apk speed enviroment for pentest

emulator -avd Pixel_5_API_30 

 adb root; adb connect localhost:6000; sleep 1; adb push frida-server /data/local/tmp/; adb shell "chmod 755 /data/local/tmp/frida-server"; adb shell "/data/local/tmp/frida-server &" 

next

frida-ps -U |grep APK

  frida -U -n APK --codeshare pcipolloni/universal-android-ssl-pinning-bypass-with-frida 

or

  frida -U -n APK --codeshare akabe1/frida-multiple-unpinning

Penetration test flutter app

https://github.com/ptswarm/reFlutter

 ❯ pip3 install --upgrade --force-reinstall reflutter

Defaulting to user installation because normal site-packages is not writeable

Collecting reflutter

  Downloading reflutter-0.7.8-py3-none-any.whl.metadata (9.0 kB)

Downloading reflutter-0.7.8-py3-none-any.whl (24 kB)

Installing collected packages: reflutter

  Attempting uninstall: reflutter

    Found existing installation: reflutter 0.7.7

    Uninstalling reflutter-0.7.7:

      Successfully uninstalled reflutter-0.7.7

  WARNING: The script reflutter is installed in '/Users/michal/Library/Python/3.10/bin' which is not on PATH.

  Consider adding this directory to PATH or, if you prefer to suppress this warning, use --no-warn-script-location.

Successfully installed reflutter-0.7.8

USAGE:

reflutter your.(apk)|(ipa)

❯ /Users/michal/Library/Python/3.10/bin/reflutter 49406.apk

 Choose an option: 

 1. Traffic monitoring and interception 

 2. Display absolute code offset for functions

 [1/2]? 1

Example: (192.168.1.154) etc.

Please enter your BurpSuite IP: 192.168.51.129

 Wait...

SnapshotHash: ee1eb666c76a5cb7746faf39d0b97547

The resulting apk file: ./release.RE.apk

Please sign,align the apk file

Configure Burp Suite proxy server to listen on *:8083

Proxy Tab -> Options -> Proxy Listeners -> Edit -> Binding Tab

Then enable invisible proxying in Request Handling Tab

Support Invisible Proxying -> true

DOWNLOAD:

https://github.com/patrickfav/uber-apk-signer

❯ java -jar uber-apk-signer-1.3.0.jar --apks release.RE.apk

source:

/Users/michal/Downloads

zipalign location: BUILT_IN 

/var/folders/gs/n5db96m941gb7b4ly4r1dw100000gn/T/uapksigner-2589864279722257602/mac-zipalign-33_0_216157554363753981716.tmp

keystore:

[0] 161a0018 /private/var/folders/gs/n5db96m941gb7b4ly4r1dw100000gn/T/temp_3968706172894682738_debug.keystore (DEBUG_EMBEDDED)

01. release.RE.apk

SIGN

file: /Users/michal/Downloads/release.RE.apk (221.2 MiB)

checksum: e28f1257d549f0cb5cfe774a4ad6ffa379be58f91c74aa6630ad720fcafb253a (sha256)

- zipalign success

- sign success

VERIFY

file: /Users/michal/Downloads/release.RE-aligned-debugSigned.apk (221.34 MiB)

checksum: 6504671cfc17578de09c94f90fdd79cf9fd838de633f3b25c25ba865f5dab1d2 (sha256)

- zipalign verified

- signature verified [v3]

Subject: CN=Android Debug, OU=Android, O=US, L=US, ST=US, C=US

SHA256: 1e08a903aef9c3a721510b64ec764d01d3d094eb954161b62544ea8f187b5953 / SHA256withRSA

Expires: Thu Mar 10 21:10:05 CET 2044

[Thu Mar 14 20:07:37 CET 2024][v1.3.0]

Successfully processed 1 APKs and 0 errors in 5.43 seconds.

❯ adb install release.RE-aligned-debugSigned.apk

Performing Incremental Install

Serving...

Success

Install command complete in 527 ms

~/Downloads ❯ All files should be loaded. Notifying the device.    

MobSF on MacOS

 https://github.com/MobSF/docs/blob/master/dynamic_analyzer.md

❯ ./emulator -avd Pixel_API_28  -writable-system -no-snapshot

Emulator android MacOS

 W celu uruchomienia emulatora androida z poziomu terminala:

❯ ./emulator -avd Pixel_3a_API_32_arm64-v8a

❯ pwd

/Users/michal/Library/Android/sdk/emulator

apk.sh - ułatwia inżynierię wsteczną aplikacji na Androida

apk.sh to skrypt Bash, który ułatwia inżynierię wsteczną aplikacji na Androida, automatyzując niektóre powtarzalne zadania, takie jak ściąganie, dekodowanie, przebudowywanie i łatanie pliku APK.

Cechy

apk.sh zasadniczo używa apktool do dezasemblacji, dekodowania i odbudowy zasobów oraz trochę basha do automatyzacji procesu wstrzykiwania gadżetów frida . Obsługuje również pakiety aplikacji/podzielone pliki APK.

🍄 Łatanie plików APK w celu załadowania frida-gadget.so na starcie.

🆕 Obsługa pakietów aplikacji/podzielonych plików APK.

🔩 Przebudowywanie zdekodowanych zasobów z powrotem do binarnego pliku APK/JAR za pomocą apktool.

🗝️ Kod podpisując apk za pomocą apksigner.

https://github.com/ax/apk.sh

Android - analiza dynamiczna aplikacji

https://github.com/ac-pm/Inspeckage
https://vimeo.com/156745941

Android - frida - memory dump app

https://www.frida.re/docs/android/
https://github.com/Nightbringer21/fridump
/fridump# python fridump.py -U -s -o . --max-size 2097152 com.app-name.rc.nopin
http://pentestcorner.com/fridump-android-examples/


D:\Android\sdk\platform-tools>adb shell "su -c /data/local/tmp/frida-server &"

How to install NDK with Android SDK Manager [windows]

1. Close Android SDK Manager
2. Start a Command Prompt as Administrator
3. cd"path to your installation of Android SDK Manager"\tools\bin
4. sdkmanager ndk-bundle
5. Accept the License Agreement
6. Wait a long time. The installation is done without any progress indicator.
7. When it finally reports done, start Android SDK Manager
8. Look under Extras and there you'll find Ndk Bundle

https://stackoverflow.com/questions/41471000/how-to-install-ndk-with-android-sdk-manager