some fundamental concepts that power the Android ecosystem.

Get ready to unravel these essential building blocks of the Android world!

Let's jump right in without any delay and break down each of these concepts.

Understanding the Zygote Process: How Apps Start on Android?

As the Android Operating System comes to life, a crucial player enters the stage – the Zygote process. This process is like a guardian that waits for new app launch requests. Whenever you tap on an app icon, Zygote takes the lead in getting it up and running. Imagine it as the app-launching maestro.

Zygote employs a clever trick. When it's time to launch a new app, it makes a copy of itself using a technique known as a fork system call. This duplication process happens lightning-fast, ensuring quick app launches. This approach also makes things efficient since the new app process shares resources with the parent Zygote.

Now, picture this: the freshly initiated app process is like a canvas being prepared for a masterpiece. It loads up all the essential code required to bring the app to life. And remember those classes.dex files we talked about earlier? They contain the app's bytecode that's compatible with the Dalvik Virtual Machine.

But wait, there's more! In Android devices from version 5.0 onwards, things get even smarter. The default runtime environment becomes ART (Android Runtime). Here, are the classes.dex file undergoes a transformation. It's converted into something called OAT using a tool named dex2oat. This clever conversion optimizes performance and helps your app run smoothly.

So, the next time you tap on an app and it swiftly appears on your screen, you'll know that the Zygote process played a crucial role in making it happen!

Understanding Garbage Collection in Java

Now, let’s understand the Garbage Collection in Java.

In Java, an automatic garbage collection mechanism is employed to manage memory. This mechanism is responsible for reclaiming memory that is no longer needed within a managed memory environment.

The primary objectives of garbage collection are twofold: firstly, to identify data objects in a program that are no longer accessible in the future, and secondly, to free up the resources occupied by these objects. Objects can belong to different generations, such as active, younger, older, and permanent generations. The time taken by the garbage collector varies depending on the generation to which an object belongs.

Comparing this to manual garbage collection, where it's the user or programmer's responsibility to release memory, automatic garbage collection offers both advantages and disadvantages. On the positive side, it enhances performance by efficiently freeing up memory. However, since it operates automatically, the timing of memory reclamation is beyond the user's control. For instance, if the collector initiates its task during a critical operation, it might impact performance negatively.

What is ART – Modern Android Runtime?

Let's delve into the world of ART - the new Android Runtime. ART was first introduced in Android 4.4 as an optional runtime environment, allowing users to choose it from developer options on their devices. Starting from Android 5.0 (Lollipop), Google made ART the default runtime.

ART operates by transforming an application's bytecode into native machine code during installation on the user's device. This process is known as ahead-of-time compilation. 

In contrast, before ART's introduction, Dalvik used to convert bytecode to native code at runtime, in what's called the JIT (Just-in-Time) approach. The noteworthy advantage of ART lies in its approach to bytecode conversion. 

Unlike the JIT approach, ART doesn't need to convert bytecode into machine code every time the app launches; this is already accomplished during the app's installation. 

Although this might result in a slight delay during the first run, it leads to substantial performance enhancements and improved battery life in subsequent runs.

Decoding ANDROID JIT (Just-In-Time Compilation)

Within the Android runtime (ART), a just-in-time (JIT) compiler plays a pivotal role by continually enhancing the performance of Android applications during their execution.

Here's how the JIT compilation process unfolds: 

When a user initiates an app, ART internally loads the .dex file. If a .oat file (the Ahead-Of-Time binary for the .dex file ) is available, ART directly employs it. 

However, these .oat files, which contain pre-compiled AOT binary code, may not always be present. In such cases, ART resorts to JIT compilation, along with an interpreter, to execute the .dex file.

The JIT profile data, accumulated during app usage, gets stored in a system directory accessible only to the application. This profile data guides the AOT compilation (performed by the dex2oat daemon) in parsing and driving the compilation process.

In essence, the Android JIT mechanism dynamically optimizes the execution of apps through on-the-fly compilation, refining performance and responsiveness.

Dalvik Virtual Machine (DVM)

A Virtual Machine (VM) is a simulated computer system that mimics the functions of a real computer. It's crafted using the physical components such as the hard disk, CPU, RAM, and other resources available on the host machine. Through virtualization, you can set up multiple guest operating systems on a single host operating system. Hypervisors, commonly used, help in creating VMs either through full virtualization or para-virtualization methods.

Typically, standard Java applications follow a common procedure for executing Java programs. First, the source code file with the ".java" extension is compiled, resulting in the creation of intermediate code known as bytecode. This bytecode is saved with a " .class " extension. To execute this code, Java interpreter tools come into play.

However, in the modern context, the Java Virtual Machine (JVM) is designed for high performance and boasts efficient memory management. Nonetheless, there's a need to tailor it for low-powered handheld devices too. Consequently, it's re-engineered to accommodate mobile devices and their applications.

When bytecode is executed using the Java Interpreter and JVM, a pivotal role is assumed by the Just-in-time (JIT) compiler. This compiler translates bytecode into machine code. In contrast to languages like C or C++, which involve creating multiple .obj files and linking them with a linker, Java simplifies this process by omitting the linking step.

Tailored specifically for Android, the  Dalvik Virtual Machine (DVM)  emerges as a specialized VM optimized for mobile devices. It places emphasis on memory efficiency, battery life, and overall performance. Interestingly, the moniker " Dalvik " takes inspiration from a town in Iceland. The visionary responsible for shaping the Dalvik VM is  Dan Bornstein.

Within the Android ecosystem, the Dex compiler handles the conversion of class files into .dex files, compatible with the Dalvik VM. It's notable that a multitude of class files consolidate into a single dex file, streamlining the workflow.

Throughout the compilation journey of the Dalvik VM, optimization is at the forefront. The focus lies on enhancing app performance, efficiency, and overall functionality, contributing to a more seamless user experience.

In the realm of the Android platform, the Dalvik VM assumes its role. It operates as an interpreter-only VM, executing files in the Dalvik Executable (.dex) format. This format is designed for efficient storage and memory-mappable execution. Operating on a register-based structure, it can handle classes transformed by a Java language compiler, converted into its native format using the " d8 " tool. 

The VM functions atop POSIX-compliant OSs, relying on them for underlying functionality such as threading and low-level memory management. The Dalvik core class library aims to provide a familiar development foundation for those accustomed to programming with Java Standard Edition. However, it is tailored specifically to meet the requirements of small mobile devices. 

In this article, we have covered the fundamental concepts that underpin the Android ecosystem. In our next article, we delve into understanding Android app sandboxing. 

If there are any queries, then write them in my comment section.

Hello everyone, welcome back to our latest article! Today, we're diving deep into the fundamental aspects of Android Apps. Our focus will be on unraveling the core concepts that lay the groundwork for Android app development.

Every app that we download and install from the Play Store or any other source, comes with the ".apk" extension, indicating that they are compressed archive files. These APK files encompass various files and folders, which we'll explore shortly in this article.

As we go about our digital lives, it's common to download these apps and set them up by granting the required permissions before diving in. But today, we're shifting our attention to the technical side. We're about to peel back the layers to understand what's tucked away inside these apps, how they're packaged, and the intriguing sequence of events when we hit that "Install" button.

Structure of Android Apps

Let's start by getting a solid grip on the structure of Android Apps:

Imagine for a moment the final product that you, as an end user, interact with. As mentioned earlier, Android apps come wrapped in a package denoted by the ".apk" extension, a shorthand for the Android Application Package. 

These packages, much like treasure chests, hold an array of files and folders. It's what end users and those delving into penetration testing receive.

Given that Android apps are essentially archive files, you can unleash their contents using any traditional extraction tools. 

This diagram paints a clear picture of the folder structure once the APK file is unzipped. 

This structural layout is a constant across different APKs, occasionally sporting slight variations like an added "/lib" folder when supplementary libraries are part of the app's ensemble.

Let's explain it down with a step-by-step approach to un-compress an APK file:

Step-by-step approach to un-compress an APK file

Here, we have a file named "test.apk" residing in the Kali home directory. 

The first step is to modify the file extension from ".apk" to ".zip".

In a Linux system, run, the following command, to extract the content.

If you are on a Windows system, you can use 7-Zip, WinRAR, or any other similar tool to extract the contents.

After the extraction process, a world of files and directories unfolds before us. These include “AndroidManifest.xml”, “classes.dex”, “Res”, “Assets”, and “META-INF”.

Now, let's delve into what's hidden within each of these files and folders:

1. AndroidManifest.xml: Think of this as the app's information hub. It not only houses configuration details but also the app's very identity. From the package name to insights about app components, security settings, permissions requested, and much more, this file is the keeper of app essentials.
2. classes.dex: Imagine this as the app's translator. It holds the Dalvik Bytecode – a transformed version of the developer's source code. When the app runs, this DEX file takes the stage, executing the app's functionality on the device. Later in another article, we'll even explore how to manually create and run this DEX file on an Android device.
3. resources.arsc: Here, we find the app's compiled resources. It's like a treasure chest of assets that the app requires to function seamlessly.
4. Res\ Folder: Within this folder, you'll find the raw materials that bring your app's visual and creative elements to life. Think of images, icons, and other graphical assets that add sparkle to your app.
5. Assets Folder: This folder acts like a secret stash. Developers can tuck away files of their choosing – be it music, articles, databases, and more. These files become part and parcel of the app, bundled together for a cohesive experience.
6. META-INF\ Folder: Here lies the app's virtual identity card. Not only does it hold the application certificate, but it also contains the SHA1 digests of all files used within the app. It's a behind-the-scenes security feature that ensures the app's integrity.

By peeking inside these files and folders, we're unearthing the intricate framework that shapes an app's functionality and structure.

 This is all about the fundamentals of Android Apps! In this article, we've covered the groundwork by understanding the essential structure of Android apps and delving into what lies within an APK file, as well as how to unzip it.

In our upcoming article, we'll take the next step and explore different storage spots for Android apps. We'll even dive into the techniques of extracting both preinstalled apps and those personally installed by users. So, stay tuned for that!

For now, it's time to bid farewell. If you have any questions or thoughts about this article, feel free to drop them in the comment section. Until next time, take care and goodbye!

