Android Damn Vulnerable App by Security Compass

Tutorial of Android Damn Vulnerable App by Security Compass

Introduction:

Hi folks, today I am gonna show you some hands on or tutorial of the android app testing which I done during my R&D of android app security testing. Here I will show you from scratch setting up of Lab Server to testing of application.

In this you will learn on below topics:
1)Insecure Connection (Traffic over HTTP)
2)Server Side Authorization Issue
3)Insecure File Storage
4)Insecure Logging
5)Encryption of data on device
6)Memory Protection

Setting-up of lab (App & Server)

First of all you have to download the base app which is damn vulnerable from here.
After downloading zip and extracting it you have to build it in .apk format using Eclipse IDE.

Now you have to install the app in the emulator before that you have to make sure that you installed SDK and its packages.

To install the app you have to start emulator using AVD and clicking on "Start" or by command line
emulator.exe -avd [emulator name]

Install the app on emulator using below command and you will get the adb.exe from SDK/platform-tools folder below is command to install it

adb.exe install [apk file]

Server setup

This vulnerable app is having client & server architecture and to practice you have to setup the server.

You are having 3 options to run the server:

1)Mobisec:

Mobisec is mobile application testing linux distro in this you will find the lab server there.

2)Android Tamer:

Like Mobisec it is also a linux distro for mobile app testing and in this also you will find the server.

3)Manual setup:

For manually setting up of server we have to download the server from https://github.com/securitycompass/LabServer after that we need some dependencies like

• blinker (https://pypi.python.org/pypi/blinker)
• cherrypy (https://pypi.python.org/pypi/CherryPy)
• flask (http://flask.pocoo.org/)
• flask-sqlalchemy (https://pypi.python.org/pypi/Flask-SQLAlchemy)
• simplejson (https://pypi.python.org/pypi/simplejson/)

after installing the dependencies now we can start the server 

Now our app is working and now we can go for testing

In my next post we will test this app on insecure connection.

Labs

Lab 1 Insecure Connection 

Lab 2 Server Side Authorization Issue

Lab 3 Insecure File Storage

Lab 4 Secure Logging

Lab 5 Basic Encryption 

Lab 6 Advanced Encryption