Mobile Application API Hacking
Lab Guide
Omar Ωr Santos (@santosomar)
Mobile App and API Hacking – Lab Guide
Introduction
This course starts with an introduction to modern web applications and immediately starts diving
directly into the mapping and discovery phase of testing. In this course, you will learn new
methodologies used and adopted by many penetration testers and ethical hackers. This is a
hands-on training where will use various open source tools and learn how to exploit SQL
injection, command injection, cross-site scripting (XSS), XML External Entity (XXE), and
cross-site request forgery (CSRF).
WebSploit VM
Your laptop has been preloaded with a VM that contains Kali Linux and several vulnerable
applications. You can download the VM to practice at your own time at:
[Link]
IMPORTANT: This VM contains vulnerable software! DO NOT connect to a production
environment and use with caution!!! The purpose of this VM is to have a lightweight (single VM)
with a few web application penetration testing tools, as well as vulnerable applications.
Vulnerable Applications Included
● Damn Vulnerable Web Application (DVWA)
● WebGoat
● Hackazon
● OWASP Mutillidae 2
●[Link]
OWASP Juice Shop
VM Creds:
Username: root Password: toor
Additional Resources:
● The Art of Hacking Website ([Link] The Art of Hacking is a series
of video courses and live training sessions in Safari that is a complete guide to help you
get up and running with cybersecurity and pen testing career. These video courses
provide step-by-step real-life scenarios. This website has been created to provide
supplemental material to reinforce some of the critical concepts and techniques that the
student has learned and links a GitHub repository that hosts scripts and code that help
you build your own hacking environment, examples of real-life penetration testing
reports, and more.
Omar Ωr Santos (@santosomar)
Mobile App and API Hacking – Lab Guide
● The Art of Hacking GitHub Repository ([Link] Over 5,000
references and resources related to ethical hacking / penetration testing, digital forensics
and incident response (DFIR), vulnerability research, exploit development, reverse
engineering, and more.
● Safari Live Training (free with a Safari subscription): [Link]
Docker Containers
All of the vulnerable servers are running in Docker containers. The Docker service is not
started at boot time. This is to prevent the vulnerable applications to be exposed by default.
Please use the following command to start it:
service docker start
The following are all the Docker containers included in the WebSploit VM:
WebSploit VM Details
Omar Ωr Santos (@santosomar)
Mobile App and API Hacking – Lab Guide
To obtain the status of each docker container use the sudo docker ps command. If they are
not started, you can use the start_vulnerables.sh script (located under the root home
directory) to start all of the containers:
root@kali:~# ./start_vulnerables.sh
Starting Vulnerable Docker Containers
... Author: Omar Santos
The following are the vulnerable applications included:
- Hackazon (running on port 80)
- WebGoat (running on port 6661)
- Juice Shop ((running on port 6662)
- Damn Vulnerable Web Application (DVWA) - (running on port 6663)
- Mutillidae 2 (running on port 6664)
... starting dvwa
dvwa
... starting webgoat
webgoat
... starting hackazon
hackazon
... starting mutillidae_2
mutillidae_2
... starting juice-shop
juice-shop
Omar Ωr Santos (@santosomar)
Mobile App and API Hacking – Lab Guide
Exercise: Hacking Web APIs
1. Let's start by verifying that Hackazon web application is running by browsing to
[Link] If it is not, please follow the procedure outlined in the beginning of this
document.
2. Next we want to fire up our Android emulator. This is in contrast to our previous lab
where we utilized the web browser to access the application. Most modern Mobile
applications use a REST API to talk to the backend server. That's what we are going to
attack. Click the button in the bottom left of the toolbar to open the android-sdk.
3. Once the Android SDK Manager is open, click on Tools, then Manage AVDs. This will
open up the AVD Manager.
Omar Ωr Santos (@santosomar)
Mobile App and API Hacking – Lab Guide
4. Select the already created AVD and click the Start button.
5. In the Launch options window click launch to start the AVD. You should now see
the android virtual device starting up. This may take a few minutes.
Omar Ωr Santos (@santosomar)
Mobile App and API Hacking – Lab Guide
When the AVD has finished booting you will be at the home screen.
To prepare our AVD for additional tools we will need to root it.
