Recover or Shred deleted files

Deleted Files can still be recovered. As hackers, we might have saved important/ confidential files on an android device and anyone can recover this – It is death to our part. Therefore, we might need to shred this data.

How to recover deleted files? 

First, we must know how to recover deleted files. There are numbers of file recovery apps but I use “GT File Recovery.” It is so user friendly that I don’t even need to explain to you how to use it! It only requires Root access and that’s it!  

How to shred deleted files? 

Shredding files means deleting a file forever. For this tutorial, we will use Fshred. Download the app on Play Store and open the app. you will be asked on which storage space you wanted to wipe/shred. The Fshred creates a huge file to fill up your selected storage’s free space; if this happens, all deleted files will be impossible to be recovered. NOTE: Fshred does not harm anything on your device; it does not delete any existing files. Just make sure that your device is on its full energy before you start shredding.

Alternative Recovery apps

Source: Google Play Store

1. Disk Digger (Photo Recovery)

2. Photo Recovery

3. Deleted Photo Recovery

4. Dumpster (Photo & Video Recovery)

5. Memory card Recovery

6. GT Recovery

7. The Recovery app

8. Undeleter (This one is the most effective but the recovery features are paid)

9. GT Sms Recovery (Recover Text messages)

Fixing bootloop (soft brick) 

What is bootloop?

 It is when your Android device is stuck on device’s boot a.k.a stuck at Logo problem. This often happens when you tampered something on your device’s system files. On some cases, there are unrooted Android devices that experience bootloop because of factory defect; but normally, bootloop happens only on rooted devices. Some people call this problem as soft brick, because the device is not totally bricked at all, it is half dead though…

What is the cause of Bootloop?

 “Boot Loop Causes. The core problem found in a boot loop is a miscommunication that prevents the Android operating system from completing its launch. These can be caused by corrupt app files, faulty installs, viruses, malware and broken system files.”

How to fix? 

Warning: This tutorial may not be compatible with all Android devices. 

For this tutorial, we are going to use SP flash Tool. SP Flash tool is an application you could find very useful in fixing extreme cases of a bricked MTK Android (e.g Tecno, Gionee, Infinix, Opsson, Innjoo etc) like the phone not coming on at all or not booting into recovery mode etc.

Requirements

 Your Android Smartphone should have at-least 40-50 percent of battery to perform the Flashing Process.

Attack Execution-Business Logic

Attacking business logic is one of the methods used to compromise a web application noting that discovering a logical flaw is a hard task because this kind of flaws does not have a specific signature as other types of vulnerabilities and it can be totally different from one application to another but attacker can try a set of possible vulnerabilities that might exist in the probed application.

1- Encrypt and disclose the key: Using the same encryption for two pair of information one is visible and the other is not. An example about that might appear in (remember me) functionality where the developer implements the same encryption key for a cookie containing session ID information and what is called screen name (the user name shown on screen). 

The main problem in the logic is that the attacker can tamper and replay what is encrypted and protected. This actually is not the problem of weak encryption but the usage of the same key with value that is visible (the screen name) which makes it easy for attacker to predict the used key and unlock the encryption of the Session ID information.   

2- Overloading dual privileges: Implementing an overloaded method for password change for administrators and normal users depending on the existence of the (old password parameter) which gives the attacker the ability to use non valid parameter list to be routed to administrator’s version.

3- Multistage manipulation: Sometimes the developer makes a bad assumption that user will follow all steps in a multistage task in the right sequence but this is not always the case as an attacker can manipulate the client to avoid passing through a specific stage which will cause sometimes a great damage.an example about this attack is manipulating a sequence parameter that hold the current stage in purchasing multistage task to purchase a digital content without passing in payment phase. 

4- Overlapped checks: Another case is the case where the business logic does not consider out of band inputs for all methods related to same input. an example is a banking web application containing transfer method dedicated to do the transfer and a pre-check method to restrict transfers for amounts higher than (10,000$) and route such transfers to be approved by senior manager. The pre-checked method considers only the check for a number higher than 10,000$ so the flaw was that even a negative number will pass through that test and the negative value will go directly to the transfer method that takes the absolute value of the number so if somebody tries to transfer (-900,0000$) the transfer will be authorized with no senior manager review. 

