lee/hpr-knowledge-base
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Update metadata and transcripts through end of July 2026

Browse Source 
Refreshed episodes/hosts/comments/series from hpr.sql, and added
official HPR transcripts for the 180 episodes aired since the last
sync (hpr4516-hpr4695).
This commit is contained in:
Lee Hanken
2026-07-31 16:18:57 +01:00
parent 37e8274bff
commit 087f80c44d
184 changed files with 61169 additions and 41 deletions
Download Patch File Download Diff File Expand all files Collapse all files
hpr_transcripts/hpr4645.txt
+816
View File
@@ -0,0 +1,816 @@
Episode: 4645
Title: ZERO HOUR: FRIDAY AFTERNOON APK HACKING
Source: https://hub.hackerpublicradio.org/ccdn.php?filename=/eps/hpr4645/hpr4645.mp3
Transcribed: 2026-07-31 16:15:51 (official HPR transcript)
---
This is Hacker Public Radio Episode 4645, for 2026-05-22
Today's show is entitled, "ZERO HOUR: FRIDAY AFTERNOON APK HACKING "
The host is operat0r and the duration is 00:55:06
The flag is Explicit, and the license is CC-BY-SA
The summary is "APK VIBE HACKING LIKE A BOSS"
Hello, welcome others. So to have a good video, it was top rating. Oh, so yeah, I'm on the idea of another
Podcastor, I think I can't find who he was, but he's like, well, I'm working. So he just kind of was like
Started doing some work and whatever he has is I can do audio based stuff for my work, but for, you know
Security reasons I can't do video or I have to redact a heavily or whatever, and even then on if I miss something it might be
The difference between me can
Pired or whatever, so anyways, I could do this radio. So I
Got this web app assessment or
Android application assessment and I have a tool called jambree
Um, that I use for most of my Android stuff. Cool worker was having problems. Maybe it was region locked or whatever
With his account, so I'm trying to get his stuff set up
So I offer to I guess help at the last minute
And I realized it's an app I had already done and I could never get the SSL pinning to work. So
Free history and when we started with Android it was bad like you could man in the middle of everything
You know the traffic you could see all the traffic there's no route detection and there's no a daddy bugging
You could just go in and open up burpsweet and do whatever
Then they added like certificate pinning or things like that
Basically they
Started stacking on security layers now if you want to try to look at an app
There's about 15 different security layers of hell. You have to go through to get it now
When I was originally doing my testing
I could never get the actual meat and potatoes back in production API to that work
To see that traffic right um, but after
Getting access to the cure or any
Leading AI thing I had it run through
And patch this footer app now the first time I tried to patch it it didn't work. I don't know why
If I'd have been just like I got lucky because I reset things in the right order and I did the certificates right way or whatever
But I'm pretty sure the way I did it last time
It's basically the same exact way and I just maybe did got unlucky in the process of how I do this so
Generally speaking you start out with my normal video on jamboree of how to get root and all that stuff
And then there's a few other things you can kind of turn on that may or may not make much of a difference
You can do things like freeze the google apps
That might help kind of lessen the traffic
But then you're gonna get a ton of errors if you actually installed the google abk
With my setup here
So you know
Really want to do that either
But it is an option for you to freeze and that's part of the
It's a console based abk's button and my setup
So usually first thing I do both I've got root. I'll turn off google play protect for whatever reason. I just
Give me the woman fuzzies
Now last night I was able to
Have it walk through cheetah
Which is a decompiler for android abk's and put about things
It asked me to go through and do these things
It's easier on a said to you have a command language and it's like oh there's a bat file
This call like that's less analyzer and so I ran that
Oh, for ever like the team minutes
on a pi-end machine
then
um
It failed out or whatever and I gave it to air message and it said it was missing some libraries or whatever and then it just said oh
Well, I'm just gonna do this python
And so instead of I think he gives the
G-jorded dump the original image
Um, which is a decpiler by that's basically free that everybody can use
Um, which is pretty awesome
I'm not make good at it, but it the AI walked me through
Doing that and
After some my human and hon
I actually had to re
Not only did I have to run the modded abk I had to
run
The base I have a base button is called free to anti-root
So this is self-depending button and that just applies in normal
No, this is all depending types of of attacks
Our types of mitigations and
I've got a really big file here
Your you're you're getting me like a third of the way through this process now
Once I was able to see that traffic going to the client
To the production server
Through this flutter has its own HTTP thing and it was a full SSL server and it doesn't listen to anything
It doesn't listen to what the system starts
For Android it doesn't listen to client inserts it doesn't listen to um
It does not listen to
Your
The settings and the wifi so if you put the settings and the wifi to say use you know this
This proxy that is your per suite so what you do back up when you're doing
