So, let’s see if this application is logging the data into logcat. It is common that Android apps log sensitive information into logcat. The goal is to find out where the user-entered information is being logged and also the code making this vulnerable. If you want more details on how to setup the above mentioned tools, please refer to my article on Reverse Engineering here.Īll set to crack the challenges. $ java -jar apktool_2.0.3.jar d diva-beta.apk -o outputįigure 1 Contents of AndroidManifest.xml(truncated) So, let’s use apktool to get the AndroidManifest.xml file and smali code as shown below. Additionally, apktool provides us the smali code. This gives us great deal of information about the app and its internal structure. Getting AndroidManifest.xml and smali code using apktoolĪnother important thing in static analysis of Android apps is having access to Androidmanifest.xml file. Open up this newly created diva-beta_dex2jar.jar file using JD-GUI as shown below. Once done, you should see diva-beta_dex2jar.jar file in the same directory where you have dex2jar. This cmd is deprecated, use the d2j-dex2jar if possibleĭex2jar diva-beta.apk -> diva-beta_dex2jar.jar So, run the following command to convert the dex file into a jar file. As mentioned earlier, I have set up my lab on a machine running Mac OSX.

java files using dex2jar and JD-GUI tools we set up earlier. Getting the readable java files is always helpful during an assessment. Note: This step is must, as some of the challenges require you to look at the source code. So, lets reverse engineer our target application to get ready to crack the challenges. One of the first steps to find vulnerabilities is static analysis by reversing the app. Now, let’s explore how to solve the challenges provided in this application. Android utilities – adb, sqlite3, aapt etc.Download and install (if required) the following tools.So, set up the following tools preferably on a Unix based machine. We will use both manual and automated techniques to crack these challenges. Let’s also some important tools to crack these challenges. We are ready with the target application now. If you have done everything successfully, launch your application.Launch an emulator and install the apk file using as shown below.You can download the application from here. Download the application and extract the APK from the compressed tar file.We are going to solve all these challenges on an emulator.

Download diver diva