SettingupMobileTestingLab - Revision history

Tarek at 10:52, 7 June 2013

2013-06-07T10:52:18Z

Tarek at 11:52, 6 June 2013

2013-06-06T11:52:42Z

Tarek at 11:50, 6 June 2013

2013-06-06T11:50:36Z

Tarek at 11:50, 6 June 2013

2013-06-06T11:50:12Z

Tarek at 11:46, 6 June 2013

2013-06-06T11:46:20Z

Tarek at 11:44, 6 June 2013

2013-06-06T11:44:58Z

Tarek at 11:32, 6 June 2013

2013-06-06T11:32:55Z

Tarek at 11:26, 6 June 2013

2013-06-06T11:26:55Z

Tarek: Created page with "This document details how to set up an Android lab so you can do mobile app assessments without the need for a physical mobile phone. It will discuss some of the common and us..."

2013-06-06T11:25:41Z

Created page with "This document details how to set up an Android lab so you can do mobile app assessments without the need for a physical mobile phone. It will discuss some of the common and us..."

New page

This document details how to set up an Android lab so you can do mobile app assessments without the need for a physical mobile phone. It will discuss some of the common and useful tools, what their purposes are and how they can be used.

The prerequisites are simple: Java and an OS.

URL: http://java.com/en/download/index.jsp

== 1- Install Android Software Development Kit (SDK) ==

“The Android SDK provides you the API libraries and developer tools necessary to build, test, and debug apps for Android”. There are two parts to SDK. The SDK manager where you can install the tools and the Android versions of your choice. And the AVD (android virtual device) manager (we'll get to that in a minute). That's what creates the emulator that we'll be playing around with.

URL: http://developer.android.com/sdk/index.html

== 2- Install tools ==

Install the tools and the Android OS. At a minimum you'll want the SDK tools and SDK platform tools which we'll use later on. Then choose an Android version. There's a long list of Android versions and other extras. I usually go with the latest version. It's a straight forward next install process but it might take a while.

== 3- Emulator ==

Step three is to set up an Android emulator. You do this using the AVD manager which is part of the SDK tool. AVD stands for Android Virtual Device and it looks something like this. You click on New and here's what these options mean.

== 4- Creat AVD ==

Enter a name for your virtualized Android, and select the version of Android you want to use from the drop-down menu if you've installed different versions. Enter a size under the SD Card entry; this is a virtual SD card that’s actually an IMG file that Android will use to store your settings and files in.

Diff between Android and Google API?

== 5- Start Emulator ==

By now you'll have a fully functioning emulator that you can use just like your phone. One thing you'll notice missing is the Android market or play store which you usually use to download and install applications. The good news is that we don't need it... for now.

== 6- Install apk ==

without the need of the android market we can install the application directly if we have the .apk file. This is the Android Application Package (APK) file. It sounds fancy but it's really a zipped file based on JAR format which will come in handy when we try to reverse the application later. Usually the client will provide this file.

== 7- ADB ==

To install apk file we use the Android Debugging Bridge. The ADB tool part of the paltform-tools we installed with the SDK manager at the beginning. It's got a lot of uses one of which is to install and uninstall app. We do this by typing going to the platform-tools directory and lunching adb with the install command while the emulator is running

== 8- Proxy ==

Start up the emulator using the proxy command to tell it to tunnel traffic through your local proxy. In this current setup you'll also be able to test https website but you'll not be able to authenticate if there's a login page because of certificate errors. There seems a lot of ways to documented to overcome this but non has worked for me. So if anyone has any tips or solutions please do share hem with me.

== 9- Mallory ==

What if the application you're testing that doesn't use standard http/s but instead uses some proprietary protocol? There's a tool for that called mallory. It's a very effective transparent TCP/UDP proxy. Setting it up is a bit of pain but the process is well documented online. If you need the resources let me know and I'll send them over.