Testing with Android
You have to proxy your traffic through something
Usually that's per suite you've got things like kind of the weekend popular
C.I.D.O
But usually it's gonna be per suite and that's what builds into my tool and it's a whole process to get the certificate on there and everything and that
My thing doesn't like three minutes from nothing to you know a full-bombly Android testing suite
And like two four minutes so I've been doing this
You know kind of creating this app for six years or so
So anyways you have a rooted
Full-Mur Android and I managed to get it to walk me through and I
Modded the APK using
Either just straight up Python after the debugger with
G-Joy was run
So G-Joy was just like an offline debugger. I think you can probably connect to an Android bridge while you're like
Really doing like real time debugging it's probably possible, but I'm not really that
Into it right now mom would be nice
Well, if I could get the AI to help me with some of these like you know encrypted payloads or SSL pinning so SSL pinning
Is
You go to website you get that thing, you know, this is a secure site you get the little block rate
Well, that's a lot of flies in the Android ecosystem also
What we've added is like millions of layers of
Obstraction from that whole process. So if you
Install your own client cert you could get man in the middle then they said okay only system certs can see certain things
So then people put system certs on the on the devices by rooting them and then they had like anti root
So that's like okay your your phones rooted so you can't do anything and then
This is okay fine. We're gonna do anti root root anti anti root
So now when you run a thing you have an anti root thing that like detects like magics and
There's other things that just look up like root
Google wallet and you'll find the nightmare that is trying to get
Like Google wallet to work on your phone
Um, do you do not want to run any of these software packages um they're not open source
They are just weird binaries like where certificates that come from I don't know where
So I would not run any of this these APKs you get off of thing unless it's on my list and even that APK button on my list is
Probably not the best thing to be doing with a personal account. So all my accounts are tested counts
I don't use any personal
Accounts for any of my Android testing so it doesn't really matter what I do
But if you do this on your own personal phone
You do not want to be like put an APK's on there and then it like ask it for root
So anyways, I've installed I have the one
have a reasonable finding of
You can request the
Location of another user by their user ID now problem with that is that if I can ADB debug or
Get traffic on your local network or pull the track up traffic from your phone
I can get your ID and if I can get your ID and I can tell where you are so if you're using this app
And maybe I manage to socialize near you or get you to plug in something or go to a website
Or I think even actually if you share your
You're yourself to someone like a link
I think it might be hidden in there too, but I'm not gonna test that so anyways
So now unfortunately I have two of these I'm running. I have the main one which has got all SSL
Shannians and it's all working and everybody's happy
Which
I don't know if that's actually accurate right now. Yeah, there was an error taking a bad ability of vehicles
So I think it's it's broken again. It seems to only work for a minute and then like some cookie times out
So I have to rerun the yeah, we can't receive details at this time. It's like some kind of caching issue or something
So what I usually do with apps if I'm testing him a if they don't work I checked the ADB debug
And it'll say stuff like blah blah blah check failed or like some kind of service check failed or something
Basically that's man in the mid preventing man in the middle stuff. So right now I've actually killed the app
I don't want to reset the setting because I already have the app logged in
So I've killed the app and
To explain what this app is it's like a location sharing app and
Other than that is
Not really important to know what it is
It's a location sharing app for like
Different
For like family services it possibly
That helps
I don't even know what they're trying to do but that's one of the things that it does you you can share your location
You can say hey, you know, I'm I'm at a Costco
You know, I'll take you to track your kids you can use it
Um, whatever
There's billions of other things out there. It doesn't matter better like custodia or whatever
If you want to track your kids this app is I don't know what it's trying to be so anyways
So now I have it. I've killed the task. I'm going to relaunch the task with my original
Which now I'm confused. I don't remember which one of these is which
And two jambis the one's got more traffic and the logs is the one that I want to do so I'll do run a free to anti-rude
a facility pinning
I've got another task running in the background. It's completely unrelated to anything else
Light saber fonts the lightsaber AI font generator. It's been running for like an hour
So it's kind of interesting
Um, so it says we're starting that app
But I don't see the list it's coming for me
Um
Starting free to with the tambourine and to man the little yeah
Oh, because I do not have root. I can't
This is the wrong. No, this is the right one. It's the right one
Yeah, this is the original one. So why doesn't poison the sword?