Hey there, welcome back to our new article series! Today, we're taking a deep dive into the inner workings of Android apps. We'll break down how these apps are built behind the scenes, what goes on during installation on your device, and how they actually run. These insights provide a solid foundation for understanding reverse engineering and penetration testing of Android apps.

Throughout this playlist, we'll cover a variety of important subjects, including:

By the end of this article, you'll have a thorough understanding of the core principles driving Android app development, execution, and analysis. This knowledge equips you for further exploration into advanced topics like reverse engineering, pen testing, and more within the Android app ecosystem. Thanks for joining us on this journey! 

Hello everyone! Today in this article, we'll be uncovering the fundamental components of Android apps and breaking them down for easy understanding. Let's dive right in.

Android apps typically consist of four main components: 

• Activities
• Services
• Broadcast Receivers 
• Content Providers

Let's take a closer look at each of these components:

Activities

An activity is like a window that users can interact with to perform tasks. It might contain multiple fragments that handle specific parts of the interface. For example, think of the login screen of a social media app.

Services

Services are behind-the-scenes workers that handle tasks without a user interface. An example is a music app that keeps playing music even if you switch to a different app or lock your screen.

Broadcast Receivers

Broadcast receivers listen for system-wide announcements, such as a low battery warning or device booting up. Apps can also create their own broadcasts. They help an app respond to specific events.

Content Providers

Content providers manage data and make it available to other apps. They use methods like insert(), query(), update(), and delete() to interact with the data. Each content provider has a unique URI, allowing apps with proper permissions to access and share data. An example is accessing SMS messages using the content://sms/inbox URI.

And that's a wrap on the basics of Android app components!

In our next article, we will be going to cover. If you have any questions or need further clarification, feel free to leave a comment in the section below.

In our next article, we'll delve into the process of building Android apps, illustrated through an example. 

If you have any queries or require additional explanations, don't hesitate to leave a comment in the section below.

Throughout our previous discussions, our focus has been primarily on APK files. Hello everyone! Welcome back to a new article. In this article, we'll unravel the intricate process of constructing Android apps. It's crucial to comprehend the inner workings that lead to the creation of these APK files. 

When a developer engages with an Integrated Development Environment (IDE) like Android Studio, they typically undertake the following steps at a high level:

1. Install Android Studio
2. Create a New Project
3. Choose Project Template
4. Configure Project Settings
5. Design User Interface (UI)
6. Write Code
7. Add Resources
8. Build Gradle Files
9. Run and Debug
10. Optimize and Test
11. Generate Signed APK
12. Package Resources
13. Align and Optimize
14. Install and Test
15. Publish or Share

For a more profound understanding, I invite you to read this article. In it, I've taken the initiative to craft a prototype Android application using Android Studio.

This article reveals that an Android project generally encompasses Java source code, which is subsequently compiled into a binary form called "classes.dex." Additionally, there's the binary representation of the "AndroidManifest.xml" file and various other resources that harmonize during the compilation and packaging phases.

Upon reaching completion, the app necessitates the developer's digital signature for verification. At this point, it becomes primed for installation and execution on a device.

While this may seem straightforward from a developer's perspective, it encompasses intricate processes behind the scenes. 

Mechanics of the entire build system to gain a more comprehensive insight

1. The opening act of the build process revolves around compiling essential resource files like AndroidManifest.xml and other XML files. These files are pivotal for crafting the user interface of activities. The mastermind behind this operation is none other than Aapt (Android Asset Packaging Tool). This magician conjures up a file named R.java, home to a set of constants that serve as our gateway to referencing them in our Java code.
2. In case the project incorporates .aidl (Android Interface Definition Language) files, these undergo a transformation orchestrated by the aidl tool. It metamorphoses them into .java files. AIDL files commonly find their purpose when we grant permission to clients from diverse applications to tap into our service for Inter-Process Communication (IPC), and when the need arises to navigate the intricacies of multithreading within the service.
3. With our Java files fully prepared for compilation, we move forward. The Java compiler, commonly referred to as Javac, undertakes the task of processing these Java files and generating corresponding .class files.
4. As we make progress, the subsequent step entails the transformation of these .class files into .dex files. This conversion process is performed using the dx tool (although in recent times, d8 is more commonly used for this purpose). The result of this stage is the creation of a solitary DEX file, denoted as classes.dex.
5. Subsequently, the classes.dex file produced in the preceding phase, in combination with resources that remain uncompiled (such as images), as well as compiled resources, are ushered into the realm of the Apk Builder tool. Here, these components are methodically woven together, culminating in the creation of an APK file.
6. To install the APK file on an Android device or emulator, it's essential to sign it with either a debug or release key. During the development phase, the IDE signs the app with a debug key to facilitate testing. This signing procedure can also be performed manually through the command line, utilizing tools like Java Keytool and Jarsigner.
7. As the application nears its final release, it must be signed with a release key. Once the app is signed with a release key, it needs to undergo alignment using the Zipalign tool. This alignment enhances memory optimization while the app runs on the device, ensuring smoother performance.

All these processes unfold behind the scenes to generate the APK files. 

In our upcoming article, we'll delve into the creation of DEX files through command-line operations. Until then, farewell.

If you have any questions or doubts about this article, feel free to share them in the comment section below.

Now that you've got all the tools and the Android SDK installed, it's time to get started! Just like in many programming books, we'll begin with a classic: the HelloWorld application. This will help you explore the different parts that make up an Android project. So, without any delay, let's jump right in!

In our earlier article, we successfully installed "Android Studio." In case you haven't installed Android Studio yet, I recommend you to read this article for guidance.

A program typically does something with data, and an Android app is no different. It processes information, displays content on the screen, and gathers data from various sources. Developing Android apps for devices with limited resources requires understanding the application lifecycle. In this unit, you'll get to know the essential components of Android apps and learn how to create and run one.

Building a sample Android application using Android Studio

Before diving into complex app development, it's important to make sure that all the necessary development packages are installed and working correctly. The easiest way to do this is by creating a basic Android app, compiling it, and running it. 

Let's walk through the steps of creating a simple Android app project using Android Studio. Once the project is set up, we'll later explore using the Android emulator to test the app.

Creating a New Android Project

The initial and foremost step in creating your app involves setting up a new project within the Android Studio environment. 

To begin, open Android Studio. 

As soon as you launch the application, you'll be greeted by the "Welcome to Android Studio" screen.

Moving forward, our next step involves generating a new project. 

Simply click on the "New project" option. This action will open up a selection of templates. 

Choose the "Phone and Tablet" category, and then select the "Empty Views Activity" template. Once you've made your selection, click "Next" to continue.

In the New Project window, you'll find a field labeled "Application name," and enter "HelloWorld" as the name of your application. 

This name will be used to identify your app within Android Studio and will also be displayed when your fully developed app is available on the Google Play store.

The Package Name serves as a unique identifier for your application within the larger Android application environment. To create this name, use a pattern based on the reverse URL of your domain name combined with your app's name. 

For example, if your domain is www.example.com, and your app is named HelloWorld, your package name could be "com.example.HelloWorld". This distinctive package name ensures that your app stands out within the Android ecosystem.

The default Project location is initially set to a directory called "Android Studio Projects" within your home folder. Nevertheless, you have the option to modify this location by clicking the button located to the right of the current path field. 

Once you've determined the desired location, proceed to select the Programming Language. Although Android Studio offers various language options, I recommend choosing Java.

Set the minimum SDK version to API 16, which corresponds to Android 4.1 (Jelly Bean). Opting for an older SDK version ensures compatibility across a wider range of Android devices. 

Keep in mind that selecting a higher minimum SDK version limits the app's compatibility with newer devices.

Once these settings are configured, click on "Finish" to initiate the project creation process. 

Upon clicking "Finish," Android Studio will automatically download the necessary resources, and this step may take some time to set up the project files.

Running the HelloWorld Application

With your project now set up, it's time to take your first step into running your Android app!

In the top bar of Android Studio, you'll find a selection of Android virtual devices. Choose the one that suits your needs, or connect your physical device via Wi-Fi. 

Following this, locate and click the "Run App" button in the taskbar.

Allow a moment for the Android emulator to initialize. Once it's up and running, Android Studio will automatically deploy your app onto the selected virtual device.

With the application launched, you'll witness it on the screen. For a clearer understanding, you can refer to the visual illustration provided.

To exit the application, simply click the Home button on the emulator. 

Upon accessing the Application Drawer, you'll notice the installed applications, which mirror the image provided.

If you find yourself with several compatible AVDs in operation, Android Studio will open the Android Device Chooser window. Within this tool, you have the freedom to select the particular emulator or device you intend to use for debugging your application.

If there is any uncertainties or questions arise, feel free to share them in the comments section below. Your inquiries are most welcome!

Hello everyone, welcome to our latest article all about Android Reverse Engineering and Penetration Testing. Today, we're embarking on a journey to uncover the secrets behind APK files' storage locations and understand the way to extract apps – both pre-installed and user-installed. Let's jump right in!

Understanding the Storage location of APK files

On Android devices, where an app is installed and any extra settings during installation play a role in determining the storage location. 

We're about to take a meticulous look at these distinctive storage spots. Let's dissect them one by one.

But before we proceed, let's establish a connection with my Android virtual device using the adb connect command. 

Then, by running adb devices, we can verify if our device is successfully connected or not.

Now, let me run adb shell command to transition into shell mode. 

This prepares us to thoroughly explore the storage locations of APK files.

/data/app/ directory

Let’s start with the /data/app/ directory:

To get a glimpse of the files and directories within, simply run the ls –l command. 

Running the ls –l command prompts a " Permission denied error ." To overcome this, we'll elevate to super user mode with the su command.

Now, we have super user permission, let's run again to find out what are there:

This location is where user-installed apps find their place. A closer examination of the file permissions unveils intriguing insights. Take a look at this highlighted passage, showcasing that these files are world-readable. This means anyone can copy them without the need for elevated privileges.

This glimpse into the world of APK files beneath the /data/app/ directory showcases their world-readable permissions, providing us with a captivating peek into the Android app landscape.