== 10- Decompiling app (jd-gui) ==

Apart from treating the application as a regular WAVA there are a few other things to do. One is trying to decompile the application. We already mentioned that the .apk is a compressed JAR format and so it can easily be decompiled using numerous tools. Here's an example of a class Adel found the encryption key in.

== 11- Shell ==

We can browse the application directory using the adb tool. By issuing the shell command we can browse to the /data/data folder where the packages are installed. We can then look for interesting information such as encryption keys in xml files

== 12- Memory ==

Android ships with a debugging tool called the Dalvik Debug Monitor Server (DDMS). This is part of the Eclipse tool suite so obviously we need to install Eclipe. We can use this to obtain a memory dump of the application during runtime. This hopefully will yield some good information.

== 13-Memory Analyzer ==

Once we create a dump we can analyze it using a tool called the (can any one guess) Memory Analyzer which is part of Eclipse. However before we can do that we need to convert the dump to the proper hprof format using hprof-conv in sdk

== 14- Santoku ==

Now if all this sounds like a lot of work luckily the good guys at owasp and our french t&v team has saved us a lot of trouble. Owasp has created a backtrack like os for mobile testing called santoku. And the good guys in our french team namely alaeddin and adel have created working vms and avds to save us all some time. So feel free to reach out for them and ask them for those

@@ Line 91: / Line 91: @@
 == Santoku ==
-Now if all this sounds like a lot of work luckily the good guys at OWASP has saved us a lot of trouble. OWASPhas created a backtrack like OSfor mobile testing called Santoku.
+Now if all this sounds like a lot of work luckily there's a ready made Linux distro called Santoku that has all the tools preinstalled.
 [[File:Santoku.png]]

@@ Line 46: / Line 46: @@
 without the need of the android market we can install the application directly if we have the .apk file. This is the Android Application Package (APK) file. In reality it's a zipped file based on JAR format which will come in handy when we try to reverse the application later.
-[[File:apk.pgn]]
+[[File:apk.png]]
 == ADB ==

@@ Line 28: / Line 28: @@
 Once the installation is complete you'll need to create a new AVD simply by clicking on New on the Android Virtual Device Manager
-[[File:andoird avd new.pgn]]
+[[File:andoird avd new.png]]
 == Create AVD ==

@@ Line 22: / Line 22: @@
 == Emulator ==
-Step three is to set up an Android emulator. You do this using the AVD manager which is part of the SDK tool. AVD stands for Android Virtual Device and it looks like the picture below. You click on New and here's what these options mean.
+Step three is to set up an Android emulator. You do this using the AVD manager which is part of the SDK tool. AVD stands for Android Virtual Device and it looks like the picture below.
 [[File:install emulator.png]]
 == Create AVD ==

@@ Line 18: / Line 18: @@
 Install the tools and the Android OS. At a minimum you'll want the SDK tools and SDK platform tools which we'll use later on. Then choose an Android version. There's a long list of Android versions and other extras. It's a straight forward install process but it might take a while.
-[[File:sdk manager.png]]
+[[File:1-_sdk_manager.png]]
 == Emulator ==