5- Bulk but for a while: A scenario where attacker can get benefit from bulk purchase then purchase only one item is also a flaw based on the assumption that the user will send the full list of purchased product after getting the discount. 

6- Forgotten escape: this attack is based on the assumption that a sanitization method is available and will prevent all malicious characters that might cause a problem but the developer forgot the escape which itself does not represent a problem but escaping the escape by the mean of disable the sanitization functionality. An example is the usage of an input like ( whatever \;ls ) in this case the sanitization will turn the clean input to poisoned one ( whatever \\;ls ) which will reactivate the semicolon malicious effect. 

7- Defence+Defence=? : sometimes the intersection of two defense mechanisms can be used by the attacker to initiate a successful attack. An example is the usage of an extra single quotation mark to escape a single quotation mark as a defense mechanism to prevent SQL injection, and truncation length limiter mechanism for input as a second mechanism to minimize the ability to enter unexpected amount of entry. The flaw resides in the usage of the second mechanism by the attacker to break the first. 

if the user login query was:

Select * from users where username=’user name’ and password=’password’;

Now if the attacker provides the a user name containing ( xxxxxxx….xxxx’) where 127(x) character is there and a password ( or 1=1--) the resulting query

Select * from users where username=’xxxx..xxx’’and password=’ or 1=1--’; 

Will break the login functionality as the extra added quotation by the first mechanism will be truncated by the second. 

8- Race condition: in the case of race condition the vulnerability appears only for a short period of time, it is hard to detect and reproduce, but it can open a door wildly if exploited. an example is the case of login function that mistakenly stores part of session information as a static information that are used as an identifier in other functionalities so if two users use the login functionality exactly in the same time there is a big chance that they can reach the functionalities that uses the static identifier. 

   

Authorization and Attack Execution-data stores

Authorization the process of giving someone permission to do or have something it defines how access is controlled in the context of what is access by whom. In authorization we can talk about three types of authorities: 

1- Vertical authority: it is about the level of access to specific functionality set for each type of users an example is the difference in authority between administrator and a normal user. 

2- Horizontal authority: this type of authority is about controlling the access in the same functionality, as example having the authority to access the web mail functionality does not mean ability to access any email account. 

3- Contextual authority: this type of authority is related to current application state which can be explained in the perspective of multistage process where available functionalities are specified according to present state. 

attacking those concentrate accordingly on breaking the access control using three methods: 

•  Vertical privilege escalation: The focus in this method is to gain higher level of access related to more privileged type of users. 
•  Horizontal privileges escalation: tries to compromise resources to which he is not entitled. For example, in web mail application to read other people’s e-mail 
•  Business logic exploitation tries to exploit a flaw in the application’s state machine to have access to an important resource. For example, a user may be able to bypass the payment step in a shopping checkout sequence.  

Attack requirement: 

A. Different privileges to different users on functionalities 

B. Different privileges to different users on resources. 

C. Privileged user used functionalities are in the same application containing configuration and motoring it 

Attack Process: 

A. Configure Burp as a proxy and disable interception, browse all the application’s content within one user context. If the target is to test vertical access controls higher privileges account should be used. 

B. Be sure to map all functionalities by checking Burp’s site map. 

C. use the context menu to select the “compare site maps” feature. 

D. To select the second site map to be compared, you can either load this from a Burp state file or have Burp dynamically re-request the first site map in a new session context. 

E. To test horizontal access controls between users of the same type, you can simply load a state file you saved earlier, having mapped the application as a different user. For testing vertical access controls, it is preferable to re-request the high-privilege site map as a low-privileged user, because this ensures complete coverage of the relevant functionality.

