Mobile PT lab setup commands

installing genymotion on kali:

step1:
Goto https://www.genymotion.com/download/
Download current version of genymotion.
run genymotion from your downloaded place
cmd: ./genymotion-3.1.0-linux_x64.bin
go to cd /opt/genymobile/genymotion/
to run genymotion:
./genymotion


burp configuration on genymotion:

https://linuxsuperuser.com/configure-burp-suite-proxy-genymotion/



https://linuxsuperuser.com/configure-burp-suite-proxy-genymotion/


Download genymotion install
download terminal emulator -> www.apkmirror.com to get terminal access

ADB device:
genymotion setting ->sdk device -> use custom andriod sdk tools -> path -> your sdk path ->close


Install apktool
---------------

$ sudo apt-get install apktool

Install dex2jar
---------------

$ sudo apt-get install dex2jar

$ d2j-jar2dex -h

install qark:
--------------

Download QARK from github

$ git clone https://github.com/linkedin/qark

$ cd qark

$ pip3 install -r requirements.txt

$ python3 setup.py install

To test APK :

$ sudo qark --apk path/to/my.apk




MobSF Installation:
===================

Static Analysis Mobsf:
----------------------

The Installation procedures of MobSF are as follows:

$ git clone https://github.com/MobSF/Mobile-Security-Framework-MobSF.git

$ cd Mobile-Security-Framework-MobSF
$ ./setup.sh
$ sudo apt-get install wkhtmltopdf
Running MobSF
=============

/Mobile-Security-Framework-MobSF$ ./run.sh

Installation of sqlitebrowser
==============================
sudo apt-get install sqlitebrowser

Running MobSF
=============

/Mobile-Security-Framework-MobSF$ ./run.sh


Decombile the apk file:
========================

$ apktool d name-of-the-app .apk


connect to the device:
======================

adb root
restarting adbd as root
megala@kali:~$ adb shell

Installing drozer:
==================

goto https://github.com/FSecureLABS/drozer/releases

Download drozer-2.4.4-py2-none-any.whl

open terminal -> $ sudo pip install drozer-2.4.4-py2-none-any.whl


terminal cmd:

$ adb forward tcp:31415 tcp:31415
$ drozer console connect

dz> run app.package.attacksurface io.messenger
Attack Surface:
  5 activities exported
  1 broadcast receivers exported
  0 content providers exported
  3 services exported
dz> run app.activity.info -a io.messenger
Package: io.messenger
  io.messenger.activities.MainActivity
    Permission: null
  io.messenger.activities.ObvLinkActivity
    Permission: null
  io.messenger.activities.ShareActivity
    Permission: null
  io.messenger.activities.ShortcutActivity
    Permission: null
  androidx.biometric.DeviceCredentialHandlerActivity
    Permission: null


dz>run app.broadcast.send --action androidx.biometric.DeviceCredentialHandlerActivity --extra <alert> <alert> putparcelable


check for which application using which port:
cmd:sudo netstat -nlp


Comments

Post a Comment

Popular posts from this blog

System Malware Analysis

What is Malware ?                           Malware is a code that performs malicious actions; it can take the form of an executable,script, code, or any other software. Attackers use malware to steal sensitive information, spy on the infected system, or take control of the system. It typically gets into your system without your consent and can be delivered via various communication channels such as email, web, or USB drives. The following are some of the malicious actions performed by malware: Disrupting computer operations Stealing sensitive information, including personal, business, and financial data Unauthorized access to the victim's system Spying on the victims Sending spam emails Engaging in distributed-denial-of-service attacks (DDOS) Locking up the files on the computer and holding them for ransom Types of Malware  Botnets Ransomware Rootkits Trojans Viruses Worms Adware sp...
Read more

Malware Sample Analysis (29F228F3375C489A8A6E31203AB25787)

Image
File hash: MD5 : 29F228F3375C489A8A6E31203AB25787 Sha1 : 14D713A5C8A2FC01FA2F01D993A249B9FB292810 Sha256: EC905CB2CB8E9F74790ADDE2C138807F3A6CDBECD5735FA5035B547280D7DB79 Note : cmd are mentioned in blue.Imp data marked as "purple". Basic Static Analysis: Determine the file type: Using file command:   test$ file Unknown Unknown: PE32 executable (console) Intel 80386, for MS Windows Using File Signature: Test$ hexdump Unknown  0000000 5a4d 0090 0003 0000 0004 0000 ffff 0000 0000010 00b8 0000 0000 0000 0040 0000 0000 0000 0000020 0000 0000 0000 0000 0000 0000 0000 0000 0000030 0000 0000 0000 0000 0000 0000 00d8 0000 0000040 1f0e 0eba b400 cd09 b821 4c01 21cd 6854 0000050 7369 7020 6f72 7267 6d61 6320 6e61 6f6e 0000060 2074 6562 7220 6e75 6920 206e 4f44 2053 0000070 6f6d 6564 0d2e 0a0d 0024 0000 0000 0000 0000080 4be3 9a53 2aa7 c93d 2aa7 c93d 2aa7 c93d 0000090 b7bc c9a3 2aa6 c93d b7bc c997 2aa1 c93d 00000a0 52ae c9ae 2aa2 c93d 2aa7 c93c 2ab5 c93d 00000b0 b7bc c992 2aa6 c93d ...
Read more

Static Analysis

Image
Static Analysis                                          Examine the executable file without viewing the actual instruction. Try to figure out what the malware is trying to do and the commands it is attempting to execute. Identifying the File type Extracting the String Analysis binary with Virus Total   Determining Obfuscation of binary   Examine the PE header Malware Sources:                          Once you have a lab set up, you will need malware samples for performing analysis.The following are some of the sources from where you can get malware samples for your analysis.             ...
Read more