Android-exploitme (vi): Basic encryption

This time, let's see what sensitive information the program stores on the device.

(server-env) SARTRE:ANDROIDLABS2 maxim$ adb shell # Cd/data/data/com.securitycompass.androidlabs.base # ls Libshared_prefs # CD Shared_prefs # ls Preferences.xmlcom.securitycompass.androidlabs.base_preferences.xml

View the Preferences.xml file as follows:

#Cat Preferences.xml<?xml version='1.0'encoding='Utf-8'Standalone='Yes'? ><map><string name="Serverpass">password</string><string name="Localpasssalt">+tm+vxqunl01t2caewlg6xbj9zrs9w5xfvk5efv15sq=</string><string name="Serveruser">jdoe</string><boolean name="FirstRun"Value="false"/><string name="Localpasshash">vt8O7P2Y1dPYjRJG/F7QXADtpc2/DxlvpYya2b/oSIA=</string></map>

The

can see that he has saved the user name and password in plaintext, that the sensitive data should be stored encrypted or not stored and verified by backend