/system/app directory

Now, let's journey over to the /system/app/ directory:

This is where the apps that come bundled with the system image find their residence. Let's take a closer look at the file permissions governing these apps within this directory. A quick overview reveals that all these files are also set as world-readable. This means that anyone can duplicate them without needing additional privileges:

This snapshot lays bare the world-readable permissions that characterize the APK files in the /system/app/ directory . It's an insightful glimpse into how the Android system stores and manages its bundled apps.

/data/app-private directory

Now, let's take a look at the /data/app-private/directory:

When we run the ls -l command here, it doesn't reveal any visible content. However, this is the space where apps that demand an extra layer of copy protection on the device typically reside.

For users without the necessary privileges, copying apps from this location isn't straightforward. Yet, if we gain root access to the device, it's still possible to extract these APKs, granting us access to their contents. This adds an intriguing layer of security and access control for these specific apps.

Extracting Android Apps: A Step-by-Step Guide

1. Find the Package Name
2. Locate the APK Path 
3. Pulling it Out

Let's put this into practice. Allow me to demonstrate with an example from my Android device, which is running on VirtualBox.

Example of extracting pre-installed apps

If we happen to know the app's name, we can deploy the adb shell pm list packages | grep "app_name" command. This action unveils the precious package name we're looking for.

With the package name in hand, the next stride involves discovering the path of the associated APK. This can be accomplished using the adb shell pm path [package_name] command.

As expected, it is located under the /system/app/ directory since it is a preinstalled application. The final piece of the puzzle involves pulling it out from the device. We achieve this by executing the adb pull /system/app/[file.apk] command.

Extracting user-installed apps

This process follows a similar trajectory as with preinstalled apps, if we know the name of the app, we can use the previous commands to extract user-installed apps. 

However, in my Android VirtualBox emulator, there aren't any user-installed apps yet. I'll address this by manually installing one. But, there's a catch: the emulator lacks the Play Store. Therefore, we'll need to install the apps from the browser.

So, how can we obtain an APK file?

If we want to acquire a specific APK file of our choice, we can download it directly by visiting the Play Store web page. Simply copy the app's ID or complete URL from the URL bar of the browser. 

Then, visit http://apps.evozi.com/apk-downloader/, and paste the copied ID or URL. This enables you to download the APK file. 

Let me download it and install the downloaded APK file on the Android device using the adb install command. 

Now, the application is installed, and we are ready to continue our example:

First, let me run adb shell pm list packages | grep "your app" command to find the package name of the application installed by the user.

Well, as you can see, we have got the package name. We can use the adb shell pm path [package name] command to find its APK path.

In this scenario, the APK resides in the /data/app/ directory , as it's a user-installed application. Lastly, we can extract this app from the device using the adb pull /data/app/[file.apk] command, much like we did earlier with preinstalled apps.

One important point to note is that the location of APK files might differ slightly on the latest versions of Android devices. In my testing emulator, each APK possesses its own directory within /data/app/ for user-installed apps and /system/app/ for pre-installed ones. 

This ensures a more organized and manageable file structure.

Additionally, if you navigate to the /data /dalvik-cache/ directory after running the adb shell command, you might come across optimized dex files.

In the x86_64 architecture within the /data/dalvik-cache/ directory , you have two subdirectories: x86 and x86_64. 

These directories contain the optimized .dex (Dalvik Executable) files (.dex) and the verification data files (.vdex) for various apps and frameworks.

These optimized dex files are created on an app's first run, to enhance app performance. This process, known as dexopt, occurs during Android OS's initial startup.

VDEX stands for "Vdex Execution." VDEX files are used in the newer Android runtime environment, ART. Starting from Android 5.0 Lollipop, ART replaced Dalvik as the default runtime. VDEX files are part of the ART's compilation and optimization process.

Let’s briefly give an overview of the files present in the x86_64 subdirectories:

• The /system/app directory contains optimized .dex files and .vdex files for various system apps like AndroidTerm and WebViewGoogle .
• The system/framework/ directory contains optimized .dex files and .vdex files for various framework components such as android.hidl.base , android.hidl.manager , boot-android.hidl.base , boot-android.hidl.manager , and more.

Each app or framework has its associated .dex file, which contains the compiled code, and a corresponding .vdex file, which contains verification data to speed up the app's loading process. This provides a comprehensive understanding of how apps are structured and managed on the Android system.

In this article, we've delved into the world of APK file storage locations and learned how to extract these files from their storage spots. 

In our next article, we are going to explore Android App Components. So, keep waiting till then. 

If you have any questions about the content we've covered, feel free to leave a comment in the comment section below.

 Hello everyone, welcome to our latest playlist! Throughout this series, we're embarking on a journey to establish a solid foundation for Android app Penetration Testing and Reverse Engineering labs. 

Our mission is to consolidate all the essential tools needed for Android security into a user-friendly toolkit. In this chapter, we'll be diving into critical subjects, which include:

By the time you finish these videos, you'll have a strong grasp of how to establish your Android Hacking lab. This foundational knowledge serves as a stepping stone for delving into advanced areas like reverse engineering and penetration testing within the dynamic Android app landscape. Thank you for joining us on this educational journey! We appreciate your presence on this enlightening journey of learning!

To get hands-on experience with most of the concepts in this series, readers must have an emulator or a real Android device (preferably a rooted device) up and running. Firstly, we have to download and install Android Studio.

Android Studio is the official IDE for Android application development, based on IntelliJ IDEA. Eclipse used to be the IDE for Android Application development before Android Studio was introduced. 

Android Studio was in the early access preview stage, starting with version 0.1 in May 2013, and then entered the beta stage starting with version 0.8, which was released in June 2014. The first stable build was released in December 2014, starting with version 1.0.

Steps to Install Android Studio on Windows

Step 1: Download Android Studio and run the installer.

Step 2: Click next till the following window appears:

This window shows us the options for the tools to be installed. It is suggested you check to install Android Virtual Device (AVD), which is used to run emulators with Android Studio.

Step 3: Choose the installation location for Android Studio. If you don't have any specific choices, leave them to the default values.

Step 4: The following step allows us to choose the name for Android Studio in the start menu. Again, you can leave it to the default value if you don't have any specific choice.

Step 5: Continue the installation by clicking Next till the following screen appears. This finishes our Android Studio installation.

Step 6: When you click Finish in the preceding window, the following screen will be shown. 

If you have installed an older version of Android Studio, choose its location to import your previous settings. If this is a fresh installation on this machine, choose if I do not have a previous version of Studio, or I do not want to import my settings.

Step 7: Clicking the OK button will start Android Studio, as shown here.

Step 8: Once it is loaded, we will be greeted with a window, where we need to choose the UI theme. Select one of the themes and click Next.

Step 9: Clicking Next in the previous window will download the latest SDK components and the emulator. Before that accept the license agreement.

Step 10: Finally, click Finish and you should be greeted with the following window. This completes our installation:

Step 11: To create a new sample application, click Start a new Android Studio project.

Step 12: Select a Blank Activity, as shown here, and click Next:

Step 13: Choose a name for your app under the Application name. Let’s leave the options to their defaults.

Step 14: Finally, click Finish to complete the setup. It will take some time to build our first My Application app:

Wait for all initialization to finish when you see the previous screen.

Setting up an AVD

Step 1: Click on Tools at the top of the Android Studio interface, and then click on the Device Manager.

Step 2: This will open the following tab on the right side.

Step 3: Click the Create Virtual Device button. This will display a window.  

Step 4: Now, choose your device definition. I chose the Pixel 4 device with Play Store support, to create an emulator of large screen size.

Step 5: Click Next, and you will see the following window where you have to select a system image. From here you have to download a recommended system image to proceed further. 

Step 6: Finally, give your AVD a name and click Finish.

Step 7: Once you are done with the previous steps, you should see a virtual device, as shown on my screen.

Step 8: Select configured emulator, and click on the Play button, to start the emulator.

When it's ready, you should see an emulator interface. This process may take 5 to 15 min as per system performance, so keep calm and quiet.

Java constitutes an essential dependency for various tools, including Android Studio and Burp Suite. While Android Studio has introduced its own programming language, Kotlin, in recent times, a select group of developers still prioritize Java.

Hello everyone. In today's tutorial, we'll provide you with a step-by-step guide to smoothly install Java on the Windows platform.

Let's begin by checking if Java is already installed on my Windows system. 

As you can observe, Java is absent, so we need to install it.

To begin, let's initiate the process of downloading the Java Development Kit (JDK) executable file for the Windows platform.

In this case, I'm opting for the x64 installer. 

Once the download is complete, run the installer. During installation, you can generally stick with the default settings unless you have specific reasons to make changes. 

Click "Next" until you reach the successful installation screen. 

Once Java is installed on your system, Android Studio requires a correctly set up JDK.

Set up JDK

Follow the below steps to setup JDK:

1. Configure the "JAVA_HOME" Environment Variable:

a. Open the Start menu and search for "Environment Variables." 

b. Click on "Edit the system environment variables." 

c. Within the System Properties window, access the "Environment Variables" button. 

d. In the "System variables" section, click "New" to create a new variable. 

Assign the Variable name as JAVA_HOME and the Variable value as the path to your JDK installation directory (C:\Program Files\Java\jdk-20).

Click "OK" to save this new environment variable.

2. Add the Java Bin Directory(C:\Program Files\Java\jdk-20\bin) to the PATH. 

a. Still, within the Environment Variables window, locate the "Path" variable under the "System variables" section and select it. 

b. Click "Edit" and the Edit Environment Variable window, click "New" and add the path to the "bin" directory within your JDK installation directory. 

Click "OK" to preserve the changes.

To verify the successful installation and functioning of Java on your system, open a new command prompt and execute the command "java -version." This command will display the version details if Java is properly installed.

In our next article, we'll delve into the installation of Android Studio and guide you through the setup of an Android Virtual Device (AVD) Emulator. If you have any inquiries or encounter issues, feel free to share them in the comment section.

Hello everyone, welcome back to a new article. Today, we'll be recapping our recent learnings. In our previous sessions, we set up a lab environment for Android Mobile Penetration Testing and Reverse Engineering.

We covered the installation of Android Studio and setting up an Android Virtual Device (AVD). We also introduced tools like APKTool, Dex2jar, JD-GUI, and Dozer, which are valuable for future Android Penetration Testing and Reverse Engineering endeavors.

