Insecure Logging

In this section, we'll analyze the concept of insecure logging in Android applications and its potential impact. Insecure logging occurs when sensitive

information is unintentionally recorded through the application’s logging mechanism. This may include user credentials, payment details, or other

personal data handled by the app.

The primary tool used to exploit this vulnerability is Logcat. Logcat is a command-line utility included in the Android SDK that captures system message

streams, including logs generated by the application via the Log class. These logs are invaluable for developers during debugging, but they can also be

a goldmine for penetration testers if they contain sensitive information. When an application logs sensitive data, it may become accessible to anyone

with physical access to the device or to other applications running on the same device. Such exposure can signi�cantly increase the risk of a security

breach.

The Android logging system consists of a series of structured circular bu�ers managed by the system process logd. The number and types of bu�ers

are �xed and de�ned by the system. Below are some of the most relevant bu�ers.

Bu�er Description

main Stores most application logs.

system Stores messages originating from the Android OS.

crash Stores crash logs.

In the upcoming example, we'll examine an application that logs sensitive information and walk through how to identify these log entries using static

analysis and Logcat. Before diving into the analysis, let's review a table of commonly used Logcat �lters, which can help re�ne log output based on
✎
speci�c criteria:

Filter Description Code Command

Verbose Shows all log messages (default). Log.v(TAG, "Your verbose message"); adb logcat
'*:V'

Debug Displays log messages that are only useful during development. Log.d(TAG, "Your debug message"); adb logcat *:D

Info Shows general log messages useful for understanding the application's Log.i(TAG, "Your info message"); adb logcat
state. '*:I'

Warn Displays possible issues that are not yet errors. Log.w(TAG, "Your warning message"); adb logcat
'*:W'

Error Shows issues that have caused errors. Log.e(TAG, "Your error message"); adb logcat
'*:E'

Fatal Displays severe error messages that have caused the process to abort. [Link](TAG, "Your fatal error adb logcat
message"); '*:F'

Silent Shows no log messages. This �lter completely silences the log output. - adb logcat
'*:S'

Reading Application Logs

In this example, we'll use an Android Virtual Device (AVD), though the same approach applies to any rooted or emulated Android device. First, let's

connect to the device via ADB and install the target application:

Insecure Logging

rl1k@htb[/htb]$ adb connect

rl1k@htb[/htb]$ adb install [Link]
 rl1k@htb[/htb]$ adb install [Link]

Performing Streamed Install

Success

Running the application, we see it can generate tokens for any usage.

Similar to previous cases, the app requires a PIN to access saved notes: ✎

Let's get the application's package name using the command below while the app is running, so we can further enumerate it.

Insecure Logging

rl1k@htb[/htb]$ adb root

rl1k@htb[/htb]$ adb shell
rl1k@htb[/htb]$ adb shell dumpsys activity activities | grep VisibleActivityProcess

VisibleActivityProcess:[ ProcessRecord{8f86b89 6255:[Link]/u0a120}]

Listing the content of the app-speci�c external storage reveals the following �les.
Listing the content of the app-speci�c external storage reveals the following �les.

Insecure Logging

rl1k@htb[/htb]$ adb shell ls -l /sdcard/Android/data/[Link]/files/MyPersonalNotes/

total 12
-rw-rw---- 1 u0_a121 ext_data_rw 45 2024-01-16 13:30 Note_-[Link]
-rw-rw---- 1 u0_a121 ext_data_rw 230 2024-01-16 13:30 Note_309943672.txt
-rw-rw---- 1 u0_a121 ext_data_rw 157 2024-01-16 13:30 Note_311366182.txt

Reading the content of any of these �les reveals only encrypted data:

Insecure Logging

rl1k@htb[/htb]$ adb shell cat /sdcard/Android/data/[Link]/files/MyPersonalNotes/Note_-[Link]

NVtNyfHvEvK+Hg2wDJi9AYRckvLnjr19ClYVG7svSx0=

To better understand the app’s behavior, we'll reverse-engineer it using JADX:.

