You can get the IP address of a person whom you are calling through telegram. Though this was not a new bug, this bug has been there since 2018, and Telegram declared this is a feature, not a bug

Recently Whatsapp introduced a new feature, Protect My IP during Whatsapp calls. Maybe Meta worried about the same as Telegram used to Leak IP address during an audio call

I have been aware of this bug since then but never tried it. I was a web developer, and after being involved in WebRTC projects, I am aware of how these real-time communication applications work. Of course, I have developed some real-time chatting applications using ReactJs and Nodejs

Most of the Chatting, real-time communication applications use WebRTC, WebSockets where WebRTC focuses on Audio, Video Transmission and Websockets on general data transfer

While these connections work on peer-to-peer, a server is still needed. Once the connection is established between two clients, then there is no need for a server. The clients can transfer the data without a server

After reading the recent article by Techcrunch on Telegram still leaking the IP addresses of its users, I found it interesting and thought it could be possible; I have also tried the script by n0a. I have tested the script on Linux as well as Windows, but it doesn't seem to be working for me (But it does the same for Whatsapp too), so I used Wireshark to demonstrate this again

Requirements:

• Telegram Desktop application
• Wireshark

What is Wireshark?

Wireshark is a Network monitoring troubleshooting software. It is free and open source, used by IT professionals and Hackers to analyze the network packets.

Also Read: Capture Android Traffic Remotely With Wireshark

How to get the IP address of a Telegram User by Making an audio call

Make sure Wireshark and Telegram for Desktop are installed on your system. It doesn't matter Windows or Linux. I have used the Windows system

Firstly, Open Wireshark and choose the network. In my case, I was connected to my wifi, and I will be choosing the wifi. If you are connected to your ethernet,   then you should choose that

After that, open Telegram  Desktop, call any of your friends and wait till they accept the call. After accepting the call, you can end the call and Open Wireshark to see the logs.

In the search bar, filter the protocol by stun. You can search stun  and search for the message XOR-MAPPED-ADDRESS

Image2

You will get the IP address of the other person. This is how you can use that IP address to geo-locate the Person.

Note:
Telegram allows Peer-to-peer calls. If this option is enabled, then only this will work. Otherwise, the call will be relayed through Telegram servers.

How to prevent This?

Go to Telegram Settings, Privacy calls Disable Peer to Peer.

In WhatsApp To access this setting:

Tap Settings, then Privacy.

Tap Advanced.

Turn Protect IP address in calls on or off.

In this blog post will discuss everything you need to know as an Android app penetration tester. Whether you are a Bug bounty hunter, a working cyber security professional, or a random security researcher, this blog will surely benefit you.

I will simplify everything in this tutorial so that you do not struggle while setting up your Android Pentesting lab.  I wish no one should face the same issues which I faced earlier. That's why I put my hard work here to give you a clear picture so you can start quickly.

Having a developer background, I Know how to build Android Mobile applications using Java, Kotlin, Flutter, and React Native. I am also good at Building web applications, having good knowledge of frontend and backend, along with OWASP knowledge for Both Web and Android apps. I will share my knowledge through this blog.

Without wasting your valuable time, let me tell you the resources and tools you should have before jumping into Android app pentesting. Also, there are some frequently asked questions you have to know.

Frequently Asked Questions

Setting up Android App Pentesting Environment

Note:
If you try to Run Android Emulators inside Virtual machines, then it won't work. When I was new to Android pen testing, I used to do the same but later realised and Switched all my tools to my Primary machine.

Android app pentesting tools

Burp Suite

apktool

apktool, a tool for android app reverse engineering. We will use this tool to decompile android apps, modify some code and recompile

install apktool

apkleaks

apkleaks a tool for automatic scanning for secret keys, URLs, IP addresses, API endpoints etc

install apkleask

Python

We need Python to use dynamic hooking tools like Frida.

Download Python

Frida

Frida tool/script is used for dynamic hooking so that we can test the application at the run time, overriding the functions, 

You have to install the Frida server on your android emulator, and the Frida client on your machine

Frida on the local machine

if  Python is installed on your local PC, then you can install frida by typing the following in a terminal

pip install frida-tools

you can check if frida is installed or not by typing

frida --version

Alternatively, you can use npm to install frida binaries. As a pentester, I hope everyone is familiar with Python 

Frida server on Android Emulator

This is the frida server; you must download the frida server file according to your emulator's architecture.

Download Frida Server

After downloading the zip file, unzip it, and use adb shell to connect your android emulator

then go to the directory  /data/local/tmp

push the frida-server there

adb push frida-server /data/local/tmp

Now 

adb shell 

then

cd tmp

since it is already an executable file, if not then you can make it executable by giving the permissions

chmod 777 frida-server

run the server

./frida-server

soon we will discuss how to use frida in depth

Objection

objection is a runtime exploitation toolkit based on frida

You can install objection by typing the below command in a terminal

pip3 install objection

Objection on GitHub

How to intercept Android app traffic in Burp Suite

In this section, we will set up the Burp suite to intercept the android app's traffic. Note that if you choose an android emulator for android version 6, it is easy to install the burp suite's CA certificate. You can still install burp CA on android 7 and above.

Configure Burp Suite Proxy

Open Burp Suite

Go to the Proxy tab, then Options, then Click on Add.