In those previous articles, I haven't covered the process of setting them up in a Linux environment, and I've also not discussed the common challenges that arise with Android Virtual Devices (AVDs) . Android Studio demands a dedicated graphics card for smooth AVD operation, implying the need for high-end hardware to ensure seamless performance.

However, the main emphasis of this article is directed toward crafting a lab environment that caters to the capabilities of low-end devices. This configuration holds significant importance for engaging in Android app penetration testing and reverse engineering activities.

To begin, we'll initiate the process of setting up an Android Virtual Device within a Virtual Machine. 

Setting up an Android Virtual Device within a Virtual Machine

While there are various Android ISO images available for manual installation, you won't need to follow those steps. You can conveniently download the required files from the link I've provided in my blog.

Click Here to Download: 

Here, on my screen, you'll notice an " Android.ova " file. 

This particular file can be directly configured and launched without encountering any complications. Once you've got it, fire up VirtualBox. 

Click " File," and select " Import Appliance ." 

Import the downloaded OVA file. Locate the file on your computer, then click " Next ." 

Review the settings or customize them as needed. Hit " Finish " to begin the import process.

After the import is done, you'll spot the "Android" virtual machine in the VirtualBox Manager. 

Choose it, click on "Settings,"

 And switch the network adapter to " Host-only adapter ."

With that done, we're ready to kick-start the VM. Android is up and running! 

You can now use the Android VM just like you would on an actual Android phone. It's a great alternative to the Android Emulator.

Access Android VM from Kali Linux

To access the Android VM, we'll be using Kali Linux. If you're not familiar with Kali Linux, take a look at my article on the blog.

Alright, Kali Linux is good to go. First, we need the IP address of the Android VM. Run the following command: 

The result will show the IP address, such as 192.168.95.118.

Now that we have the IP address, we need the Port ID to connect via adb. Let's scan the network using Nmap.

Upon scanning, we'll spot an open Port that we need. This running server is adb, which facilitates communication between different network services over a network.

If you've read this article, you have a basic understanding of ADB installation on Windows. If not, make sure to catch up.

ADB doesn't come pre-installed on Kali Linux, so we have to install it. To install it, run the following command:

With the installation completed, we're all set to establish a connection with the Android Virtual Machine.

To connect to the Android Virtual Machine, employ the following command, making sure to input the IP of the Android VM, followed by specifying the open Port.

Once connected, run adb devices, to list the devices connected to the workstation. 

For a list of basic adb commands and their usage, check out my blog. 

Installing Scrcpy on Kali Linux

For showcasing the Android VM, we'll utilize Scrcpy. If you've followed along with this article, you're already familiar with how we've set up Scrcpy on Windows .

Similar to ADB, Scrcpy isn't included by default in Kali Linux. After conducting a Google search, I came across the official documentation provided by Genymotion. As I scrolled down, I discovered the installation steps tailored for Linux. 

Scrcpy is packaged in several distributions and package managers:

I attempted to execute the provided command but encountered an " unable to locate package " error, indicating that it didn't work as intended.

To overcome this, I decided to proceed with the manual installation steps . 

Referring to the installation instructions on Scrcpy's GitHub repository , I started by installing the necessary packages. Copy and paste it into the terminal, following which I responded with "y" to proceed.

Once the necessary packages are installed, copy the second command and paste it on the terminal. 

This command will clone the repository and execute the installation script automatically. This phase required some time to complete.

Upon a successful installation, we are now prepared to run Scrcpy, enabling to display and control of an Android virtual machine on the computer screen. To verify its functionality, execute the Scrcpy command and observe its behavior.

Installing Android SDK Toolkit on Kali Linux

Certain essential applications are missing from the Kali Linux distribution, such as the Android SDK tools, which encompass the Android build tools. 

While adb is often associated with Platform tools, SDK tools play a crucial role in manual Android applications and DEX file creation. 

To install the Android SDK on Kali Linux, first, we have to update the repository using the command sudo apt-get update. 

After this, proceed to install the SDK manager. You can achieve this by running sudo apt-get install sdkmanager.

Once the SDK manager is successfully installed, the next step involves downloading Platform-tools and Build Tools onto Kali Linux. Execute the following command:

This will facilitate the automatic download of platform tools and build tools, with the target platform set to version 30.

You have the flexibility to adjust the targeted platform value according to your preferences. Once the installation is complete, you can easily identify the storage location of the build tools. 

To verify the successful installation of these build tools, simply check the designated installation directory. 

Within this directory, you'll discover a comprehensive assortment of invaluable tools that play a pivotal role throughout the entire Android APK building process.

Downgrade the Java to JDK-8

An important point to keep in mind is that Java plays a significant role in Android app reverse engineering. 

While Kali Linux does come with Java pre-installed, it's worth noting that the latest version of Java might not function optimally with various Android build applications. As a result, it becomes necessary to downgrade Java to an earlier version. 

In my case, I've chosen to work with JDK-8 for this purpose. During my attempt to install JDK-8 using the command, sudo apt-install openjdk-8-jdk, I encountered an error stating " Unable to locate package ." 

To address this issue, I'll guide you through the manual installation of JDK-8. You can apply similar steps to install other versions as well.

Open your preferred web browser, and navigate to this URL. 

This webpage will offer access to the installation and archive files for JDK-8. 

We'll specifically target the Linux version for installation. However, you'll notice various architecture options available. To determine your system's architecture, execute the command " uname -a " in your terminal. 

Upon checking the result, I discovered that my system employs the x86_64 architecture. Consequently, I will download the x64 archive file. After completing the download, the next step is to prepare for the installation of JDK-8. 

Navigate to the directory where the download is located. 

Once there, extract the downloaded file. 

After extraction, rename the folder to, " jdk-8 ." 

To proceed, move this renamed folder to the /usr/lib/jvm directory. Open a new terminal, and navigate to the download directory and Execute the "mv" command to relocate the folder to its new destination.

Now, let's execute the following command: 

This command instructs the system to add a new alternative for the Java executable. It designates the new alternative's location as ` /usr/lib/jvm/jdk-8/bin/java ` and assigns it a priority of 1. This means that if other alternatives for the `java` command exist, the system will give preference to the one specified in this command with a priority value of 1. This approach proves valuable for managing multiple versions of a program and seamlessly switching between them.

Similarly, we proceed to add new alternatives for other executables. Replace the word "java" with " javac " to add a new alternative for the Java compiler.

And then repeat the process for the "jar" command.

Having successfully installed Java 8, the next step is to configure it as the default Java runtime environment (JRE) interactively. This configuration is especially handy when dealing with multiple installed Java versions, and you wish to designate one as the default.

To achieve this, enter the command ` sudo update-alternatives --config java ` in the terminal. 

This command prompts the system to present you with two alternative options for Java. You'll need to choose the number corresponding to the location of jdk-8 and press "Enter."

By following this step, you'll effectively update Kali Linux to use Java 8. In case you wish to revert to the previous Java version, simply execute a similar command and select the desired alternative.

These steps provide a robust mechanism for managing different Java versions of your system.

However, the Java compiler has not yet been updated to version 8. To achieve this, run the same command as before, but replace "java" with "javac." Then select the alternative "javac" option when prompted.

Likewise, proceed to update the path for the jar file. 

Once these changes are made, you can verify them by checking the version:

There is some additional information that I have provided you in this video that can prove valuable for testing Android applications during Penetration Testing and Reverse Engineering. If you have any uncertainties or questions, please feel free to leave them in the comment section below.

Santoku Linux is a Ubuntu Based Distribution that is focused on Mobile Forensics, Analysis, and Security. It comes with pre-installed platform drivers SDKs, and utilities and also allows auto-detection and setup of new connected mobile devices. It is a free and open community project sponsored by NowSecure.

4. Click next and allocate the size of the Memory. 

5. Click next and choose “create a virtual disk now”. 

6. From here choose the hard disk file type and click on next. 

7. From here set the size of the disk and then click on create.

8. Once a new Virtual Machine image is created, upload the disk image file to storage ( settings >> Storage).

9. Click on start, to boot the virtual machine, and then choose Install to start the installer directly.

10. Choose your preferred language and continue. 

11. This screen provides a piece of information about Santoku Linux. For better performance checkmark on install this third-party software and click on continue.

12. From here select the installation type to erase the disk and install Santoku. 

From here you no need to change anything else, so click on install to start the installation. 

The installation started in the background, no need to worry about it. So we proceed with further steps. 

13. Select the country and click on continue. 

14. Choose your keyboard layout and continue.

15. Provide the name and password. Now click on continue. Wait till the end of the installation, it might take time depending upon resources allocated to VM.

16. On completion of the process of installation, you need to restart the VMs in order to use the new installation.

17. Login with the password:

18. After installation, our first priority is to install the virtual box guest box addition. Before that let me update the repository using sudo apt-get update command. 

If you got something like this error, you have to upgrade the Ubuntu distribution. 

19. Upgrade Ubuntu Linux system from Santoku Menu à System Tools à Update Manager.

20. Click on Upgrade to upgrade the Ubuntu Distribution.

It will take time to complete the installation.

21. After the Distribution Upgrade, reboot the system. After a successful reboot, a new login screen will appear in front of the screen:

21. From the menu bar at the bottom section, click on Device and Insert Guest Additions CD image. Open the CD image in File manager. 

Click OK to Open VBox Guest Addition in File Manager:

22. Open the terminal by pressing CTRL + ALT + T. Change the directory to cd image.

23. Run the Virtual Box Linux addition script to complete the initialization.

After completion reboot the system.

• Development tools, 
• Device Forensics tools, 
• Penetration testing tools, 
• Reverse engineering tools, and 
• Wireless analyzers tools

In my next article, I am going to demonstrate the tools separately. 

ADB (Android Debugging Bridge) plays the most important role in modifying your Android Device.
In simple words, Android Debug Bridge (ADB) is a versatile command-line tool that lets you communicate with a device.

ADB allows you to

• Install, copy, and delete files;
• Install a program on a device;
• Record a video or take a screenshot of the phone;
• Debug a device in case of its malfunction;
• Examine logs on the phone;
• Upgrade the firmware of the programs and system elements;
• Get full access to information about OS and a device.