Insecure Logging

rl1k@htb[/htb]$ jadx-gui [Link]

Reviewing the MainActivity code reveals that tapping the buttonNotes UI element calls the promptPin() method:

If a PIN is given, the method m135lambda$promptPin$0$comhacktheboxmyappMainActivity() will be called, which in turn will call the method

checkPin().

As shown in the picture above, the method checkPin() will check if the PIN is correct, and if it is, the NotesListActivity will be called with the

userPin variable passed as a parameter.

Within NotesListActivity, the PIN is validated again, and if successful, the available note �les are displayed. When the user selects a note, the app

starts NoteContentActivity, passing both the �lename and the PIN:

✎
Examining NoteContentActivity, the onCreate() method reveals that the checkPin() method is invoked after the note content is read:

This means the content is processed before the PIN is validated. However, the user is redirected back to the main screen before they can view the

notes. Further inspection of readNoteContent() shows that the app logs the decrypted content using Log.d():
This line logs the decrypt variable, which likely contains the plaintext content of the note. Simply tapping the NOTES button won't reach this point in the

code unless the correct PIN is provided. But because NoteContentActivity is marked as exported in the [Link], we can access it

directly:

Since the activity is exported, it can be started externally using ADB. To do this, we'll need two parameters: the �lename, which we found earlier during
enumeration, and the PIN. Before launching the activity, let’s start Logcat to capture the log output. We could use a broad �lter like adb logcat '*:D',

but since we already know the tag is Debug note:, we can use grep for more focused output:

Insecure Logging

rl1k@htb[/htb]$ adb logcat '*:D' | grep 'Debug note: '

Now let's launch the NoteContentActivity directly via ADB:

Insecure Logging

rl1k@htb[/htb]$ adb shell am start -n [Link]/.NoteContentActivity --es filename "Note_-[Link]" --es userPin

Starting: Intent { cmp=[Link]/.NoteContentActivity (has extras) }

✎
Back in the Logcat output, we can now see the logged content of the note.

Insecure Logging

rl1k@htb[/htb]$ adb logcat '*:D' | grep 'Debug note: '

01-17 10:34:13.598 8392 8392 D Debug note: : NVtNyfHvEvK+Hg2wDJi9AYRckvLnjr19ClYVG7svSx0=

01-17 10:34:13.598 8392 8392 D Debug note: : HTB{N0t3s_4r3_l0gg3d!!}

Connect to Pwnbox
Your own web-based Parrot Linux instance to play our labs.

Pwnbox Location

UK 36ms

Terminate Pwnbox to switch location

 Start Instance

 / 1 spawns left

Waiting to start...

Enable step-by-step solutions for all questions 

Questions
􏅜
 Cheat Sheet
Answer the question(s) below to complete this Section and earn cubes!

+5
􏆲 What is the content of the �le "Note_-[Link]" ?

Submit your answer here...

+10 Streak pts 􏄞 Submit

  insecure_logging.zip

 Previous Next 

✎
􏅜 Cheat Sheet


ဿ Go to Questions
?

Table of Contents

Enumerating and Exploiting Installed Apps

Introduction

􏆲
 Enumerating Local Storage

􏆲
 Exported Activities

􏆲
 Insecure Logging

􏆲
 Pending Intents

􏆲
 Exploiting WebViews

􏆲
 Insecure Library Load Through Deep Linking

Dynamic Code Instrumentation

􏆲
 Hooking Java Methods

􏆲
 Altering Method Values

􏆲
 Hooking Native Methods

􏆲
 Bypassing Detection Mechanisms

􏆲
 Authentication Token Manipulation

Intercepting HTTP/HTTPS Requests

􏆲
 Intercepting API Calls
 􏆲
 IDOR Attack

􏆲
 SSL/TLS Certi�cate Pinning Bypass

Skills Assessments

􏆲
 Skills Assessment

My Workstation

OFFLINE

􏅄 Start Instance


 / 1 spawns left