To do this, open a terminal and change into the ~/Mobile/root directory. In the
directory there is a script named root_avd.sh which will issue ADB commands to
remount the /system partition in read-write mode, push the required files to the
/system partition, set the appropriate permissions for the pushed files, and start the su
daemon. Review the file if you wish, and execute it by running it from a terminal.
$ cd ~/Mobile/root
$ ./root_avd.sh
Verify the device was successfully rooted. Launch the Root Check Pro application, give
it a few minutes to complete, and look for a message in green text noting that you have
root access.
Omar Ωr Santos (@santosomar)
Mobile App and API Hacking – Lab Guide
6. From here we want to fire up burp as we did in the previous lab by running the command
“burpsuite” from the terminal window.
7. Click Ok to the message about the JRE version. Also, click Close if asked to update
burp suite.
8. Click Next to open a temporary project. Then click the “Start Burp” button.
You should now be at the main burpsuite screen.
Omar Ωr Santos (@santosomar)
Mobile App and API Hacking – Lab Guide
9. Let's double check that Burp Suite inspect is set to off. This way we can see our traffic
flow through then inspect it. To do this, navigate to the Proxy tab at the top. If the
“Intercept on” button is gray, click it once to turn it off.
Omar Ωr Santos (@santosomar)
Mobile App and API Hacking – Lab Guide
10. Before we start our application, we need to tell the AVD to send all traffic through the
Burp Suite proxy.
11. Move back to the Android ADV and click on the applications icon at the bottom. Now
click on “ProxyDroid” application.
12. From there, click on the toggle to switch it to on.
Omar Ωr Santos (@santosomar)
Mobile App and API Hacking – Lab Guide
12. Now we can start the Hackzon app from the Android device desktop. Move back to the
Android ADV desktop by clicking the home button on the right control panel. Then click
on the applications icon at the bottom. Then click on the Hackazon Application.
Omar Ωr Santos (@santosomar)
Mobile App and API Hacking – Lab Guide
13. When the login screen for Hackazon comes up, Go ahead and login with the
credentials “elliott” and password “mrrobot”.
14. To verify that the traffic is being proxied through Burp, jump back to the
Burpsuite window and click on the Proxy tab, then the Http history tab.
Here you should see some traffic from the mobile application to the
Hackazon server.
Omar Ωr Santos (@santosomar)
Mobile App and API Hacking – Lab Guide
15. To expose the API to Burpsuite we want to run through some functions in the
application (add to cart, view cart, submit, etc). So now move back to the AVD
and explore the Hackazon application for a few minutes. Be sure to add
something to your cart. Now let's jump over to the proxy history tab and look for
interesting requests/responses
16. Look through the requests to find something interesting that you might be able to modify.
Notice the POST request for /api/cartitems. Highlight that line in the HTTP histor and you will
see the actual raw request in the bottom window. Notice that the body contains json formatted
data. This is typical of a REST API.
Omar Ωr Santos (@santosomar)
Mobile App and API Hacking – Lab Guide
17. Here we find that the price is being sent in the POST request. Lets send that request to
repeater by right clicking and selecting send to repeater.
18. Now jump over to repeater by clicking the repeater tab at the top. The first thing we want
to do is to send a baseline request without any modification. So just click the go button
to send it as is.
Omar Ωr Santos (@santosomar)
Mobile App and API Hacking – Lab Guide
19. Now let's try to modify some information and see if we can get it to pass through.
Lets modify the price from 9.0 to 1.0. Then click go again.
20. As you can see, we got a 200 ok message in the response. This indicates that
the server is not verifying that we have not changed the price in the request.
Very bad…
Lets see how the application handles negative numbers. This time modify the
price to be -100.00. Then click go.
21. Again we see that we get a 200 ok message in the response. Lets jump over to
the Hackazon application and check our cart to see if these requests truly went
through.
Omar Ωr Santos (@santosomar)
Mobile App and API Hacking – Lab Guide
The cart shows us that we are now getting 2 of these items for -$100. This is a pretty good
deal.
22. Lets jump back to burp repeater and try modifying something else, like the quantity.
This time change the quantity to 1000 and click go.
23. If we jump back to our Hackazon app and refresh the cart we will see that we are now
getting a serious discount.
Omar Ωr Santos (@santosomar)
Mobile App and API Hacking – Lab Guide
24. Our last test will be to try and checkout. Surly the application will not let us checkout
with a refund of $99990. Click on the “proceed to checkout” button in the app. Then
click “shipping method”. Fill out some fake information in the address lines and click
billing address. Then click confirmation. And last but not least, click the “place order”
button.