Click to button again
Ah, there's more than one emulator installed so now
Unfortunately, I have to
Trying to get my ID while I'm still hot
So I'm running a normal no root no anything client right now has a client to and
Somewhere in here hopefully
There's a folder that has my
Client to ID and so I have two jambories from here running right now
The problem with that setup is that it doesn't know which device to connect to it
It's a failed to connect to the device because there's no mobile
There's two devices. It's trying to connect like an array so it doesn't connect to both
So I have my
I did ran a db log tech because I realized that the user ID is in the logs
of a db log cat now a db log cat is probably shooting you have different version
Like a error version so you can say all the way from warning and up or only critical enough
That helps with the size because this this file is basically a trace file. It is there's so much information in these files
Like things like location data and things like that
If you can plug in the phone you can get all tons of interesting information
So what I found is the user on this where ID is in the thing and it is also the user for it's
UNC web path through the actual API
Which is kind of interesting because you can't see anything to the prod API without
decrypting the flutter thing, but if you use this a db
Log cat which you can get on your actual phone you can run a db log cat on your phone and just export the results and then
Shipping to AI it's a hey, was this is anything weird running on my phone. I have troubleshoot and debug
All kinds of issues with a db bug a db debug or a db log cat that I was not able to troubleshoot within the other software or any other
scripts or mainly looking at stuff
Because this thing is just like a dumpster fire of nightmares so anyways
I'm using crep to crep for user underscore ID in my log cat
Log cat file now we have use right d0 no use right d0 use right d0 use right d code SQL a constraint now
A little strange
That I don't have a user ID right
Is my thing now if you go back to here it says blah blah blah on command faults
On handle exception client exception D
Isn't not adding events C blah blah user ID so I think it was just like how failure that I happened to catch
When doing the to get the user ID so I'm gonna have to try to trigger right
on at the try to trigger
Somewhere I have my output file
I'm gonna find
See that's not even the right
That's not even the right
80 b
Has here to block a real okay so money this man
To do the log cat again and I'm hoping
I can get the thing now. I know the only thing I've really done on the app is share
So I did like what I say
I was like share my thing
It's a bit strange and white members send it in by link
You know copy or maybe like
Send it in by link
Okay, so hopefully now there is a
These are ID of not
And well, I don't see anything so we're in client to entail
look at
Make sure there's actually stuff going on here
Yeah, we're getting we're good stuff
So you can say tell if it's crap
So you can't what have her had a reason
80 b log cat doesn't like you using windows pipes
Try to do stuff so I'm using tail of a walk cat in segment which is a kind of
Unix like horrible thing
You don't even know subsystems for Linux to run
So when you just need you know not by listing and you can basically get Linux on your journal
Can't do x windows? I don't think there might be some crazy s way to do it
So GPS coordinates seem to work here you can pick your GPS
coordinate still so
Especially and now when I originally was testing this app it wouldn't let me do are they anything?
I'm gonna say I'm in the middle of the Atlantic
Or where should I say it's close to the guy?