@@ Line 12: / Line 12: @@
 URL: http://developer.android.com/sdk/index.html
@@ Line 19: / Line 18: @@
 Install the tools and the Android OS. At a minimum you'll want the SDK tools and SDK platform tools which we'll use later on. Then choose an Android version. There's a long list of Android versions and other extras. It's a straight forward install process but it might take a while.
-[[File:Example.jpg]]
+[[File:sdk manager.png]]
 == Emulator ==
@@ Line 25: / Line 24: @@
 Step three is to set up an Android emulator. You do this using the AVD manager which is part of the SDK tool. AVD stands for Android Virtual Device and it looks like the picture below. You click on New and here's what these options mean.
-[[File:Example.jpg]]
+[[File:install emulator.png]]
 == Create AVD ==
@@ Line 31: / Line 30: @@
 Enter a name for your virtualized Android, and select the version of Android you want to use from the drop-down menu if you've installed different versions. Enter a size under the SD Card entry; this is a virtual SD card that’s actually an IMG file that Android will use to store your settings and files in.
-[[File:Example.jpg]]
+[[File:create avd.png]]
 == Start Emulator ==
@@ Line 37: / Line 36: @@
 By now you'll have a fully functioning emulator that you can use just like your phone. One thing you'll notice missing is the Android market or play store which you usually use to download and install applications. The good news is that we don't need it... for now.
-[[File:Example.jpg]]
+[[File:working emulator.png]]
 == Install apk ==
@@ Line 43: / Line 42: @@
 without the need of the android market we can install the application directly if we have the .apk file. This is the Android Application Package (APK) file. In reality it's a zipped file based on JAR format which will come in handy when we try to reverse the application later.
-[[File:Example.jpg]]
+[[File:apk.pgn]]
 == ADB ==
@@ Line 49: / Line 48: @@
 To install apk file we use the Android Debugging Bridge. The ADB tool part of the platform-tools we installed with the SDK manager at the beginning. It's got a lot of uses one of which is to install and uninstall app. We do this by typing going to the platform-tools directory and lunching adb with the install command while the emulator is running
-[[File:Example.jpg]]
+[[File:adb install.png]]
 == Proxy ==
@@ Line 55: / Line 54: @@
 Start up the emulator using the proxy command to tell it to tunnel traffic through your local proxy. In this current setup you'll also be able to test https website but you'll not be able to authenticate if there's a login page because of certificate errors. There seems to be a lot of ways documented to overcome this. One my favorite is using Mallory.
-[[File:Example.jpg]]
+[[File:proxy command.png]]
 == Mallory ==
@@ Line 61: / Line 60: @@
 What if the application you're testing that doesn't use standard http/s but instead uses some proprietary protocol? There's a tool for that called Mallory. It's a very effective transparent TCP/UDP proxy. Setting it up is a bit tedious but the process is well documented online.
-[[File:Example.jpg]]
+[[File:mallory.png]]
 == Decompiling app (jd-gui) ==
-Apart from treating the application as a regular WAVA there are a few other things to do. One is trying to decompile the application. We already mentioned that the .apk is a compressed JAR format and so it can easily be decompiled using numerous tools. Here's an example of a class Adel found the encryption key in.
+Apart from treating the application as a regular application there are a few other things to do. One is trying to decompile the application. We already mentioned that the .apk is a compressed JAR format and so it can easily be decompiled using numerous tools.
@@ Line 71: / Line 70: @@
 We can browse the application directory using the adb tool. By issuing the shell command we can browse to the /data/data folder where the packages are installed. We can then look for interesting information such as encryption keys in xml files
 == Memory ==
 Android ships with a debugging tool called the Dalvik Debug Monitor Server (DDMS). This is part of the Eclipse tool suite so obviously we need to install Eclipe. We can use this to obtain a memory dump of the application during runtime. This hopefully will yield some good information.
 == Memory Analyzer ==
 Once we create a dump we can analyze it using a tool called the (can any one guess) Memory Analyzer which is part of Eclipse. However before we can do that we need to convert the dump to the proper hprof format using hprof-conv in sdk
 == Santoku ==
 Now if all this sounds like a lot of work luckily the good guys at OWASP has saved us a lot of trouble. OWASPhas created a backtrack like OSfor mobile testing called Santoku.

