Allsafe is an intentionally vulnerable application that contains various vulnerabilities. Unlike other vulnerable Android apps, this one is less like a CTF and more like a real-life application that uses modern libraries and technologies. Additionally, I have included some Frida based challenges for you to explore. Have fun and happy hacking!
I have my Frida scripts (more like templates) in other repository. I'm sure they might be quite handy for the Frida related tasks. Check it out: https://github.com/t0thkr1s/frida
Simple information disclosure vulnerability. Use the logcat command-line tool to discover sensitive information.
Show me how it's done!
adb shell 'pidof infosecadventures.allsafe'
Take output and substitue for
adb shell 'logcat --pid | grep secret'
Some credentials are left in the code. Your task is to reverse engineer the app and find sensitive information.
Show me how it's done!
# TODO
This is purely for Frida practice. Make the code believe that your device is not rooted!
Loading modules securely with third-party apps are not easy. Write a PoC application and exploit the vulnerability!
Show me how it's done!
# TODO
Another Frida-based task. No real vulnerability here, just have fun bypassing the secure flag!
Show me how it's done!
# TODO
Certificate pinning is implemented using the OkHttp library. You have to bypass it in order to view the traffic with Burp Suite.
Show me how it's done!
# TODO
There's a vulnerable broadcast recevier in the application. Trigger it with the correct data and you're done!
- Android Broadcasts Overview
- ok.ru Broadcast Receiver Exploitation
- Bitwarden Vulnerable Broadcast Receiver
Show me how it's done!
# TODO
Similar to the insecure broadcast receiver, you need to provide the right query parameter to complete this task!
Show me how it's done!
# TODO
Just a regular SQL injection that you'd find in web applications. No need to reverse the code to bypass the login mechanism.
Show me how it's done!
# TODO
You can also complete this task without decompiling the application. Pop an alert dialog and read files!
Show me how it's done!
# TODO
In this task, you have to modify the execution flow of the application by editing the Smali code. Finally, rebuild and sign the APK!
Show me how it's done!
# TODO
The application uses a native library that validates the entered password. Reverse engineer the library to find the password then use Frida to hook the native method.
Show me how it's done!
# TODO
Noticed a bug? Have a suggestion? Feel free to open an issue or create a pull request!
If this project was valuable to you or helped you in any way, please consider making a small amount of donation via the following cryptocurrencies. Giving a star on the project also helps a lot. Thanks!
Bitcoin Address ⟹ bc1qd44kvj6zatjgn27n45uxd3nprzt6rm9x9g2yc8
Ethereum Address ⟹ 0x1835a58E866a668C48Ee63d32432C7Fe28aF54b4
This tool is only for testing and academic purposes and can only be used where strict consent has been given. Do not use it for illegal purposes! It is the end user’s responsibility to obey all applicable local, state and federal laws. Developers assume no liability and are not responsible for any misuse or damage caused by this tool and software.
This project is licensed under the GPLv3 License - see the LICENSE file for details