Security Testing for Android Cross Platform Application ( Xamarin & Cordova ) - Part 2

Written by on
Hello All,

This is the continuation of my previous post where we tried to bypass SSL Pinning by modifying the JS File in Cordova framework. Now in this post we will focused on Xamarin based application and how to get C# code which is used for building of Android App using  Xamarin framework.

What is Xamarin?

According to Microsoft Docs
Xamarin allows you write code in C#, with a class library and runtime that works across all many platforms, including iOS, Android, and Windows, while still compiling native (non-interpreted) applications.

Let's Begin:

How to Identify Xamarin Based application?

The way I used to identify was by converting the apk file to jar using dex2jar to get source code for the application and jd-gui for viewing the source code.

Command:- d2j-dex2jar.bat yourapp.apk


Now open the .jar file with jd-gui and you can notice keyword "xamarin" in below screen.


So while going through the source code of application it was observed that most of file just had some generic java function compared to application containing functionality. This made me confused how the application is able to run so many different functionality 😕 compared to source code available to me.

So it was time to understand what was going on. As usually I used apktool to unzip the apk.
Command:- apktool d yourapp.apk


After unzipping the apk file I started looking for files in each folder and I found a folder named unknown where there was another folder named assemblies. The assemblies contained various .dll files which were used in the application.

What is DLL?

A Dynamic Link library (DLL) is a library that contains functions and codes that can be used by more than one program at a time.

Yes you read it correctly DLL's contain functions and codes. So let's try to decompile the DLL and read the codes



To decompile the dll you can used dotPeek

Open the dotPeek -->Explore Folder ⇒Select your folder containing DLL


Once you select your folder, dotPeek will start decompiling all the DLL's and  now you can read the source code of those DLL's which are written in c#.
Note: There are also some default assemblies which are provide by Microsoft .
So now you can perform source code review to find more vulnerabilities like sensitive information(DB Credentials, Encryption Keys etc), SQL Injection etc.



Thanks for reading the post.

Special thanks to all my friends who helped / supported / motivated me for writing blogs. 🙏

Comments

  1. CyanousJune 30, 2021 at 5:24 PM

    Thankyou so much for wonderful information …great work…well done…keep doing…Looking for the best mobile application penetration testing services in Hyderabad contact Cyanous software solutions now.

    Best web designing services in Hyderabad
    Best software & web development company in Hyderabad

    ReplyDelete
  2. Sapphire SolutionsJune 22, 2022 at 12:58 PM

    Thanks for sharing the nice information. You have need Xamarin App for your business. Sapphire Solutions is a reputed
    Xamarin App Development Company in USA, India, Uk, Australia and more.

    ReplyDelete
  3. John FeiJune 12, 2024 at 7:35 PM

    Attract Group offers a comprehensive solution for launching an Uber-like service https://attractgroup.com/solutions/solution-for-uber-services/ that includes a user-friendly interface, real-time tracking, secure payment integration, and customizable features. Their expertise in developing robust and scalable platforms ensures a seamless user experience and efficient management system. A reliable option for businesses looking to enter the on-demand service market.

    ReplyDelete

Post a Comment

Popular posts from this blog

Information Disclosure - Internal Path Disclosure (PHPWCMS) - CVE-2018-12990

Written by on
Image
Hello All, ​INTRODUCTION T​he  purpose  of this post is to let you know how I managed to get one more CVE​. Throughout this post, I will give you relevant examples/screenshots that demonstrates how I ended up finding the vulnerability. ​Alright, lets plunge into the Proof-Of-Concept ! ​ PATH OF EXPLORATION ​ After submitting the first vulnerability (Stored Cross Site Scripting) to the developer for phpwcms application I continued to test further for finding more vulnerability. While testing I saw that CSRF Token was submitted in all the request. I tried to tamper with the parameter which contained the CSRF Token and found that the application throws an error which discloses the Internal Path of the application where it has been hosted. THE MOST AWAITED DEEP DIVE POC​ 1) While submitting the profile page request I saw that the application passes one parameter (csrf_token_value) which as per the name suggest contains the csrf token as you can refer the below screenshot.
Read more

Introduction to Callidus

Written by on
Image
Hello All, Performing Red Team assessments are becoming challenging day by day. In mature environments we see a lot of custom tool development and new techniques are getting discovered by the community to overcome various challenges. While thinking about such challenges, I came up with the idea of creating a tool that can leverage legitimate services for establishing command & control communication channel which is likely to be whitelisted or are less monitored due to the nature of services used by the corporate environments. This is not a new technique, we have already seen similar projects that were developed to leverage legitimate services for command & control. Communication channels such as Slackor for Slack C2, DaaC2 for Discord C2 or  Domain Fronting techniques etc. In this post I will introduce you to a tool called "Callidus" which I created to learn & to improve my knowledge about developing custom toolset in C# and learning how to leverage
Read more

Process Injection - Part I

Written by on
Image
Hello All, After publishing the post about Dumping Process Memory with Custom C# Code my friend Himanshu suggested me to write a tool & a blog post about Process Injection for learning and he referenced his post about Code Injection which covers the concept about the vanilla process injection technique. It was quite interesting to learn and understand the core concepts about Process Injection techniques and as a learning path to code in c# leveraging Windows API I started writing the tool for Process Injection. What is Process Injection ? Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process. Why Process Injection ?
Read more