Selection
Oh, unfortunately no, segregation
Points that you save all up here here
I thought there was a way to like I'll save point. Yeah, so you can save your points. Let's say
Selection
Close out here
And then I can say like go to my location
This is saying somewhere
I can't really tell where this is
I
Don't how do you zoom out with
My touch
I see this
Entch
I'll pick you can zoom out
I mean, I can just to open source intelligence maybe
And ask a I
So from my memory now as I don't know or this
I tried to deny where is this
I'm not gonna be surprised, but it's gonna be terrifying if I can take a japan or I can take an image and then ask a I where it is
That's kind of interesting
Research interested
Fairfell if you call it for me that is not where I am or I'm actually supposed to be
So we're gonna
Oh, I think we broke that no, it's a different type
Is this the one I want to pick by GPS, but yes, I was a yeah, see though we can't reach here in that work is the other de-original app like
That's like a times out after a while or a while
All right, so I think I'm gonna kill the app and restart it
Um, let me go to permissions because when you reset everything the permissions get all reset
So I'm I allow everything again
contacts I'll allow about some media
A lot of microphone
I usually allow everything at that the beginning but then if I have the issues I have to remember to go back and say
Who I turn on microphone and then I want to call the microphone and I pooped out because you know
I didn't know where it was yeah, so now we're in Puerto Rico
Real flat the narrow so I can take a screenshot. This is a finding right it's like again
When I couldn't do any debugging
I had to say I had to be creative so what I do as an attacker right if I wanted to
If I have an app that tracks my location
Okay, so we've written well we told somebody to write that up. I'm to help somebody at the last minute
So I told them I'll do the test
See you to the reporting because I don't feel like doing it
Um, I'm actually supposed to be leaving for a thing. Well, the thing is still going in circles
No idea what it's doing
Arthur author. Um, this is our our
Profi believe style X for AI prompt
That is now doubled in size
Which is fine around the characters that is but
30,000 that's way too many
So first small model at least
So what we're doing here is like I'll three check point full convert EV before harness implementation from status
I know it's doing this whole like
Hero does the requirements design task
So it like does proper like STLC kind of strategy proper STLC stuff even though he'll use an example way
Half the way there
So we've got our first finding
With the geolocation spoofing is a thing
Um, I'm still have not seen a good for
Whatever
So I'm a little confused as to why I can't see that
iteration
Worst case scenario. I have to do the whole clone the whole thing
That means having two per principle it's instances
editing the per suite
The jambory it's a minute isn't I? I really don't want to get so I'm trying to find
Oh wait make this crash enough to like you know
Crash enough to
Show me my location
so
But that's interesting that you can add by license plate
Um, do you think that would be a finding if I can look up?
Somebody's license plate
So
The tax case would be if I can get somebody's been or do you have a vehicle or stuff
Just by their license plate number right
Then that means I get like a free registration stuff so I'm going to
I don't know my license plate number. I might lose you for a second. I'm going to go downstairs and take a picture of my license plate
See
I've got roughly
All right, so you might have lost anything
But um
So I've got my license plate here. I actually don't have a
Association with images because I got rid of all the Google apps
Most of the Google apps on its full because I got tired of nagging
So I'm gonna put in my notes
My license plate
CG
CG
Jay
Last year's year one
Idea he is is it maybe I can look up
license plates for free right
As maybe we're doing this. I'm going to just make up a head details manually
I pick a car
Billy
Um, yeah, maybe I'll be able to refine on the trip and that's good
Yes, that's a burglow
Color optional all-wheel drive
Okay, Vin is optional. Let's get for now
At a name
Hey, hey, head it
Okay, I turned to garage. I still don't see any
errors in here um
I mean what you can do is kind of do something like a
Then like kill the internet and try to cause an issue
Maybe that'll help
I do like a
Break the internet kind of scenario
Yeah, see I've clicked something and it's like lagging out now
But I think I've disconnected the internet so it's like a you have no live listing
It's great a new live listing
Would you like to list like it sell other people's cars right?