Install ADB on Windows

• To install visit ADB Platform Tools for Windows. 

• Download and Extract the file.
• Move/Copy the directory to C:\ drive and Rename it to "adb".
• Set up Environment Variable.

To do this Go to This PC and right-click. Click on properties.

Click on Advanced System Settings. Click Environment Variable.

Search in System Variable " Path " and type semicolon paste the path of ADB and Save it.

Run it. Run " adb ".

Install ADB on Linux

1) Installing ADB on Linux is quite simple. For Debian based operating system, use the following command:

Or, if it doesn’t work,

2) Let’s test whether it works or not using the following command:

Run ADB

1) To fully use all the ADB functions on Android devices, it is necessary to make certain changes in the phone settings. Depending on the manufacturer, the configuration menu may vary. But in general, the main actions are the same:

Turn on Developer Options

a. Go to settings > About device > Software info. Tap 5 to 7 times on the Build number to turn on the Developer Option.

b. Now go back to the Developer Option > Turn on USB debugging.

c. Now, Plug in your Android Device and run “ADB devices” to display all information about devices connected to the PC and with their serial numbers. A popup screen appears to get access to the Android device.

2. Now you can here type all useful commands to intercept with Android.

Basic Commands to run on ADB

ADB Basics

Command	Description
adb devices	Lists connected devices, helping you identify which devices are currently recognized by ADB.
adb root	Restarts adbd (the ADB daemon) with root permissions, enabling access to system-level operations.
adb start-server	Initiates the ADB server, allowing communication between your computer and Android devices via ADB commands.
adb kill-server	Terminates the ADB server, useful if you encounter issues or need to reset the ADB server.
adb reboot	Reboots the connected Android device. Useful when changes require a device restart or to troubleshoot issues.
adb devices -l	Provides a detailed list of connected devices, including their product and model information.
adb shell	Opens a background terminal on the connected Android device, enabling direct interaction with its command line.
exit	Exits the background terminal and returns you to the local terminal or command prompt on your computer.
adb help	Displays a list of all available ADB commands along with brief descriptions, helping you discover new commands.
adb -s <device>	Redirects subsequent ADB commands to a specific device identified by its unique device ID.
adb –d	Directs ADB commands to the only attached USB device, useful when multiple devices are connected.
adb –e	Directs ADB commands to the only attached emulator, facilitating testing and debugging on virtual devices.

Package Installation 

Command	Description
adb shell install <app>	Installs the specified app onto the connected Android device from the local system.
adb shell install <path_to_app>	Installs an app located at the specified path on the connected Android device.
adb shell install -r <path_to_app>	Reinstalls an app located at the specified path, replacing the existing version on the connected Android device.
adb shell uninstall <package_name>	Uninstalls the app identified by its package name from the connected Android device.

Paths

Command	Description
/data/data/<package_name>/databases	Represents the directory on the Android device where app-specific databases are stored.
/data/data/<package_name>/shared_prefs/	Represents the directory on the Android device where app-specific shared preferences files are stored.
/data/app	Refers to the directory on the Android device where APKs installed by the user are stored.
/system/app	Represents the directory on the Android device where pre-installed system APK files are stored.
/mnt/asec	Refers to the directory on the Android device where encrypted apps (App2SD) are stored.
/mnt/emmc	Represents the internal SD card directory on the Android device.
/mnt/sdcard	Represents the external or internal SD card directory on the Android device, depending on the device configuration.
/mnt/sdcard/external_sd	Represents the external SD card directory on the Android device, if present.
adb shell ls	Lists the contents of the current directory on the Android device.
adb shell ls -s	Lists the contents of the current directory along with the size of each file.
adb shell ls -R	Lists the contents of the current directory recursively, including subdirectories and their contents.

File Operations 

Command	Description
adb push <local> <remote>	Copies a file or directory from the local system to the specified location on the Android device.
adb pull <remote> <local>	Copies a file or directory from the specified location on the Android device to the local system.
run-as cat <file>	Accesses and displays the contents of a file located within the private package files of an installed app.

Package Info 

Command	Description
adb shell list packages	Lists the package names of all installed apps on the Android device.
adb shell list packages -r	Lists the package names of all installed apps along with the path to their corresponding APK files.
adb shell list packages -3	Lists the package names of third-party apps installed on the Android device.
adb shell list packages -s	Lists the package names of only the system apps installed on the Android device.
adb shell list packages -u	Lists the package names of all installed apps, including those that have been uninstalled but not yet removed.
adb shell dumpsys package packages	Provides detailed information about all installed packages on the Android device.
adb shell dump	Provides detailed information about a specific package identified by its package name.
adb shell path	Retrieves the file path to the APK file of a specific package identified by its package name.

Device Related Commands 

Command	Description
adb reboot-recovery	Reboots the connected Android device into recovery mode, enabling various system-level operations.
adb reboot fastboot	Reboots the connected Android device into fastboot mode, facilitating bootloader-related operations.
adb shell screencap -p "/path/to/screenshot.png"	Captures a screenshot of the device's current screen and saves it to the specified file path on the device.
adb shell screenrecord "/path/to/record.mp4"	Records the screen of the connected Android device and saves it as a video file at the specified location.
adb backup -apk -all -f backup.ab	Creates a backup of the device's settings and all installed apps, saving it to the specified file.
adb backup -apk -shared -all -f backup.ab	Creates a backup of the device's settings, installed apps, and shared storage, saving it to the specified file.
adb backup -apk -nosystem -all -f backup.ab	Creates a backup of only the non-system apps installed on the device, saving it to the specified file.
adb restore backup.ab	Restores a previous backup of the device's settings and apps from the specified file.
adb shell am start <intent>	Sends an intent to the Android system to start a specific activity based on the provided intent parameters.
adb shell am start -a android.intent.action.VIEW -d URL	Opens the default web browser on the device and navigates to the specified URL.
adb shell am start -t image/* -a android.intent.action.VIEW	Opens the default image viewer on the device, allowing the user to view images stored locally.

Configure Settings Commands 

Command	Description
adb shell dumpsys battery set level	Sets the battery level of the connected Android device to the specified value (0-100).
adb shell dumpsys battery set status	Sets the battery status of the connected Android device to the specified value (unknown, charging, etc.).
adb shell dumpsys battery reset	Resets the battery statistics of the connected Android device, clearing any accumulated data.
adb shell dumpsys battery set usb	Sets the USB connection status of the connected Android device to either ON or OFF.
adb shell wm size WxH	Sets the screen resolution of the connected Android device to the specified width (W) and height (H) in pixels.

Logs 

Command	Description
adb logcat [options] [filter] [filter]	Displays logs from the device, allowing you to monitor system and app activity for debugging purposes.
adb bugreport	Generates a bug report containing information about the device's current state, useful for debugging issues.

Permissions 

Command	Description
adb shell permissions groups	Lists all permission groups defined on the connected Android device, providing insight into app permissions.
adb shell list permissions -g -r	Lists detailed information about all permissions defined on the connected Android device, including their groups.

Do you want to access your Android device remotely? There's a tool for that: "Scrcpy."

Scrcpy lets you display and control your Android devices through a USB connection or over a network (TCP/IP).

To get started, you need to install and configure ADB (Android Debug Bridge).

Configure on windows

1) Download scrcpy from Github.

2) Configure scrcpy. Extract all contents and copy them to "C:\adb\".

Access Your Android device using a USB cable

Now open your command-line interface. Here type “adb devices” to display all information about devices connected to the PC and with their serial numbers.

Now Run scrcpy.exe. Here you see your device pop up on the screen.

Now let it connect with TCP/IP. 

Access your Android device from the IP address

You have just to type "adb connect {your device IP address}" with port ID. And hit enter. 

As here you see we are now connected with the Android device through TCP/IP.

Before we start, it is important your Android device and your PC both be connected to the same network.

Now open the command-line interface. Plugin your Android and here type "adb devices". As here you see a device is connected to a USB.

Now here type adb tcpip <port number>.

Now let it connect. Type "adb connect" and here type your IP address. To find the IP address, go to Settings → About phone → Status. This is your IP address.

Run scrcpy.exe:

There are few other commands are there. I suggest you read the manual by typing "scrcpy.exe -h".

If you have any doubts or queries write below in my comment.

The ADB-Toolkit is a comprehensive BASH Script featuring 28 options, including a METASPLOIT Section with 6 additional options specifically tailored for penetration testing on Android devices. Developed in collaboration with ADB (Android Debug Bridge), this tool facilitates various tasks related to debugging and modifying Android applications.

Install & Configure on Linux

To get started with the ADB-Toolkit on Linux, follow these steps:

1. Open the Terminal and execute the command below to download or clone the ADB toolkit from its GitHub page:

2. Once downloaded, navigate to the toolkit directory and install it using the following commands:

3. After installation, you can launch the tool using the command:

For visual reference, a screenshot of the ADB Toolkit is provided below the commands.

Any further guidance on the usage of the ADB Toolkit can be found in a video tutorial, where users can watch and discover the answers to their queries.

Usually, ADB is used to communicate or Access an Android Device to find bugs and vulnerabilities.

Click Here to Learn More About ADB (Android Debug Bridge)

But this video is going to be an experiment. Can I manage two Android devices using ADB, if yes then how? Let’s find out our answer with this Article.

Prerequisites

The following are the requirements before we proceed further:

1. Two Android Devices with OTG supported (On my side Infinix Hot 8 and Samsung J7)
2. OTG cable or Port
3. USB cable

Getting Started

My Infinix device will be my host device(Infinix) and Samsung will be my target device(Samsung j7).

1. Open Playstore and install the ADB OTG Application.

2. It’s time to Plug in the OTG to the Host device and then Plug in the USB cable to the corresponding side.

3. Now launch the application to get the ADB command shell. A pop-up screen appears on my Samsung device.

4. Click ok and give access to the host. Now here on my Infinix device, I get the shell interaction. 

5. Now it's your time to type UNIX-based commands.

Apktool is a tool used for Android application reverse engineering, and for creating malware by infecting legitimate apps. 

