Mobile Adventures: Fuzzing Android Browsers

In the meantime of last 3 weeks (beside looking for new projects;) of course) I was reading and learning about Android security. Below you'll find few notes about it. Here we go... 

This time we'll start here:

Last month was a time I tried to understand more and more about security and bugs exploitation in mobile applications.

I decided to refresh my current knowledge by practicing exploitation of multiple vulnerable APK's applications available online (see references below for more details).

One of the most interesting resource I found was created by hpandro so I started to check it - one by one... ;}

As this is the story for another post in mini-art section... ;) Let's move forward.

Few days later I decided that (similar to previous adventures) it will be a "good idea" to take a similar 'approach' as I did before: 

1) from: creating "simple and example" APK application
2) to: hack it.

Simple, isn't IT? ;)

That's how I landed between multiple tutorials related to 'creating apps in Android environment' (again, please see references below for more details).

After my 'super_sample.apk' was ready my next step was - as usual - to start a "blackbox pentest" of the app.

After a while (of reading about possible Android security bugs and/or miscofigs) I found this nice Framework ;]

(Simply to not try to go to deep - this time we'll skip "manual" testing and focus on (let's say;)) "automation", ok?)

So, let's try our new AndroBugs Framework against one of the apps from hpandro's resources - like this:

Checking:

 
Ok, we have a nice(=greppable) log file, we can see some hints about possible exploitation. So far, so good.


*(t_ack_a_hint:
`But "after all" we have some WebViewzzz and/or some info leakzzz... ;S`

Hm. :Z Well. Indeed! ;}
)

So at this moment I decided to stop the framework and think 'what else' and 'how' - can be "attacked" 'from so called userland'.

And that's how I found another cool code at github - here (we go...;))

(...after a while... ;)

We should be somewhere here:

As you can see at this stage it should be pretty easy to (re)create a similar code/approach and find some new more bugs. 

If you'll need a help (commercially) - feel free to ping me privately any time.

See you next time! ;)

Cheers

Refs:

1) https://developer.android.com/training/articles/security-tips
2) http://hpandro.me/
3) https://play.google.com/store/apps/developer?id=hpAndro&hl=pl&gl=US
4) https://owasp.org/www-project-mobile-security-testing-guide/