We're going to turn out kind of hilarious um serve center
Sure whatever
So this is like a they're also trying to do like a car do like help your
So anyways, it's like a money thing
So I'm going to go back
I'm still trying to call some kind of air
Um the problem with this is a view
There and it seems to still be working despite
Kind of put it in airplane mode
Maybe airplane mode. Oh, it's still in their mobile
Mobile data
Mobile connection
Which is like you know whatever
Still don't see
We're still doing a logcat
In five six that's the new one
Um, so like the internet's not working and we're not getting anything
Nothing is crashing so
I don't know what to do
I'm turning shit
I'm going back off turn Wi-Fi back on
So
I still don't really know how to get my idea without doing the whole
You know
The whole entire thing now I could sign in with it
I could they do have virtualization with something where you can basically
Run an app and then you run another app and then that app allows you to run two of the same apps at the same time
It's does like some weird
Jailing thing um, I think it's a you think I don't think you need
No, I guess you probably need route to do something crazy
The idea being that you could test same map on same phone
Two different
So I don't know I'm still I still left this thing open and running
Maybe I'll get lucky and I'll just cough and grab out
So
Okay, so we've got
Our first finding
Oh, let's tag the guy
Um
The
In a bad enough time I'd be able to do other stuff but don't um
So I've turned the internet back on on the normal app. I've kind of given up on
Getting that user ID
And I might just have to
Use another account
And like
Right
And try again, so
I kill this so I'm on the original one with all the main and the middle stuff
I'm going to
Do ADB
Even actually gonna turn off
This old one because this is
Not super helpful. I use this shut down button
On chambering because that ensures that I think ADB gets killed after
Emulator because sometimes ADB likes to keep running
It's sometimes if ADB servers already running it doesn't want to attach just else
So a lot of times I my in my scripting. I always kill ADB and then start it back up
Because it like runs almost as a service and it's really annoying
It gets hung up on itself a lot
It might have gotten better or maybe that was just my weird circumstances when I was doing all my testing
So now I said it's said it's trying to shut down, but it doesn't know which one to shut down because there's two
So that's kind of a bug with my own
deal
It's like device emulator bash one of four space emulator dash five is not enough
All right, so now we just have one
Nope, I sat down there on one
That's okay
That is okay. That what can actually walk you through
Since there's only one device. I'll hit the shut down button over here
And it both shut down buttons. Why not shut down all the things?
All right, so
I'll give you not give me an idea to tell you once you do get rid of an advice
When you do normal Wi-Fi thing, it doesn't always follow it now the only way to force all traffic through
The proxy with specific port is to do IP tables and Linux if you do that that is network layer
Shannon, there's no
Cheating out of that scene. I have emulator that's in a state of
It's on, but I can't press any buttons. I can't
Quit there's no
There's no way to stop it
So the emulator gets dies at some times so then I have to do oh because I'm piping the logcat probably
I don't know
It's really weird that that file is not in here anywhere
Use right zero use right zero so yeah, I don't know
Anyways, both art crapped out my original is this guy so I'm gonna start him back up
The star AVD button will start the virtual image
Now I think as today I'm using I'm Windows not the there's parts of acceleration
So if you have emulator you pretty much have to have acceleration world's nothing gonna work
Because you need acceleration
It's gonna be really slow like on
You can't really test it's so slow now if you would want to you know if you want to do like a quick test
Something like take you 30 minutes is gonna end up picking you an hour sure go ahead do that
But I'm going to Windows accelerator thing that's what I'm using now you can use until Haxium which is the pressure
And I've also okay to seek you for it so it might break other stuff. I don't know
I got rid of the pixel launcher
I'm using some
Pirated pixel launcher that's got like ads in the middle of the launcher that whatever it appears
So what we have is a nice clean image
We need to run our route so we're gonna go back here
We're not on client to anymore
We're on savory client one and then we're gonna do ADB shell