 F. To re-request the first site map in a different session, you need to configure Burp’s session-handling functionality with the details of the low-privilege user sessin (for example, by recording a login macro or providing a specific cookie to be used in requests 

G. It is necessary that define suitable scope rules to prevent Burp from requesting any logout function.

Data storage is one of the main components of most of web applications, it contains the information about the key business functionalities in addition to users account information which makes it a delicious meal for an attacker. Data storages have many types that rely on multiple technologies, it can be as simple as plain text file or sophisticated Data base management system like Oracle.

No matter what used Data stores are it can become vulnerable if the attacker finds a way to interface the data store through the application functionalities or being able to access it directly in case of Data remote access availability. Injection is one of the common types of attacks that commonly executed to compromise data stores, it generally depends on the nature of interpreted languages characterized by parsing and executing instructions in the run time. PHP, Perl, SQL and LDAP are well-known examples of interpreted languages used in web application development. 

The main idea that helps in compromising interpreted language is being able to inject special characters or instruction that have grammar match in the language syntax. 

The following listing a simple SQL syntax that retrieve user records that has a matching user name and password to those entered in quotations. 

Select * from users where username = ‘usrName’ and password = ‘pass’   

If the application that include this syntax is vulnerable to injection by mean of absence of sanitization functionality for entered values, the attacker will be able to enter the value of ( admin’- - ) in the user name and any password to gain administrator account privileges as the resulting code that is going to be executed by the interpreter is:

Select * from users where username = ‘admin’- -‘ and password = ‘anyPass’   

The (- -) is the special syntax to begin comment in SQL, which means that the interpreter will ignore everything after (--) and will retrieve the admin record.

 

Password management exploit

In many situation developers do not focus on protecting privileged pages from privileged users so the mistakes that are covered in main login page reappear in the change password, forget password or remember me option.

Mistakes like allowing unlimited number of false login, providing different message depending on bad or valid password and checking the validity of password before matching with new password. 

Another issue raise when dealing with Forgotten password, a weak method might lead to use challenge questions that are much more easier to break, like pet name or first name for mother..etc. Another source of danger as mentioned is the option of remembering the password which can be reflected using cookie based approach through non encrypted or weak encryption that might allow the attacker to understand the identifier used and generate similar one. 

Attack requirement: 

A. No or weak locking policy 

B. Verbos messages for false and valid login 

C. Storing password locally through weak identifier 

Attack process: 

A. For change and forgot password process is totally similar to brute force process 

B. As for the password remember option user should check for cookies and any stored non encrypted or weakly encrypted value or identifier by capturing and examining the sent request after activating remember me option using a tool Like Burp proxy. 

C. If the identifier can be easily generated, generate different identifiers and iteratively check if this will allow compromising other accounts using Burp to achieve that.  

Impersonation Functionality

In many cases, application implements an impersonation functionality in order to be able to control a user account by a privileged person in the organization.an example is the case of a bank customer account and an account supervisor where the supervisor has the privilege to access the customer account and execute tasks on his behalf. The main issue related to impersonation that the functionality is treated as hidden functionality with minimal control over access or as a back door that can be accessed through simple password.

Attack requirement: 

A. The impersonation functionality is using a back door or hidden functionality 

B. Minimal control on the access through that functionality (vulnerable to brute force or bad password)  

Attack process: 

Use the same process applied in brute force attack or bad password depending on the case 

Other issues

Other issues related password might be things like vulnerabilities caused by inefficient handling of errors in login process or multistage login. The storage of non-encrypted password values might also represent a serious problem which makes the usage of MD5 or SH1 necessary to eliminate such threat.

Attack analyzing

 Attack analyzing stage 

Benefiting enumerated information to specify the attack surface and going through a full feasibility study to decide if the resources including information and time required to execute the attack are in hand and serve the main attack purpose. 

