5. Data Storage and Its Security | Hacking Android

Sign In Start Free Trial

Book Overview & Buying
Table Of Contents
Feedback & Rating

Hacking Android

By : Mohammed A. Imran, Rao Kotipalli

4.4 (5)

Hacking Android

4.4 (5)

By: Mohammed A. Imran, Rao Kotipalli

Overview of this book

With the mass explosion of Android mobile phones in the world, mobile devices have become an integral part of our everyday lives. Security of Android devices is a broad subject that should be part of our everyday lives to defend against ever-growing smartphone attacks. Everyone, starting with end users all the way up to developers and security professionals should care about android security. Hacking Android is a step-by-step guide that will get you started with Android security. You’ll begin your journey at the absolute basics, and then will slowly gear up to the concepts of Android rooting, application security assessments, malware, infecting APK files, and fuzzing. On this journey you’ll get to grips with various tools and techniques that can be used in your everyday pentests. You’ll gain the skills necessary to perform Android application vulnerability assessment and penetration testing and will create an Android pentesting lab.

Preface

Preface

What this book covers

What you need for this book

Who this book is for

Conventions

Reader feedback

Customer support

Free Chapter

1. Setting Up the Lab

1. Setting Up the Lab

Installing the required tools

Android Studio

Setting up an AVD

Configuring the AVD

ADB Primer

Summary

2. Android Rooting

2. Android Rooting

What is rooting?

Locked and unlocked boot loaders

Stock recovery and Custom recovery

Rooting Process and Custom ROM installation

Rooting a Samsung Note 2

Flashing the Custom ROM to the phone

Summary

3. Fundamental Building Blocks of Android Apps

3. Fundamental Building Blocks of Android Apps

Basics of Android apps

Android app components

Building DEX files from the command line

What happens when an app is run?

Understanding app sandboxing

Summary

4. Overview of Attacking Android Apps

4. Overview of Attacking Android Apps

Introduction to Android apps

Understanding the app's attack surface

Threats at the client side

Threats at the backend

Guidelines for testing and securing mobile apps

Automated tools

Identifying the attack surface

QARK (Quick Android Review Kit)

Summary

5. Data Storage and Its Security

5. Data Storage and Its Security

What is data storage?

Shared preferences

SQLite databases

Internal storage

External storage

User dictionary cache

Insecure data storage – NoSQL database

Backup techniques

Being safe

Summary

6. Server-Side Attacks

6. Server-Side Attacks

Different types of mobile apps and their threat model

Mobile applications server-side attack surface

Strategies for testing mobile backend

Summary

7. Client-Side Attacks – Static Analysis Techniques

7. Client-Side Attacks – Static Analysis Techniques

Attacking application components

Static analysis using QARK:

Summary

8. Client-Side Attacks – Dynamic Analysis Techniques

8. Client-Side Attacks – Dynamic Analysis Techniques

Automated Android app assessments using Drozer

Introduction to Cydia Substrate

Runtime monitoring and analysis using Introspy

Hooking using Xposed framework

Dynamic instrumentation using Frida

Logging based vulnerabilities

WebView attacks

Summary

9. Android Malware

9. Android Malware

What do Android malwares do?

Writing Android malwares

Registering permissions

Malware analysis

Tools for automated analysis

Summary

10. Attacks on Android Devices

10. Attacks on Android Devices

MitM attacks

Dangers with apps that provide network level access

Using existing exploits

Malware

Bypassing screen locks

Pulling data from the sdcard

Summary

Index

Index

Customer Reviews

4.4 (5)

5 star

80%

4 star

0%

3 star

0%

2 star

20%

1 star

0%

Shared preferences

Let's launch the FourGoats app and register a new user using the register option. Once created, login using the credentials, I have used username as test and test as its password, as shown following:

Shared Preferences are created using the SharedPreferences class. Below is the piece of code used to store the username and password in the credentials.xml file:

public void saveCredentials(String paramString1, String paramString2)
  {
    SharedPreferences.Editor localEditor = getSharedPreferences("credentials", 1).edit();
    localEditor.putString("username", paramString1);
    localEditor.putString("password", paramString2);
    localEditor.putBoolean("remember", true);
    localEditor.commit();
  }

As discussed earlier, the app directory stores the shared preferences:

/data/data/<package name>/shared_prefs/<filename.xml>

So, let's browse and inspect the above path to see if there are any shared preferences created in this application:

As we can see in the previous...

Visually different images

CONTINUE READING

83

Tech Concepts

36

Programming languages

73

Tech Tools

Unlimited access to the largest independent learning library in tech of over 8,000 expert-authored tech books and videos.

Innovative learning tools, including AI book assistants, code context explainers, and text-to-speech.

50+ new titles added per month and exclusive early access to books as they are being written.

Hacking Android

Search

Your notes and bookmarks