I didn't notice that the ad is not smart enough to know to run
escalated commands inside this is like it's like run this is run this and it'll fix everything and then you go to run it
Yeah, you don't have route to run like ADB shell has route that default yet like past the parameter of
280B shell so it's like double escaping
So I just SSHN right sorry
ADB shell and and then I type whatever commands it wants me to type
So now I've typed IP tables
for all four four three and 80 to go to the actual IP address of my server and not the routed net
So there's an internal net number
That you
attached to
Sorry, by default
Most emulators and virtual things use a net
Rest your installation because it doesn't require local admin
When you use bridge that means you can basically talk directly to the card so you're on a 192 network
You start if emulator or virtual machine then you're still on a 192 network
Traditionally they all use net because net doesn't require local admin
good
You'll have to expose your internet and this is early to the
The emulator or the virtual machine
So we have our traffic going to we have our birb speed running with
Actually ignoring everything else except for my target API URL
That's a client's production
And so we're we're looking at that we're looking at that information and what we want to do is
For all its purposes, I don't really care about this account
I do have the original ID
That is attached to this account which is attached by four numbers so unfortunately I'm going to uninstall
Or actually
Keep this running
For stop it is not running
Then I'm doing clear storage
So now the app is like I've never run before it's brand new now unfortunately at the double SSL
Depending not only it's 300 meg
Hacked up version of the app I compiled it lets me as this help in I have to still as this will put everything else because sometimes get error messages
So I'm using my basic
Here is a salty peter
And I'm starting the app again now and instead of putting the phone number I use for this account
I'm going to use the phone number for my
Other account because I have the ID to the first account
I just need the ID to some other account
So I'm going to go to Google voice and apparently that's also a finding too if you can use a
fake
phone numbers fake GPS
Just take everything right. I have seen banks start to this more while they force it force you
force
They enforce
This is a oh the number number padworks. You have the reboot wants to get the number pad to work at least the keyboard to work
um
I have found that
That bank apps it's stuff are starting to block Google voice or any voice providers
One out of maybe
Ten well if there's like 10 secure apps you want to self-care or something like that
I would say like three or four of them have
some kind of issue
Around that
So anyways, I put my code after using my armcree work
Or yeah, that's my armcree work one and on all connected in it's all happy and I'm doing all the permissions again
Allow all now
When you do allow permissions and apps you're giving it access to more data
Now if you can minimize the access the app has then you can narrow the scope or
Calls less problems or errors
What you don't want is to
Have this scope maxed out and just have much of noise
Or when you give it access to everything that allows it to like a new rate more things
It caused more things to come
So if you have access to your camera and it tries to
Figure out where they have virtual camera or not it will fail so like these face ID apps all kind of stuff
Oh wait, we have a user ID here cool. So we have a second user ID
So this is
So user
ID
One is this is my original one, I think
Yeah, here's my original user ID
User
ID
User ID
Two is
Oh no, we have to do the same user IDs
How that work oh
No, they are not the same
They are very close
No, they're not do the same they're the same
Son of a bitch. All right, so I've screwed something up here
Is a user ID bound to the phone's
Mac address or something
So I locked out and logged in as as a different person and I still got the same user ID
Which sucks I'm the same user ID if I install yeah, I'm the same user as our idea if I install it
As whatever so I
Do not I'm not gonna blow this away and I don't want to call it either
Right oh
I need a second user ID but that involves
Somehow convincing this app to give me
I completely knew user ID it's probably bound to like
some specific kind of
Internal ID of the phone, you know
When it gets to originally generate it
That's a lock and figure
Because I essentially logged in as a different person and think I have the same user ID
So that doesn't make any sense
Because yeah, I used the
This number did I type the wrong number oh?
