SCRCPY : Android mirrors

By

Hi guys. It's been a while since I last shared anything useful here. Nothing much lately. Only normal day to day testing. 

Today I would like to share something which is quite useful for mobile testing for Android devices. If you are using a real device instead of an emulator, this would help you.

https://github.com/Genymobile/scrcpy

This application mirrors your android devices. It is super useful when you need to share screen or doing demonstration to your client or colleagues. Like if you stumble upon an error during testing and your client wanted you to demonstrate it to them, this is the best application you can use.

Below is the example of screenshot of my OnePlus device.

As of this year, I managed to root and push all necessary security related things into my OnePlus 6 (Android 11). My previous testing device which is the Nexus 5x was dead/bricked after I tried to upgrade Magisk version. Rest in pepperoni my best device. *sobs

For Android 11+, its kind of hard to actually push the burp certificate into the device like previous version of android. You will need to do extra steps for it. After searching for multiple ways on doing it, I have come across below blog that works for me. You can refer below url for the method used.

https://medium.com/@lightbulbr/install-burp-ca-as-a-system-level-trusted-ca-android-11-rooted-physical-device-5542fe96345f

Shoutout to him on the step by step method shared. It saved me a lot of time.

Currently there are no unique finding to be shared. That is why the blog kinda dead at the moment.

Apart from the OnePlus 6, I also managed to get an iOS device for testing which is iPhone SE (16.0.2). I might also start to share my journey discovering testing on iOS which is super new to me.

This post also served as my diary/reminder for useful application that I might forgot later on. 

Till next time. Adios.

Comments

Post a Comment

Popular posts from this blog

Petraware pTransformer ADC before 2.1.7.22827 allows SQL Injection via the User ID parameter to the login form.

By
Image
Hi All, Today I will share POC on vulnerability found during pentest. As per the title, I recently found SQL Injection vulnerability on a thick client.  To read more about thick client, click here :  https://techterms.com/definition/thickclient Thick clients, also called heavy clients, are full-featured computers that are connected to a network.  While a thick client is fully functional without a network connection, it is only a "client" when it is connected to a server. The server may provide the thick client with programs and files that are not stored on the local machine's hard drive.   Exploit Title:   Petraware pTransformer ADC before 2.1.7.22827 allows SQL Injection via the User ID parameter to the login form. Details & Description :   SQL injection is a vulnerability that allows an attacker to alter backend SQL statements by manipulating the user input. An SQL injection occurs when web applications accept user input that is directly pl...
Read more

Setting up MobSF in Ubuntu 18.04

By
Image
Hi guys, It's been a while since I last updated the blog. Been busy. So, for today I will be giving guide on how to setup MobSF in Ubuntu 18.04 . There is a lot of guide out there about how to setup MobSF. I'm here to give out step by step guide to set it up as per my own experience. The main reason of using Ubuntu 18.04 is because it has a built-in Python 3.6 and pip3 version 9.0.1 which is the requirements to setup MobSF. It's pretty much simplify the process of setting up MobSF. *Note that this is a guide to setup MobSF for static analysis. For dynamic analysis, you can refer to MobSF page in github. MobSF also known as Mobile Security Framework is an automated, all-in-one mobile application (Android/iOS/Windows) pen-testing framework capable of performing static analysis, dynamic analysis, malware analysis and web API testing. Can further read about MobSF here:  https://github.com/MobSF/Mobile-Security-Framework-MobSF For Ubuntu 18.04 can be downloaded ...
Read more

Setting up RMS in Ubuntu 18.04

By
Image
Hi peeps, It's been a while since my last post. Been busy. So, for today I would like to share on how to setup RMS (Runtime Security Mobile) in Ubuntu 18.04. RMS -  https://github.com/m0bilesecurity/RMS-Runtime-Mobile-Security "Runtime Mobile Security (RMS), powered by FRIDA, is a powerful web interface that helps you to manipulate Android and iOS Apps at Runtime." "You can easily dump all the loaded classes and relative methods, hook everything on the fly, trace methods args and return value, load custom scripts and many other useful stuff." This is a continuation of my post here  https://faudhzanrahman.blogspot.com/2019/09/setting-up-mobsf-in-ubuntu-1804.html  where I did a setup on MobSF.  I'm currently trying to set a box where it contains all sort of testing tools specifically for mobile . Now I have both MobSF and RMS setup in this box which is the Ubuntu 18.04. The same reason of setting RMS in this box is because the requirements fits Ubuntu 18.04. T...
Read more