Timeline for Android App's hardcoded local keystore password r3versing
Current License: CC BY-SA 3.0
10 events
| when toggle format | what | by | license | comment | |
|---|---|---|---|---|---|
| Feb 24, 2017 at 13:48 | vote | accept | martin_s | ||
| Feb 24, 2017 at 13:46 | comment | added | martin_s | @w s The location resides inside the directory /res/raw as I've found out. How can I decrypt it (keytool)? | |
| Feb 23, 2017 at 13:56 | comment | added | w s | @martin_s That's exactly what you need. Now you need to find where load function of this class is called - you'll find a password as a second argument and the input stream for the file as first. | |
| Feb 23, 2017 at 6:28 | comment | added | w s | @martin_s Search for KeyStore, it should be enough. Decompile all the application code and grep it for the "KeyStore" string. Let me know what do you find. | |
| Feb 23, 2017 at 0:55 | comment | added | martin_s | @w s Can you tell me the typical names and locations for the keystore file? | |
| Feb 22, 2017 at 15:42 | comment | added | martin_s | @w s The challenger essentially told me that I should be able to discover all this vulnerabilites, keystore name and location with hard-coded pass by reading decompiled code. | |
| Feb 22, 2017 at 7:49 | comment | added | w s | Do you know where is this local keystore located ? Is your code obfuscated ? | |
| Feb 22, 2017 at 7:48 | comment | added | w s | @martin_s Only if the code and/or related strings are generated on the fly, obfuscated or encrypted. However in this case you'll probably receive a lot more strings, and the main problem of distinguishing between needed and not needed strings will remain. | |
| Feb 22, 2017 at 7:04 | comment | added | martin_s | What about the heap dumping scenario, can that help ? | |
| Feb 21, 2017 at 7:57 | history | answered | w s | CC BY-SA 3.0 |