I type the wrong number that's wrong. I'm not even I'm I'm not I'm I'm not I'm please
I didn't even notice I was typing my own
Number so just kidding
That's why we do it live
Okay, so we go back here for stuff
Clear those permissions
Run the app again through
This is healthy pinner
Yeah, while it was talking I didn't realize
That I was typing the same exact phone number
Like wow how else does it know because I haven't logged in anything I'm just running that app and it's like
You know
Sign in the phone
That's so I had to it must
I do use this this number for
Other testing so I don't want to tell you guys
And like have my phone you flutter or something
All right, we got our endpoint
No, hopefully
Burp so wheat has
Us a new user ID somewhere
I use the search button and then I say auto scroll scroll
So I should be able to just go up a few times
And see the user ID at some point
Jesus, are you serious
All right, maybe here to
Oh
User reverse ID there's user's ID and user ID
There enough, well actually, let's take that because that might be useful
Kind of any strings that help me find stuff
I can find useful so it's actually user IDs
So user ID one user like God is the same user ID it is
It's not a bitch. It still is
Because the same user ID no ID
External ID
Let's just go here and say
These are
Underster
ID S
User ID
Click rejects say we're not going to get a case sensitive
User ID ID
Yeah, that's it
I think this is right
80 is the new one
80 the old one is 8c
Strange they know
It's then entropy is pretty much there
It doesn't look sequential is what we're looking for yeah, see here's our here's our c's and then we squeeze switch over
At three
We went for 159 to 301 which is
Well 159
The 301
Three minutes later, so once we we did the that we got to do ID so we've confirmed that that's a thing
We'll go back to repeater and hopefully yeah user IDs
So here's AC
So I'm authenticated as a different user and I can request
The location of any other user ID
Boom
So
Confirmed
Um
So now we have at least two findings that are new and it is
On my head the answer one call here's the thing
We don't need all this we can
Copy as curl
Um
So
Yeah
So
roof you can off as
Any user and get any user ID
GPS
GPS location
All right, so that's one um that I saw in there
Thought of um because you know even
I mean there I would be that user IDs somewhere in this uh
This file so I'm gonna go grip user
There's user underscore ID and user ID S
Oh either or I could also
Just look for the string of the user so that might be in a different type of vlog
Or parameter
Which in this case yeah app user ID user ID
So 80 it's definitely in there so there's a bunch of
There's a bunch of parameters here so we have app user ID
So there's 10,000 different ways to track user ID I guess so app user ID and then we have user ID with no underscore
Then we have app user ID again
App user ID app user ID
So we actually want to do
When we're looking
Where do
prep one aside
I
E is there a jacks like e-grap is just an alias which
Kind of interesting so we're doing user ID. I don't want to ignore the
Isaac nor a case
We want to keep the case cuz
I don't want other types of cookies or things coming in so here's our three
I just happen to pick the one user ID that wasn't in anywhere else except for
My bank
Go for your um so here's our red jacks
Which is app user ID user ID and user underscore ID
In this thing so we can say tail
I'm not sure it's going on here
I'm siglin it gets locked in frozen sometimes
So kind of sucks. I have to um
See
No idea where I
Let it find out where
See each and every client to
um
Grap
See
And the file we're looking about user ID and I just screwed that up
Let's screw that up again
Trying to go go to faster
um logcat
log
have tons
So we can say tail minus f
logcat log
And the same grip
strategy and if you do tail f and you don't
Have it running you can slowly do a dash in and say like the left 10,000 lines
And so now if you start writing out to that file again you started back up or you use that whatever
It'll it'll it'll give us a file but since
We've moved on and all we all we care about it is getting two different user IDs we are moving on so
I'm going to go back to the proxy
I've got a bunch of stuff in here but I want to only match
The almost said the words the clients API and points
There's just a lot of the same thing going over like
Lookup command happens hundreds of thousands of times all the time
It's kind of interesting so we're gonna send this to um since
One problem I had before is I use burpsuit free for jambree by default. Oh, come with that is um
No problem with that is
Can I do request the end response?