@@ Line 7: / Line 7: @@
 == Install Android Software Development Kit (SDK) ==
 “The Android SDK provides you the API libraries and developer tools necessary to build, test, and debug apps for Android”. There are two parts to SDK. The SDK manager where you can install the tools and the Android versions of your choice. And the AVD (android virtual device) manager (we'll get to that in a minute). That's what creates the emulator that we'll be playing around with.
@@ Line 16: / Line 15: @@
-== 2- Install tools ==
+== Install tools ==
 Install the tools and the Android OS. At a minimum you'll want the SDK tools and SDK platform tools which we'll use later on. Then choose an Android version. There's a long list of Android versions and other extras. I usually go with the latest version. It's a straight forward next install process but it might take a while.
-== 3- Emulator ==
+== Emulator ==
 Step three is to set up an Android emulator. You do this using the AVD manager which is part of the SDK tool. AVD stands for Android Virtual Device and it looks something like this. You click on New and here's what these options mean.
@@ Line 27: / Line 26: @@
-== 4- Creat AVD ==
+== Create AVD ==
 Enter a name for your virtualized Android, and select the version of Android you want to use from the drop-down menu if you've installed different versions. Enter a size under the SD Card entry; this is a virtual SD card that’s actually an IMG file that Android will use to store your settings and files in.
@@ Line 34: / Line 33: @@
-== 5- Start Emulator ==
+== Start Emulator ==
 By now you'll have a fully functioning emulator that you can use just like your phone. One thing you'll notice missing is the Android market or play store which you usually use to download and install applications. The good news is that we don't need it... for now.
@@ Line 40: / Line 39: @@
-== 6- Install apk ==
+== Install apk ==
 without the need of the android market we can install the application directly if we have the .apk file. This is the Android Application Package (APK) file. It sounds fancy but it's really a zipped file based on JAR format which will come in handy when we try to reverse the application later. Usually the client will provide this file.
@@ Line 46: / Line 45: @@
-== 7- ADB ==
+== ADB ==
 To install apk file we use the Android Debugging Bridge. The ADB tool part of the paltform-tools we installed with the SDK manager at the beginning. It's got a lot of uses one of which is to install and uninstall app. We do this by typing going to the platform-tools directory and lunching adb with the install command while the emulator is running
@@ Line 52: / Line 51: @@
-== 8- Proxy ==
+== Proxy ==
 Start up the emulator using the proxy command to tell it to tunnel traffic through your local proxy. In this current setup you'll also be able to test https website but you'll not be able to authenticate if there's a login page because of certificate errors. There seems a lot of ways to documented to overcome this but non has worked for me. So if anyone has any tips or solutions please do share hem with me.
-== 9- Mallory ==
+== Mallory ==
 What if the application you're testing that doesn't use standard http/s but instead uses some proprietary protocol? There's a tool for that called mallory. It's a very effective transparent TCP/UDP proxy. Setting it up is a bit of pain but the process is well documented online. If you need the resources let me know and I'll send them over.
-== 10- Decompiling app (jd-gui) ==
+== Decompiling app (jd-gui) ==
 Apart from treating the application as a regular WAVA there are a few other things to do. One is trying to decompile the application. We already mentioned that the .apk is a compressed JAR format and so it can easily be decompiled using numerous tools. Here's an example of a class Adel found the encryption key in.
-== 11- Shell ==
+== Shell ==
 We can browse the application directory using the adb tool. By issuing the shell command we can browse to the /data/data folder where the packages are installed. We can then look for interesting information such as encryption keys in xml files
@@ Line 73: / Line 72: @@
-== 12- Memory ==
+== Memory ==
 Android ships with a debugging tool called the Dalvik Debug Monitor Server (DDMS). This is part of the Eclipse tool suite so obviously we need to install Eclipe. We can use this to obtain a memory dump of the application during runtime. This hopefully will yield some good information.
-== 13-Memory Analyzer ==
+== Memory Analyzer ==
 Once we create a dump we can analyze it using a tool called the (can any one guess) Memory Analyzer which is part of Eclipse. However before we can do that we need to convert the dump to the proper hprof format using hprof-conv in sdk
-== 14- Santoku ==
+== Santoku ==
 Now if all this sounds like a lot of work luckily the good guys at owasp and our french t&v team has saved us a lot of trouble. Owasp has created a backtrack like os for mobile testing called santoku. And the good guys in our french team namely alaeddin and adel have created working vms and avds to save us all some time. So feel free to reach out for them and ask them for those