Apktool is one of the most important tools that must be included in an Android penetration tester's arsenal.

2. Download apktool-2 (find the newest here). Move the downloaded file to the C:\apktool\ folder. Rename the downloaded jar to apktool.jar.

3. If you do not have access to Apktool, then you have to add that directory to your Environment Variables System PATH variable.

Right-Click on This PC > Click Properties > Advanced System Settings > Environment Varibale.

4. Double click on Path and paste the path of the system variable. Put a semicolon (;) and paste the path C:\apktool. For Windows 10 users just paste no need semicolon. 

5. To Run Apktool, open Command Prompt (Press CTRL + R and type cmd) and type apktool.

Apktool for Linux

Apktool comes pre-installed with Kali Linux. If you have any other Linux just follow my steps:

1. Download the Linux wrapper script and paste it into any text editor. Save it as apktool.

If you are a Kali Linux user no need to worry just go to Application > Reverse Engineering > Apktool.

Usage of Apktool

Use debug mode (d) to decode the given apk file (/Desktop/test.apk):

It will create a new directory on your desktop.

Open that file.

Using Apktool, you inject malicious code inside this application and many more. You learn them in my upcoming article, so stay connected with us.

Use build mode (b) to build the apk again (/Desktop/test):

To find the apk, Go to this Path (/Desktop/test/dist). 

Learn more in my upcoming article.

Dex2jar and JD-GUI are two different tools that are often used for reverse engineering Android apps. Dex2jar converts .dex files to .jar files, and JD-GUI is a Java decompiler that can decompile .jar files to the original Java source code.

Steps to install Dex2jar

For Windows

Follow the below steps to install dex2jar on the Windows Platform:

Remember: Before decompile an android app, make sure you have pasted the APK file inside the dex2jar directory.

 4. A jar file just appears on the desktop screen.

Steps to Install JD-GUI and its Usage

For Windows

• Use the following command to install JD-GUI on Linux:

3. Run JD-GUI by searching on All Applications.

In this way, You can decompile any APK file in this way, just follow my steps.

We all remember the time when we used to create a bunch of applications to check for vulnerabilities in Android applications. Then Drozer came into existence, an open-source all-in-one combination to check your application against known vulnerabilities.

Download and install Drozer

Drozer is a tool used for automated Android app assessments.

Prerequisites

The following are the requirements for setting up: 

• A workstation (in my case Windows 8) with the following:
• JRE or JDK
• Android SDK (ADB)
• An Android device or emulator running Android 2.1 or later.

Steps to install Drozer

Follow my steps to get Drozer up and running. Before we proceed further, make sure you already have Java and ADB, up and running on your Windows workstation.

1. Visit the official GitHub page and click on release and download the appropriate version of Drozer, if you are working with a different setup, and also download the appropriate agent file.

2. Extract the downloaded zip file, and run the Drozer installer. The installation uses the usual Windows installation wizard.

 3. Click Next, and choose the destination location for Drozer installation.

As shown in the preceding, the default location is C:\drozer. It is recommended you use the default location if you would like to configure your system identical to ours.

4.  Follow the wizard's instructions to complete the installation. Click Finish to complete the process.

The preceding installation process automatically installs all the required Python dependencies and sets up a complete Python environment.

To check the validity of the installation, perform the following steps:

1. Go to the destination folder of Drozer and open the command prompt by pressing SHIFT and right-click on the mouse. 

2. Now run the drozer.bat file, 

3. Install the agent.apk file using ADB, So copy the agent.apk file to the Drozer folder. Plugin Android device via USB and run the following command.

Don't know what ADB is then click here

4. To start working with Drozer for your assessments, we need to connect the Drozer console on the workstation to the agent on the device.

To do this, start the agent on your Android device and run the following command to set the port forward. 

Make sure you are running the embedded server when launching the agent.

5. Let me check the help commands.

6. Now, we can simply run the following command to connect to the agent from the workstation.

We should now be presented with the Drozer console, as shown on my window screen.

There are many fun things you can do with Termux on your Android device. Here are a few examples:

  _   _      _ _        __        __         _     _ _ _
 | | | | ___| | | ___   \ \      / /__  _ __| | __| | | |
 | |_| |/ _ \ | |/ _ \   \ \ /\ / / _ \| '__| |/ _` | | |
 |  _  |  __/ | | (_) |   \ V  V / (_) | |  | | (_| |_|_|
 |_| |_|\___|_|_|\___/     \_/\_/ \___/|_|  |_|\__,_(_|_)

I hope This Section will be the most interesting part for you, in a few moments we all learn how can hack using it. When it comes to Hacking Tools, There are hundreds even thousands of Tools Available, but I am here to present you with a few of them. Which are Very Powerful and Used By Professional Security Researchers, Ethical Hackers, and even Black Hat Hackers. 

What if we could install Kali Linux on our mobile phones as well as our computer? If I say yes we can install Kali Linux on our device without having to root our mobile device. Kali Linux is widely used for advanced Penetration Testing and Security Auditing.

Prerequisite:

1. Android Device (Stock unmodified device, no root or custom recovery required)
2. Termux 
3. Download NetHunter-KeX client, and Hacker's keyboard from NetHunter Store.

Install and Configure

Open Termux and type:

Download rootfs File Manually and install Kali NetHunter

1. Open your browser and visit this link: https://images.kali.org/nethunter/kalifs-arm64-full.tar.xz to download rootfs file. 

2. Copy rootfs file:

3. Run again following command to install:

NetHunter GUI

1. To interact with Nethunter GUI you have to reset kex password:

2. To run it by the following command:

3. Open the NetHunter Kex VNC tool and change the port number and password. Now click connect to connect.

Make your device a server

If you want to access NetHunter GUI from your laptop or any other phone, It need to configure vnc.conf file.

So go to NetHunter. Now open vnc.conf file using a nano text editor.

Scroll end and write the following code:

Download RealVNC and connect with IP and Port number. Run Kali with root privileges then type the following:

Text Editors for Termux

To check what you write on the screen just use the cat command.

Android is the world's most popular Operating System, but it doesn't have any significant presence on PCs (Desktop or Laptop). If you have ever wondered, how you can run Android on your Desktop.

An Open Source OS, based on Android, that incorporates many optimizations, features, and expanded device support. And it is available for just about any Chromebook, Windows/Linux PC, or tablet released in the last 4 years

Steps to install Bliss OS on Virtual Box

1.  Download Bliss OS from their official website.

2. Open Virtual Box and create a new Virtual Image. Click "New".

3. Set the Name as "Bliss OS", type Linux and Version to Other Linux(64-bit), and click next.

4. Set the Memory size to 1024GB or More and the Virtual Disk size to 16 GB or more. After all is done, click Create.

5. Now Insert the iso image into Storage. Click settings and click on Storage.

6. Now Start Bliss OS. 

7. Now create a Partition before proceeding further. 

• Click on "Create /Modify Partitions".
• Next, it will ask you "Do You want to use GPT?"  So click No.
• Now new step click on "new > Primary > Bootable", then click Enter.
• When all done! type yes to write the partition table to disk.

8. Now quit to main installation step and select Primary memory to go further the installation step. It will take around 10 min to complete. After all, done! Run Bliss OS.

9. Now you see Bliss OS successfully installed on the system. 

Note: The Booting Process may take a couple of minutes, so keep calm and stay connected.

Android Rooting techniques are typically used to root Android devices. In this article, we will begin with the basics of rooting and its pros and cons. Then, we shall move on to topics such as various Android partition layouts, boot loaders, boot loader unlocking techniques, and so on. 

If you have read these articles, then you have a basic understanding of rooting, and its advantages, and disadvantages. In this same article, we also rooted a Samsung device using Odin. 

Learn More:

• Android Rooting: 

• Flashing the Custom ROM to the phone: 

What if you are using a device like Vivo, Oppo, Infinix, or much more similar to these companies, then the previous steps cannot work. 

Hello everyone, I welcome you all to a new article, where we will be going to root my Infinix device, model no: hot 8 x650c. Let’s see how it will be done, and also we are going to find a way to install LineageOS unofficial version.

Before getting started make sure you have a Micro SDcard or a Pendrive in your hand. Always remember, This process may lose your data and take a backup of your storage and applications.

Firstly, download the required tools below the link. 

Required tools

• TWRP: https://bit.ly/3FnLrjb
• orange_state_disabler_MTK_only: https://bit.ly/3yiYAbP
• Fastboot_driver: https://bit.ly/3LXvuT8

Once you have specified tools ready, then open Command Prompt by clicking window + R and type CMD, and hit OK.

Before that, you have to enable it by following this path. Tap on Settings then System then About Phone and then tap a few times on build number, usually seven to nine times. Now, go back to the menu and you will see Developer options as shown following.

Once you are done with it, connect the phone to the USB cable and type adb devices to check if the device is recognized or not.

Allow USB debugging on your phone.

Now switch to fastboot mode using ADB reboot bootloader. 

Now my device is successfully switched to fastboot mode. 

Type fastboot devices to check if the device is recognized or not. 

If the device is not listed then check the driver setting if there is an issue with it.

I found the issue is with the driver, so I have to update the driver. Extract the Fastboot driver zip file. 

Now switch to the Device Manager window and right-click on android, and click on update driver. 

From here click on the manual procedure. 

From here click on "Let me pick from a list of available drivers on my computer".

Select "Show All Devices" and click Next:

Now click on the hard disk and select the android_winUSB file from the extracted zip file.

From here choose the android bootloader interface and click next to install the driver without having trouble.

Now issue the command if the device is listed or not. 

To unlock the bootloader and enable partitions to be reflashed, run the fastboot flashing unlock command on the device. 

Press the volume up button to continue the process.

Type the following command to check if we are succeeded or not.

Now reboot the device using fastboot reboot. 

The reboot takes time to initiate. Due to the flashing unlock command the device reset, so we have to settings up the device again.

Again, we have to allow USB debugging, which will help us to proceed with further steps. Now we have to flash the TWRP recovery software, which we have downloaded previously. 

Extract the zip file, where you find out two image files and a zip file.

Before we flash the image file, we have to copy the following files to the Micro SD card and Also copy Magisk Manager to the SD card. 