Analyzing and understanding the meaning behind the collected information is essential to be able to move on to execution stage. The main purpose of analyzing stage is to:  

•  Specify attack surface: figuring what are possible scenarios to execute the attack and compromise the application
•  Specify the feasibility of each scenario from resource and time point of view 

Attack analyzing – Specify attack surface 

With lot of information attacker should know exactly where to begin from, the experience is essential in this level and can save lot of time. The number of attack points can be very big, so the following is a good practical check list to begin from to extract the attack scenarios list:

•  Client side validation: a fast and good place to begin from is specifying if the input validation is done on client, server or both sides.an easy entry might be related to a client side only input validation
• Search collected information for any sign of possible SQL injection, Database issue, root database account or any code or discovered comment that might give partial or full access to the database.
•  Available upload or download functionalities with path traversal vulnerability that give the ability to benefit relative path that use double dots ( ..\ ) to enable manipulation files or folders outside the root directory by manipulating the parameters. 
•  Check for ability to display user supplied data cross site scripting or possibility of injecting or storing a cross site scripting on uploading a file or open editors. 
• Check ability to use invalidated parameters pushed to pages that do redirects to check Invalidated Redirects and Forwards or dynamic redirects.
•  Login issues and possibility of using brute force attack: any hints found about passwords or comments about user name can be added to attack dictionary which might minimize effort and time needed to break in. 
•  Isolate available information that might help in escalate privileges like cookies and session state information. 
•  Using collected info try to identify non encrypted communication channels 
•  Identify interfaces to external system it might represent an information leakage point
• Analyze all generated error message for information leakage. 
•  Identify any pages that interact with mail server to try command or email injection 
•  Identify the usage of native code that might be a potential vulnerability for buffer over flow.
•  Identify any known structure , folder names , themes from known third party application which can open the door to search for known vulnerabilities
• Identify common vulnerability in the used web server.   

For web application security. You can benefit from many available tools to help to scan the application and give a good initial picture about the attack surface.

Attack analyzing – feasibility & priority 

At the end of this stage the attacker should have a list of possible attack scenarios with priority for each attack type. The resulted priority is guided by the complexity, purpose of attack and extra needed information. Attacker should create a list of possible attacks along with estimated requested resources then to specify priority.

Factors that affect prioritization can be related to the purpose or to needed resources. Attacker can use a prioritization table that reassemble to the following: 

Weights given to each factor might differ depending on the importance of each factor to the attacker but a rough estimation can be generated by average of factors estimated as percentage. 

   

Be the Attacker

To be able to have a full understanding of how the attack is taking place you need to put on the attacker hat and think like a one.

Time and place: Thinking of how, where when is important but actually it is not that relevant because attacker will try 24/7 from everywhere as anonymous servers and nodes are available all over the world are ready to be a hacking initiation point intentionally or accidently. An exception will be those application that are only available for a preset time or period.

As most of web application are opened to public all the time the initial scenario is the one that will stand but asking questions when an where can be beneficial because it will be helpful in most scenarios to minimize the access from nodes or areas that have a bad reputation in being a source of many attacks, the following figure represents a snapshot of the Norse Corp live threat map showing attack sources and targets in real time. 

What to target: everything…. all parts of the system should be potential subject to attack, web platform, application, backend, databases, web client, transport and last not least the availability because security is like a chain weak as its weakest part

Mindset: persistence, iterative approach is always fruitful. normally attackers are pushed by huge ego, powerful feelings and lot of energy.   

Attackers categories 

Researches by Christian S. Fötinger Wolfgang Ziegler showed that attackers have different categories depending on their motives and mindset:

A. Old School Hackers: computer programmers from known universities like Stanford or MIT interested in lines of code and analyzing systems, but what they do is not related to criminal activity as They don’t have a malicious intent.

B. Script Kiddies or Cyber-Punks: As an age group, they can be between 12 and 30 years old, and on average have a grade 12 education. Bored in school, very adept with computers and technology main intent is to vandalize or disrupt, like to brag about skills and achievement.

C. Professional Criminals, or Crackers: make a living breaking into systems and selling the information. They might get hired for corporate or government espionage 

D. Coders and Virus Writers: They like to see themselves as an elite. They have a lot of programming background and write code but won’t use it themselves they live that to others.