Quest
Response okay
I might even just send this request over to
Active scanner that's not that's part of
The
part of the pro is you get active scanner and then
If you pay for credits
They're relatively cheap. I only use them when I find like really weird stuff that I can't figure out
Which is becoming more and more
nowadays
So yeah
Bice tokens all kind of stuff active user type adult
That's kind of interesting. I did your different flags
I mean nothing looks super interesting
I'm sorting by URL so I don't have the same
things
This looks like a calendar that
You can create calendar events user current page
user IT that bandage. Okay, so here's the thing. I'm I'm like looking at someone's
Management calendar event start time blah blah page here a page size zero
Current page total pages so let me add a calendar event
Do I
Reset it again
I have no idea what user I am I get anywhere which is really matter
I'm so I'm doing like a gathering and I'm going to create an event
Then I want to call it
F F F F F F F F
Or I like to do I'm random so Kiki Q 1 2 3
No location. We're just going to do a date time
And then
In date and time
And I got about 40 minutes
I I don't know what else I need to add
I guess I need to add an event location
Growing a dot sandclare
All right
Creative event. I want to scroll it down here and color
When I highlight stuff
Are you I used to be real bad about like wiping out stuff
When we make this purple I now I just leave it open until the computer starts to die
Oops we couldn't create your event. Please try again
So
kind of weird I
May 10 through
I don't be in
This kind of weird let's go back to the drawing board here
Oh, I sorted these wrong anyways
So here's our calendar thing we got an okay response
And then we got whatever booked
Worked fine
What do I need to do
All right, so I guess I got to go here in a second
I'm gonna look at the calendar and see
What that looks like I'm highlight the purple and I'm gonna say see calendar
and
I don't know if that really gave me anything
Oh, here we go
I scrolled in say anything so this is an event
Now the thing about this is is I need to switch to the other user to see if I can see some other users
So
what we're looking for is our
Our target
Our target user sentry trace
It would be nice to like
Take this yeah, that's all user ID so I can look at somebody else's
Somebody else's calendar so user ID
So I'm using user ID AD now so this is the original request
Center repeater
Now I'm gonna use
Not AD but my other ID which is this F8
Let's see if I can read somebody else's calendar
Boom goes a diamond for a one-on-authorized day
So that means that I can't be logged in as anybody and just see
Somebody's arbitrarily calendar right
That's that's good that's a good thing
So I can go back
Do you want to do this and I can say
Repeat now I get a 200 okay, so I take it the AI and say
Oh, it's the F8
Let's see AT
Okay, yeah, so I'm picking the response and requests I need to there and I'll say
I have a different
User ID user
On easy actual ID
To test with
Find any
Arbeck
Or
Top
Or Sands top
10 test
4 each of the Sands
Top 10
Is that say the goal? The goal is to
Find findings for this app using with
For what is that but with the
That by testing or
Testing for the top
Sands
Issues
So I'm just going to enter and go
So you know we have three findings one safety PS ones
Look up anybody's ID and then one-to-test would be get a user get the license plate
Let's see if I can read other peoples
Of in numbers and stuff based on their license plate because if they have access to the data
They're going to pull it in
But maybe not you know so if I can add my license plate and get back my own information
Or add by even then number I mean I guess I don't know
Anyways, appreciate it take it easy
Sometimes these APIs will give you back a bunch of information
But you only want the name so like oh put in your social security number and to get your name or put in your name
Your social security number and these databases have tons of information and maybe they cough back whatever
But the client only takes back you know the name and it's like we put in your social security number and it returned all this other extra information
But because the client doesn't need that or an or doesn't want to like worry about
They're like oh well, we're just going to drop the you know credit card number or sensitive field and just take the whatever field
Well, you know that happens a lot where
You put an API request back and you get like a whole bunch of extra information you didn't really need or want
Kind of least privileged issue anyways take it easy got to go later
You have been listening to the Hacker Public Radio podcast, at hackerpublicradio.org.
Today's show was contributed by a HPR listener like yourself.
If you ever thought of recording a podcast, then visit the HPR site to find out how easy it really is.
Hosting for HPR has been kindly provided by anhonesthost.com, the Internet Archive, rsync.net, and the HPR Community Content Delivery Network.
Unless otherwise stated, today's show is released under a Creative Commons Attribution-ShareAlike 4.0 International (CC BY-SA 4.0) license.