Now, open the Command prompt and run adb devices command to check if the device is listed or not.

Now switch to fastboot mode, and check if the device is recognized or not. If your device is not listed, then again update the driver.

Now, type the following command to flash TWRP recovery software:

Once flashing is complete, turn on your device using the power button along with the volume up button. You will display it with the TWRP recovery screen. 

Now click on install and select the SD card. Now flash each of the files one by one.

If everything was done without having an error, just reboot your system. This is the complete process to root this type of device.                        

Magisk Manager is a widely used rooting tool for Android devices. It provides you the root access of the Android device through which you can access additional features, you can also customize Superuser permissions and other system grants.

Steps to root any Android Device using Magisk Manager

2. Now, Switch off your device and boot it into the recovery mode by pressing the volume up, home, and power buttons simultaneously.

3. Click on Install select the Magisk zip file and flash it, and then reboot the system.

4. Now you can check the root access using a Root checker application.

In this section, we will discuss how to root an unlocked Samsung Galaxy J7(2015) which uses Samsung's customized version of Android OS, we will also see the differences between Stock Recovery and Custom Recovery, and finally, we will install a Custom ROM on our Samsung J7 device.

If you don't know what is rooting, then click the below link:

Stock recovery and Custom recovery 

Android's recovery is one of the most important concepts for both tech users as well as users who use their phones just for making phone calls and regular surfing. When a user gets an update for his device and applies it, Android's recovery system ensures that it is properly done by replacing the existing image without affecting the user's data. 

The Stock recovery image that is usually provided by the manufacturers is limited in nature. It includes very few functions that allow a user to perform operations such as wiping cache, user data, and performing system updates. We can boot our device into recovery mode to do any of those operations specified such as wiping the cache. The steps/hardware keys used for booting into recovery mode could vary from manufacturer to manufacturer.

Custom recovery on the other hand provides more features such as allowing unsigned update packages, wiping data selectively; taking backups, setting up restore points, copying files onto SD cards, and so on. ClockWorkMod is one of the popular recovery images that can be shown as an example of custom recovery images. 

As mentioned earlier, some manufacturers provide an official method to unlock bootloaders and some come unlocked. If you bought an unlocked phone that is not on contract, most probably you have an unlocked bootloader.

Warning: Rooting and Custom ROM installations always have a risk of data loss, and worst, bricking the phone, so you should always backup the data before you proceed to root. You can backup your data/contacts and so on, by using Google's sync data option or any third-party app.

Prerequisites

Before we embark on our journey of rooting the phone, make sure you have the following prerequisites in place.

1. Download the Samsung USB driver from the following URL and install it on your computer: 

2. You also need to enable USB debugging by following this path: Settings | Developer options. Your screen might be slightly different based on the Android version you are using, but look for USB debugging and OEM unlock and then enable it:

If you don't see the Developer options, you can enable it by from Settings | About Phone and then tap a few times on Build Number, usually seven to nine times, and go back to the menu and you will see Developer options as shown following.

3. Make sure you already have ADB on your system . Check it by opening the command prompt and typing adb.

4. Connect the phone to the USB cable, and then type adb devices to check if the device is recognized:

5. Once you plug in the cable, you might get the authorization popup Allow USB debugging, please allow it.

Rooting Process

If you are interested in rooting your device, you only need to follow 2 simple steps:

1. Installing recovery software like TWRP or CF
2. Installing the Super Su app

1. Installing recovery software

1. Odin and Heimdall are two popular ways to install recovery software, like TWRP, or CF.

2. Before we proceed further, we need to download the TWRP recovery img.tar file for J7 from the official site:

Flash the TWRP recovery software Using Odin

Odin is one of the most popular recovery tools for Samsung devices. This section shows the steps to use Odin.

1. Download the Odin package, and extract it using WinRAR.

2. click on Odin to open it, and you should see the following screen:

3. We need to put the device into download mode by switching off the smartphone and pressing the volume up, home, and power buttons simultaneously.

4. Once the device boots into the download mode connect the device to your computer using the USB data cable.

5. You will see a warning, accept the Continue option by pressing the volume up button. 

6. If you have installed the right USB drivers, you will see Odin's ID: COM in blue text. Otherwise, you need to reinstall the driver or check your cable for any faults.

7. Click on the AP button, and select the TWRP recovery image file by clicking on the AP button. Make sure you enable Auto Reboot and F: Reset Time.

8. Click on the Start button in Odin to flash TWRP. It will take a few seconds to complete and if everything went well, you should see PASS! in green as shown on the following screen. Once the process is complete your phone will restart automatically.

9. Now you have successfully flashed TWRP recovery.

2. Rooting a Samsung Galaxy J7

This section explains the step-by-step process to root a Samsung Galaxy J7.

1. Download Super SU from here, and save it.

2. Connect the device to the computer using a USB cable and use the ADB push command to copy the file to the SD card and unplug the cable once you're done.

3. Switch off your device and boot it into recovery mode by pressing the volume up, home, and power buttons simultaneously. You will see the Team Win Recovery Project (TWRP) screen, click on Install.

4. Select the Updated Super Su Zip file to start the flashing process.

5. Once the installation is complete, you will see the Install Complete message. Click on the Reboot System to reboot the phone.

6. Once your phone starts, you should see Super SU added to your phone.

7. Connect to the device from the system using a USB cable, and check if you can log in as a root user by typing the following command:

A Pop-up request appears on the screen:

8. Congratulations, you have successfully rooted your device:

If you have read my previous article, then you might have learned, “How to unlock the bootloader to flash recovery software and root your Android device?”

To Learn More: Unlock Bootloader for [Infinix][Vivo][Oppo]

Although having an unlocked bootloader is useful in many ways like flashing firmware (factory images), installing TWRP, and getting root, it can also lead to blocked services on your device due to security reasons, and hence you might want to relock the bootloader to avail those services.

Before proceeding to further action, you have to download the flashing software and Stock Frameware ROM.

How do re-lock the bootloader securely of my Infinix device?

Firstly, download the appropriate FramewareROM, and also, You need a flashing tool to flash the Frameware. I suggest you download the transsion v4.1901.23.17.

Before typing and command, make sure you have already enabled the USB debugging, connect the phone to the USB cable, and type adb devices to check if the device is recognized or not.

Now switch to fastboot mode using the ADB reboot bootloader.

Once the device successfully switches to fastboot mode, type fastboot devices to check if the device is recognized or not. If you get any errors, then update the driver with the previous procedure.

Type the fastboot flashing lock command to lock the bootloader:

On successful execution, your device system will crash and not be able to boot again or you can say it as the device is dead.

So, now, we have flashed the Frameware ROM that we have previously downloaded.

First of all, extract the transsion software download tool. Using this one can revive a dead Android phone, reset, fixing a bricked device.

Now, we have to download a few drivers and install Them:

• MediaTek_Driver_Auto_Installer: https://androiddatahost.com/276a2
• Android SPD Driver: https://androiddatahost.com/gzn5n

Launch the application. 

Once the application is loaded click on setting, and load the path of the scatter file. 

Before that, we have to extract the frameware zip file.

Load the file and click on confirm.

Click on Start, to start the process and plug in your USB cable and you will see the download process. 

On successful flash, the frameware, unplug the USB cable, and reboot, your device and you will see, that your problem is fixed.

Lock the bootloader of a Samsung device

For a Samsung device, you will need to download the Flashing Software( i.e., Odin) and Samsung Custom Rom. Once the files are ready, extract them all. 

On successful execution, the interface will look like this:

We need to put the device into download mode by switching off the smartphone and pressing the volume up, home, and power buttons simultaneously.

Once the device boots into the download mode connect the device to your computer using the USB data cable, and you will spot Odin's ID: COM in blue text. Otherwise, you need to reinstall the driver or check your cable for any faults:

Click on the AP button, and select the MD5 file. Make sure you enable Auto Reboot and F: Reset Time.

Click on the Start button in Odin. It will take a few seconds to complete and if everything went well, you should see PASS! in green as shown on the following screen. Once the process is complete your phone will restart automatically.

Kali NetHunter is a free and open-source Mobile Penetration Testing Platform for Android Devices (based on Kali Linux) developed by Offensive Security, the creator of the popular Kali Linux distribution. 

It is designed for various devices and includes support for hacking wireless networks, web applications, and mobile devices.

NetHunter supports wireless 802.11 frame injection, one-click MANA Evil Access Point setups, HID keyboard (Teensy-like attacks), as well as BadUSB MITM attacks. It also includes a custom kernel, which has been specially configured for penetration testing and includes support for various wireless hacking tools. NetHunter also includes several command line utilities, including Nmap, Metasploit, and sqlmap, making it a powerful platform for network and application security testing.

Kali NetHunter Lite is a lightweight version of the Kali NetHunter penetration testing platform for Android devices. It is designed for devices with low hardware specifications and limited resources, such as smartphones with low memory and storage capacity. 

Here, in this video, we will be going to install Kali Nethunter lite on a non-listed device. Remember, your Android device must be rooted with the help of the Magisk manager . 

Kali NetHunter Lite can be installed on any compatible Android device, as long as the device is rooted. It is not available on the Google Play Store, so you will need to download the NetHunter Lite image file from the Kali Linux website and install it on your device manually.

Note: To install Kali NetHunter Lite on an Android Device, your Device must be rooted with Magisk Manager. 

Here, In this article, I am going to install Kali NetHunter lite on a  Samsung Galaxy J7 (2015)  non-listed Android Device.

According to the Specifications, Samsung Galaxy J7 (2015) is a 32-bit of Architecture. Since the  Samsung Galaxy J7 (2015) has low space, so I have to download the nano version.

Follow the below Article to root your Android Device:

I recommend you all install Kali NetHunter Lite on LineageOS. Because LineageOS is customizable and the most important part is, "After a successful flash, you can showcase Kali Boot Animation ".

Install Kali NetHunter Lite on LineageOS

Follow the below steps to install Kali NetHunter Lite on Samsung Galaxy J7 (2015) on LineageOS:

1. Launch the Magisk Manager app.

2. Tap on Module Tap.

3. Choose the "NetHunter Generic ARMhf kalifs-full" zip file from Storage, which we have downloaded from the Kali Linux official site.

