Android-exploitme (iii): Secure connection

Today I'm going to test the security of the connection and whether the data can be sniffed.

The Android Simulator provides a built-in tcpdump that we use to grab the package.

1. Start the simulator with tcpdump

[Email protected]:~/desktop$ emulator-avd avd1-tcpdump 7-14.cap  # here my simulator name is AND1, and the result of the capture package is saved as 7-14.cap 

[Email protected]:~/desktop$ ll 7-14-rw-rw-r--1 santoku santoku 12288 Jul 00:36 7-14.cap

2. Don't forget to start the server

[Email protected]:~/desktop/exploitme/

3. Open the Emm-vulnerable software, enter the PIN code, (see the details in one and two)

4. Turn off the virtual machine, open 7-14.cap, and analyze with Wireshark:

Find the HTTP packet, follow TCP stream, you can see the following information, the user name and password plaintext submitted to the server

5. The solution is to turn on SSL, using the HTTPS protocol, in our example:

# server side should use HTTPSpython app.py--ssl--port 8443# client also to turn on SSL in Settings, tick "https enabled"