Basic hack

[Neurotoxin]

I'm about to attempt to launch a brute force attack on a few accounts for a game I play, simply trying to see if I can get it to work. I'm a noob.


The game is rage of bahamut for android.


I've decided to use an emulator to locate the log in server better....




however...how the hell do I figure out what the log in server is? lmao


Does someone know of a program that allows for connections to be monitored with details such as the ip address and ports? Also, whats the best brute force dictionary you have on file?

[Kulverstukas]

Debugging the app won't help seeing where it connects. It's not how a debugger works.
You have to disassemble the code and see where the link is hardcoded into the app.

To monitor the traffic, you should be familiar with Wireshark and have a rooted android phone. Then you can install "Shark for root" and log the traffic, then use Wireshark or "Shark reader" for android to analyze the log.

TBH all this is not worth the shit you're doing, specially when you don't know anything about what I just explained.

Also "log in the server" is not a clear description of what do you want, but assuming you mean the logs the creator keeps on the server, you cannot access them without breaking into the server in the first place.
If you want to change something in an online game, only thing to accomplish something is to tamper with the traffic, which AFAIK cannot be done with android alone.

[Neurotoxin]

Sorry I just couldn't explain what I meant. I don't want the logs on the server, simply the address in order to correctly address my brute force. lol. I have the cannon but no target.


and yes I understood exactly what you said haha I just didn't have a starting point before that. Thank you


It also seems that you mistook what I meant...I'm using a pc emulator and the android apk to serve as my tools. Not limited to a phone at all. I brought this into the phone messaging board to better understand the method of pulling the information and for some reason I didn't think about the possibility of checking the .apk. Thank you though, you shed light on a lot!

[Kulverstukas]

No, I understood everything you said. But to use those tools you need a rooted device, and emulators cannot be rooted, therefore you need a phone to use those tools.

If the URL is what you want, then taking the APK apart should uncover the link if it was hardcoded. It can be either in the Java code, or the XML file. You will need 2 different tools (google them) to convert Java bytecode and XML Android bytecode into readable format.

But why do you want to bruteforce into the server? I don't understand the logic, why would bruteforce do anything beneficial? The link you will most likely get is the game API link where it sends scores and shit (if that's the case, I don't know the game you are speaking of). So bruteforce attack mode is not what you want. You need to analyze what gets sent there and what do you get as a reply and to do that, you need stuff I described in my first post.

Good luck with this though, I'm not sure how far will you get...

[Simba]

I guess he is on windows.
Get some advanced traffic monitoring tool, to see where app calls, what it passes and what receives.

I believe he wants to break into another user's accounts by brute-forcing tokens or passwords.

[Kulverstukas]

Called APKTool it can reverse engineer APKs

Actually to fully translate the applet, you need 2 tools. APKTool only translates the Java bytecode.
Another tool called "dex2jar" is great for translating XML bytecode.

Also APKTook can be found on Google code as well: http://code.google.com/p/android-apktool/

@Simba: Your said method would not work like that for android apps, because android does not send traffic through your computer.
I suppose skiddy tools like "Cain&Abel" would work, but I'm not sure if it will capture this kind of packets.

[vektor]

Virtuous Ten Studio is a nice all-in-one type of software which would be quite suitable for n00bs accustomed to gui's i.e Windows users, and it's really quite powerful as well since it uses all the popular android reverse tools as a backend...apktool, dex2jar, smali/baksmali, adb, etc., etc.

http://www.virtuous-ten-studio.com/

[techb]

Virtuous Ten Studio is a nice all-in-one type of software which would be quite suitable for n00bs accustomed to gui's i.e Windows users, and it's really quite powerful as well since it uses all the popular android reverse tools as a backend...apktool, dex2jar, smali/baksmali, adb, etc., etc.

http://www.virtuous-ten-studio.com/

This thread is old and OP seems to be a one time poster, I would suggest posting your find in a separate thread.

/