4. So that it will automatically flash NetHunter Lite custom ROM.

5. This process may take 25 minutes or more. Once the custom ROM flashes, reboot your device.

6. Once boot up, you will find 4 newly installed applications.

7. Launch NetHunter Application. 

• Allow all permission for NetHunter application and also grant root privilege.

8. NetHunter Lite successfully booted up, but " Kali Chroot manager " is not up and running, so we have to install Kali Chroot.

9. Tap on Kali Chroot Manager, and then click "Install Kali Chroot".

11. Click on " Start Kali Choot ", to start to chroot environment.

12. Once installation is successful, you will find out NetHunter Lite is up and running.

When the Kali Chroot Manager is running, you can use it to manage the Kali Linux Chroot environment on your Android device. This includes installing and removing tools, configuring settings, and accessing the command-line interface (CLI) version of Kali Linux.

These are the complete process to install and set up Kali NetHunter Lite on a non-listed device.

Install Kali NetHunter Lite without LineageOS support

If your device does not have lineageOS support, you can follow a similar process to install it.

Sometimes, After a successful flash, if you do not find the NetHunter applications, then you will have to flash the Kali Nethunter Lite from TWRP recovery software.  

Follow the below steps to install Kali NetHunter lite on any Android device:

1. Firstly, switch off your Mobile, and switch to the TWRP recovery mode by pressing the Power button, volume up, and Home button simultaneously.

2. Here, click on Install and tap on the downloaded Kali NetHunter zip file. 

It will automatically flash the software and install the required packages.

3. On successful flash, reboot the system. Now, launch the  Kali NetHunter lite Application from the Application Menu. 

4. Allow all Permission and, Grant superuser privileges. 

5. Once Superuser privilege is granted, the Kali NetHunter lite app automatically detects installation files. Kali NetHunter lite successfully boots up, but Kali Chroot's manager is not up and running. 

6. To set up Kali Chroot, Tap on the " Kali Chroot Manager ".

7. If you face this error, we will have to install Kali Chroot manually. Firstly, extract the zip file and copy the " tar.xz " file to the home (Device Storage)  directory.

8. Go back to the Kali NetHunter Application and Tap on " Install Kali Chroot  → Restore from Local Storage (.tar.gz, .tar.xz), and set the path of the file.

9. This installation process takes time, based on System performance. 

10. Chroot Manager was successfully installed, but various file systems are not yet mounted. So we have to start Kali Chroot, to start Kali Chroot environment.

11. Tap on Start Kali Chroot to the chroot environment.

12. Kali Chroot manager is up and running.

When the Kali Chroot Manager is running, you can use it to manage the  Kali Linux Chroot environment on your Android device. This includes installing and  removing tools,  configuring settings, and accessing the  command-line interface (CLI) version of Kali Linux.

The Android platform can be attacked either by creating a simple APK file or by injecting the payload into an actual APK. We will cover the first one. Let us get started by generating an APK file with msfvenom as follows: 

On generating the APK file, all we need to do is to either convince the victim (perform social engineering) to install the APK or physically gain access to the phone. Let us see what happens on the phone as soon as a victim downloads the malicious APK:

Once the download is complete, the user installs the file as follows:

Most people never notice what permissions an app asks for. Hence, an attacker gains full access to the phone and steals personal data. The preceding section lists the required permissions an application needs to operate correctly. Once the installation happens successfully, the attacker gains meterpreter access to the target phone as follows:

Whooaaa! We got the meterpreter access easily. Post-exploitation is widely covered in Chapter 4, Post-Exploitation with Metasploit. However, let us see some of the basic functionalities as follows:

We can see that running the check_root command states that the device is rooted. Let us see some other functions:

We can use the send_sms command to send an SMS to any number from the exploited phone. Let us see whether the message was delivered or not:

Bingo! The message was delivered successfully. Meanwhile, let us see what system we broke into using the sysinfo command as follows:

Let's geolocate the mobile phone as follows:

Browsing the Google Maps link, we can get the exact location of the cell phone as follows:

Let us take some pictures with the exploited phone's camera as follows:

We can see we got the picture from the camera. Let us view the image as follows:

Client-side exploitation is fun. However, it is tough to conduct since we require actions and help from the victim to execute a file, visit a link, or install an APK. However, in the situations where no direct attack is possible, client-side attacks are the ones that are the most useful.

Ghost Framework is an Android post-exploitation framework that exploits the Android Debug Bridge to remotely access an Android device.

Extra Credit

L3MON is a cloud-based remote android management suite, powered by NodeJS. 

Usage of L3MON

• GPS Logging
• Microphone Recording
• View Contacts
• SMS Logs
• Send SMS
• Call Logs
• View Installed Apps
• View Stub Permissions
• Live Clipboard Logging
• Live Notification Logging
• View WiFi Networks (logs previously seen)
• File Explorer & Downloader
• Command Queuing
• Built-In APK Builder

Pre-requisites

• Java Runtime Environment 8
• Kali Linux or any Linux distros
• NodeJs
• A Server

Installation Procedure

The installation procedure is quite easy to set up just follow few steps:

Install JRE 8

We cannot stress this enough USE java 1.8.0 ANY issues that don't use this will be closed WITHOUT a response.

• Debian, Ubuntu, Etc

If you found a JDK-8 installation candidate then Click here.

Install NodeJS

Quite easy to install Click Here to get more info or paste this command if you are a Debian-based Linux user.

If you found any dpkg error click here to fix it.

Install PM2

PM2 enables you to keep applications alive forever, reloads them without downtime, helps you to manage application logging, monitoring, and clustering.

• Download and Extract the latest release from GitHub.
• In the extracted folder, run these commands

Set a Username & Password

• Now Stop L3MON

• Open maindb.json in a text editor
• under admin
• set the username as plain text
• set the password as a LOWERCASE MD5 hash
• save the file
• run

In your browser navigate to http://<SERVER IP>:22533

It's recommended to run L3MON behind a reverse proxy such as NGROK.

A cloud-based Android Monitoring Tool that gives you the power to control/SPY any Android device.

Usage of XploitSPY

• GPS Logging
• Microphone Recording
• View Contacts
• SMS Logs
• Send SMS
• Call Logs
• View Installed Apps
• View Stub Permissions
• Live Clipboard Logging
• Live Notification Logging
• View WiFi Networks (logs previously seen)
• File Explorer & Downloader
• Command Queuing
• Built-In APK Builder

Pre-requisites

• Java Runtime Environment 11 or above
• Kali Linux or any Linux distros
• NodeJs
• A Server

Installation Procedure

The installation procedure is quite easy to set up just follow few steps:

Install JRE 8

We cannot stress this enough USE java 1.8.0 ANY issues that don't use this will be closed WITHOUT a response.
Debian, Ubuntu, Etc

Install NodeJS

Quite easy to install Click Here to get more info or paste this command if you are a Debian based Linux user.

If you found any dpkg error click here to fix it.

Install PM2

PM2 enables you to keep applications alive forever, reloads them without downtime, helps you to manage application logging, monitoring, and clustering.

Clone the latest release from GitHub and go inside the XploitSPY directory.

In the extracted folder, run these commands

Now Stop XploitSPY:

If you want to set up your Username & Password then you can try the following command:

If you do not know how to configure then click here.

Now again start the server.

In your browser navigate to http://<SERVER IP>. ex: http://127.0.0.1

It's recommended to run XploitSPY behind a reverse proxy such as NGROK.

The box, I will be writing up from the result is Android 4.

The settings up are quite easy and it is similar to the past videos.

• Firstly, download the ".ova" mirror image.
• Open Virtual Box. 
• Click on import, and browse the file from the Download directory.
• On completion, Check if the Network Adapter is set to Host-only adapter, or not.

Once you are done with the settings up, let’s start the instance VMs.

The instance is ready, and we have got a UI that asks us to input a password. Our task will be to find the flag and also will unlock the password screen.

Enumeration

The instances are ready and we are on Kali Linux. Let's find out the IP address by using Netdiscover. 

We have discovered an IP address, so let's perform a network scan to detect what ports are open, which is already known as an essential part of the enumeration process. This offers us the opportunity to better understand the attacking surface and design targeted attacks. As in most cases, we are going to use the famous Nmap tool.

Conducting Network Scans with Nmap

• -sC : Performs a script scan using the default set of scripts. 
• -sV : Enables version detection, which will detect what versions are running on what port.

From the network scan, we have spotted 2 open ports.

• Port 5555/TCP seems to be like a Freeciv gaming protocol.
• Port 8080/TCP running an HTTP service, which indicates that there might be a website running.

To look at the contents ourselves, we can open a web browser of our choice and navigate to the target's IP address along with port 8080 in the URL bar at the top of the window.

Foothold

Anyone would establish that there is some kind of verbal tampering involved in using the POST method. We tried but didn’t find anything useful.

This seems to be like, an information page. 

Discovery of Hidden Directories with Gobuster

Let’s brute force the directory and URL using gobuster. 

We found nothing from the result.

From the Nmap result, we have discovered port 5555 is in an open state. After analyzing, I confirmed that the Android device might be connected through the ADB command-line utility.

Remotely Accessing Android Devices with ADB

If you don’t know, what is ADB? 

• Learn More:  

Firstly open a terminal, and check if there ADB command-line utility is already installed or not. If not then install it.

To get to connect the Android device through the network:

On successful execution, you can list the connected devices using ADB devices. As you can see, we have successfully managed to get into the server.

To get interaction with the shell, use the ADB-shell command, where you can perform Linux commands to get the flag.

Privilege Escalation

From the output of the ADB shell command, we have successfully managed to get a shell that seems to be like a normal user account. To switch the user to superuser access then run the su command.

We have successfully managed to escalate to the highest privilege. You can find the root flag to complete the challenge.

Congratulations on the completion of capturing the flag.

Bypassing Android Device Lock Screen Security

Let’s see if we could remove the lock screen password using ADB. So firstly change the directory to the previous directory which is a data directory. 

From here change the directory to the system, and list all files and directories. 

The keys are stored within the file which contains the ".key" extension. 

The key files are removed.  Reboot the device to see the magic. 

We have successfully managed to bypass the lock screen.