Make these settings and bind to port 8080 (You can choose any)

And tick on All Interfaces and save

Configure Proxy settings on Android 

Now its time to configure the proxy on your Android; before that, we will find our local machine's IP and configure that IP on your Android Emulator's Wifi Proxy

To Find the IP address on your Local Machine

Open any terminal and type: 

ipconfig

 (or ifconfig for Linux)

Now Open Android Emulator's Wifi settings, and you will notice that the device is connected to a network, now long click or right-click on the network, and then you will see the options, click on Modify Network.

Now click Advanced, and configure the IP address and port.

Note:
For some emulators, there is another way to achieve this. In the emulator's settings, you will find the settings to change the proxy settings of the device

Configure CA certificate on up to Android 6

Now we have to configure a CA certificate 

Open any Browser, visit htttp://burp

and download the file, rename the file cacert.der to cacert.cer

Now open Settings, then Security, then Install from SD Card.

Now Choose the file, and you are asked to enter a name for the certificate. You can give any name and then click Ok.

Now you are ready to intercept the traffic of your android emulator. Now open Burp suite, and you will see the traffic in the proxy section.

Installing CA cert on Android devices above Android 6

on android version 7, you  need root access to install the CA certificate on your device, 

if you are on Windows, then you need gitbash or WSL to continue

Download OpenSSL Installer for Windows

Steps to Proceed

Export the CA cert from Burp, and save the file as cacert.der

then type the commands

openssl x509 -inform DER -in cacert.der -out cacert.pem

We will use openssl to convert the der file to pem, generate a self-signed certificate, then move the file to Emulator's and install it.

openssl x509 -inform PEM -subject_hash_old -in cacert.pem | head -1

You will get a hash. Now you have to rename the perm file with this hash.0

mv cacert.pem 9a5ba575.0 

Now move the file to the android emulator's sdcard

It requires root to move the certificate to /system/etc/security/cacerts

For that, we will log in to adb as the root

adb root

then

adb remount 

now open adb shell, goto sdcard

cd sdcard 

Now move the file to  /system/etc/security/cacerts

mv 9a5ba575.0 /system/etc/security/cacerts/

Now, In the device Settings, Security, Encryption, and Trusted Credentials, you will see PortSwigger's CA certificate.

Conclusion

Android application penetration testing is a broader topic and cannot be covered in a single blog post, and we have to discuss many android pentesting frameworks. We will be publishing several blog posts to cover all of them.

In this article, I will share the best bug bounty tools I personally use as a Bug bounty hunter.

Of course, hundreds of tools exist for Professional pentesting or Bug bounty. Maybe you might be familiar with the tools,

as Bug bounty hunters, we are always curious to test new tools that save our maximum time and give the best results

Best bug bounty tools

Subdomain Enumeration

Httpx for checking live domains

Browser Extensions

Wappalyzer

WhatRuns

Shodan

Cookie Editor

Radom user agent

Web Proxies

Burp suite

Port Scanning

Nmap

Naabu

Smap

Shodan

Automated Tools

Nuclei

Sqlmap

Wpscan

Fuzzers

Dirsearch

ffuf

Dirbuster

WAF Detection

Most of the targets are protected by some kind of  Web application firewalls. We have to detect the WAF and bypass it for maximum impact, 

Here are the tools I use for WAF detection

wafw00f

WhatWaf

Others

Conclusion:

Hello guys. In this tutorial, we will be discussing how to use the L3MON Rat. If you are entirely new to this RAT, then follow this tutorial carefully so that you should not face any issues while using the L3MON Rat.

Before getting into the tutorial, here are a few things you have to know

What is L3MON?

L3MON vs Xploitspy?

Why not XploitSpy?

L3MON mod by Techncyber

What is L3MON?

L3MON vs Xploitspy

What's Wrong with L3mon and Xploitspy?

L3mon Mod by Techncyber

Install L3mon-mod in Kali Linux, Windows, Termux

Installing in Windows

Today In this post, I will be sharing a unique writeup on SQL injection with Authorization Headers token.

A little bit intro to Authorization Tokens,

=> An Authorization token is generated and signed by the servers and is used to verify the users by unique tokens. 

=> After the successful login, the server sends an authorization token, and web developers often store it in the browser's local storage or session storage. 

=> Modern Websites use JWT(JSON Web Tokens) for User Authorization. It doesn't mean that each Authorization token is JWT. It depends on the backend and the Framework that the website uses,

Without wasting time, let's jump into the story

I am not a regular Bug Bounty hunter. You can say I am a seasonal Bug bounty hunter. I was bored and tried to search for some private bug bounty programs through google dorks, And Randomly selected a program for hunting. I did not do basic recon like Subdomain enumeration or any Dorking as I started with the main target.

For me, it was a typical day. I just fired up the Burp suite and opened the target site. as per the company policy, I am unwilling to reveal the target.

With the help of the Wappalyzer Plugin, I have noticed that the target runs on PHP. For me, PHP is vulnerable by nature. As a Web developer, I have plenty of experience building websites in PHP and fixing vulnerabilities.

While attacking targets, I have a practice of directory brute-forcing and checking the robots.txt file at the initial stage of my recon process.

I used Dirsearch to find the hidden directories, but no luck. I did not get anything fishy other than the admin page.

I tried Opening the admin page by visiting target/admin/

But No Luck it throws an error 403 Forbidden

I did not give up too quickly, again tried to Fuzz inside the admin page using Dirsearch. This time events page got 200 responses.

Without any delay, I have opened the page target/admin/events/ 

I have noticed that the page is a regular login page, where it has two ways to log in, one for the author and another for the super admin

Exploitation Starts here