Concepts we need to understand first of all: Penetration Testing
It is highly probable that you have heard of penetration testing at some point while investigating the topic of computer security. Or maybe you have worked on penetration testing against a web application or another system or computer network.
So what is meant by penetration testing in the first place? Well, in fact, it refers to the process of searching for vulnerabilities in a specific system. In the meanwhile, the information of a targeted system is collected in order for a pen tester to grasp what entry points could be exploited. Then, an actual exploitation or sometimes a virtual one is carried out. Accordingly, conclusions are drawn out from such testing on vulnerabilities to report how much such system is secured.
Pen testers are usually referred to as white hat attackers since they try to break the system which is tested.
It comes as no surprise that every single person on earth is familiar with the word Android and realizes that it is an operating system for mobile devices in the first place.
However, what we are interested more in finding out the basics or fundamentals of such operating system; where does it come from and from which operating system was it originated? In fact, the Linux Kernel was where it all started for the sake of reaching a dependable operating system working well on mobile devices and tablets.
It has become now a very commonly effective operating system. There exists the Android Open Source Project (AOSP) which is basically an open project where several developers and geek guys cooperate to develop new features.
One concept that any computer enthusiastic has got to know very well and understand its meaning is the notion of virtualization. Physical computers or servers are no longer appropriate for companies who struggle to find a place in their data centers to add new physical machines.
On the other hand, home users find it very hard to work on two, three, or even more operating systems and build connections with them. It is either one will have to buy several physicals, actual computers to install on whichever operating system desired. Or the other option is to have a comparably good computer with great Read-Only Memory (RAM) size and Hard Disk as well. Then, such resources shall be distributed amongst the “virtual” machines which are to exist on the same host “physical” machine.
An example of full virtualization virtual machines is Hypervisor. It is where the virtual machines are linked in a way or another direction towards the hardware of the computer device.
Whilst, operating-system-level virtualization is where virtual machines require an operating system to work on. Thereby, the virtual machines are linked to the hardware through such operating system in the middle. For instance, Virtual Box and Virtual Machine Workstation (VM Workstation) are two programs which work for this type of virtualization.
What types of software will be used for the process?
- Virtual Box:
It is for the virtualization purposes to construct the lab as explained before.
- Santoku OS:
It is an operating system which already offers preinstalled Software Development Kits (SDKs). It is actually specialized in the deeds of forensics investigations and penetration testing.
It is very important for the sake of creating Android Virtual Device (AVD)
It is an android app which is vulnerable. It will help us begin the actual penetration testing in our created lab.
A detailed guide towards penetration testing for Android
In order for us to accomplish our ultimate goal, we will have to walk through three main steps.
- Download Santoku OS:
- As mentioned before, such software is intended for penetration testing purposes since it has pre-installed SDKs.
- Plenty of forensics tools are offered by this operating system like firmware flashing tools for multiple vendors.
- App details could be also enumerated via various forensics scripts offered there.
- Install Virtual Box or VM Work Station:
- Throughout this tutorial, I will be using Virtual Box. However, you could also use VM Work Station for the same purpose.
- First, get Virtual Box opened and start a new machine which you shall create specifically for Santoku OS.
- Choose the desired RAM size dedicated for this newly created virtual machine. While it is recommended that 786MB shall be the size, making it larger to reach 2GB, for example, is okay
- The option VMDK (Virtual Machine Disk) is really the option which you should go for
- Now, specify the desired hard disk size for needed purposes afterward.
- Now, install Santoku on the assigned virtual machine. This could be simply done by a right click on this virtual machine. Then inside the option Storage, “empty disk” shall be chosen after the disk icon in front of the optical drive is clicked on. Santoku iso file should be selected for installation now
- Run the virtual machine, allowing Santoku to begin its boot menu and the option “Install – start the installer directly” should be chosen.
- Walk through the installation process and choose your preferred language.
- Get Genymotion downloaded and installed:
- The Android operating system could be experienced through such software where application testing is aided by OpenGL hardware acceleration.
- Download Genymotion, and after it gets installed, browse into https://www.genymotion.com/account/create/
- A free account should be created there for verification and then log in the downloaded Gebymotion on the virtual machine.
- Get the AVD created through clicking “Add” and select a preferred software version and brand type as per your desired task or preference.
- Get your choices reviewed and confirmed thereafter. The virtual smart phone is created at this very point.
- Data will start to get downloaded on the virtual device
- Choose the desired device to work on. You will have a bunch of options in case you added more than one device type. It will launch a similar thing to what is shown in the very following image.
- Get Santoku connected to the virtual device now for the sake of using its SDKs afterward:
- Know which IP the virtual device has.
- Get the command line opened in Santoku
- The following command should be typed adb connect <IP of Android Virtual Device>
- Make sure the device is connected through the command adb devices
- The virtual android device could be accessed for penetration now via opening a shell with a command adb shell