Case study two – automating test cases to find security issues

During an audit, we noticed that all mobile applications developed by a specific team used a list of common secrets and hardcoded values in the code. As it was also a black box penetration test, we did not have any source code but had a list of 10+ Android applications to test. We wanted to find out how many of these applications have the same secrets and hardcoded accounts inside the application code. One way of doing this could have been by manually extracting strings from each of these application binaries and then searching for them. But we automated this part a little bit by following these steps:

1. Extracting all dex files from the APKs, using the unzip utility
2. Running strings on all dex files and saving the result in different text files
3. Grepping through all the text files containing strings to search for our specific strings

A simple script to automate this would look like this:

...