The Internet of Stuff and Things

SANS Holiday Hack Challenge Continuing with Part 4: My Gosh... It's Full of Holes To continue examining and exploiting vulnerabilities was necessary to finish the environment. Here you can find my setup The Debug Server For this one, nmap only shows TCP port 80 and the content of the APK file shows an index.php URL. Visiting the URL shows nothing, so we have to find out how the SantaGram app interact with it. Time to use my emulator and BurpSuite to look at the traffic. At first I didn’t see anything interacting with the debug server (dev.northpolewonderland.com), so debug mode must be disabled. I look for debugging parameters in the APK file decoded by apktool. Searching for Debug parameters It seems the res/values/strings.xml file has the parameter we need to change and also need to interact with the EditProfile part of the app, but I changed the debug_data_enabled value to true , recompiled and signed as explained by Josh Wright here , and a...