As you can see, the transaction was successful. You now have an order of 1000 Martha
Stewart Craft Pom Poms and a check for $99990 on its way!
Omar Ωr Santos (@santosomar)
Mobile App and API Hacking – Lab Guide
Exercise 7: Exploiting Weak Cryptographic
Implementations
This exercise is for informational purposes only. Your machine does not have access to the
Internet. However, you can do these in your own system.
1. You can use nmap to enumerate weak ciphers, as shown below:
nmap --script ssl-cert,ssl-enum-ciphers -p 443 [Link]
2. There are many other open source and commercial tools that can be used to find weak
ciphers and cryptographic implementations. However, a very useful open source tool is
[Link] ([Link]
Omar Ωr Santos (@santosomar)
Mobile App and API Hacking – Lab Guide
3. You can download this tool and run it against any web server running HTTPS, as
demonstrated below.
root@kali:~# ./[Link] [Link]
No engine or GOST support via engine with your /usr/bin/openssl
###########################################################
[Link] 2.9.5-6 from [Link]
This program is free software. Distribution and
modification under GPLv2 permitted.
USAGE w/o ANY WARRANTY. USE IT AT YOUR OWN RISK!
Please file bugs @ [Link]
###########################################################
Using "OpenSSL 1.1.0h 27 Mar 2018" [~143 ciphers]
on kali:/usr/bin/openssl
(built: "reproducible build, date unspecified", platform: "debian-amd64")
Testing all IPv4 addresses (port 443): [Link] [Link]
---------------------------------------------------------------------------
-------------------
Start 2018-07-28 23:18:27 -->> [Link]:443
([Link]) <<--
further IP addresses: [Link] 2400:cb00:2048:1::681b:b09a
2400:cb00:2048:1::681b:b19a
rDNS ([Link]): --
Service detected: HTTP
Testing protocols via sockets except SPDY+HTTP2
SSLv2 not offered (OK)
SSLv3 not offered (OK)
TLS 1 not offered
TLS 1.1 not offered
TLS 1.2 not offered
SPDY/NPN h2, http/1.1 (advertised)
HTTP2/ALPN h2, http/1.1 (offered)
Testing ~standard cipher categories
NULL ciphers (no encryption) not offered (OK)
Anonymous NULL Ciphers (no authentication) not offered (OK)
Export ciphers (w/o ADH+NULL) not offered (OK)
LOW: 64 Bit + DES encryption (w/o export) not offered (OK)
Weak 128 Bit ciphers (SEED, IDEA, RC[2,4]) not offered (OK)
Omar Ωr Santos (@santosomar)
Mobile App and API Hacking – Lab Guide
Triple DES Ciphers (Medium) not offered (OK)
High encryption (AES+Camellia, no AEAD) offered (OK)
Strong encryption (AEAD ciphers) offered (OK)
Testing robust (perfect) forward secrecy, (P)FS -- omitting Null
Authentication/Encryption, 3DES, RC4
Cipher mapping not available, doing a fallback to openssl
PFS is offered (OK)
Testing server preferences
Has server cipher order? yes (OK)
Negotiated protocol TLSv1.2
Negotiated cipher ECDHE-ECDSA-CHACHA20-POLY1305, 253 bit ECDH
(X25519)
Cipher order
SSLv3: Local problem: /usr/bin/openssl doesn't support "s_client
-ssl3"
TLSv1.2: ECDHE-ECDSA-CHACHA20-POLY1305 ECDHE-ECDSA-AES128-GCM-SHA256
ECDHE-ECDSA-AES128-SHA ECDHE-ECDSA-AES128-SHA256
ECDHE-ECDSA-AES256-GCM-SHA384 ECDHE-ECDSA-AES256-SHA
ECDHE-ECDSA-AES256-SHA384
Testing server defaults (Server Hello)
TLS extensions (standard) "renegotiation info/#65281" "extended master
secret/#23" "session ticket/#35" "status request/#5"
"next protocol/#13172" "EC point formats/#11"
"application layer protocol negotiation/#16"
Session Ticket RFC 5077 hint 64800 seconds, session tickets keys seems to
be rotated < daily
SSL Session ID support yes
Session Resumption Tickets: yes, ID: yes
<output omitted for brevity>
Omar Ωr Santos (@santosomar)