# Android-Exploits A collection of android Exploits and guide on android exploitation ``` root@n3x7:~$ ls -l drwxr-xr-x dos - Denial Of Service exploits drwxr-xr-x local - Local Exploits drwxr-xr-x remote - remote exploits drwxr-xr-x webapps - webapp exploits ``` ## Usage and Where to start Clone me :)
`git clone https://github.com/sundaysec/Android-Exploits.git`

Recommend you grab [exploitpack](http://exploitpack.com) latest version

`wget https://github.com/juansacco/exploitpack/archive/master.zip`

Extract then Navigate into the folder and type:

`java -jar ExploitPack.jar`

Load the exploits

*Learn and hack*

## OWASP Top 10 Mobile Risks 1. Insecure Data Storage 2. Weak Server Side Controls 3. Insufficient Transport Layer Protection 4. Client Side Injection 5. Poor Authorization and Authentication 6. Improper Session Handling 7. Security Decisions Via Untrusted Inputs 8. Side Channel Data Leakage 9. Broken Cryptography 10. Sensitive Information Disclosure ``` ───────▀▄───▄▀──────── ──────▄█▀███▀█▄─────── ─────█▀███████▀█────── ─────█─█▀▀▀▀▀█─█────── ────────▀▀─▀▀───────── -->> exploit ``` ### Common Tools(In mobile Exploits) * SSH * VNC server * A compiler (gcc / agcc) * Android SDK (adb!) * XCode * Jailbroken iDevice * Rooted Android Device ## Android Hacking Tools #### Mobile Apps (Hack On Android) * [AndroRat](https://github.com/wszf/androrat) - Android Remote Administrative Tool * [cspoilt](http://www.csploit.org) - A tool that enumerates local hosts, finds vulnerabilities and their exploits, cracks Wi-Fi password, installs backdoors blablabla!!! * [Hackode](https://play.google.com/store/apps/details?id=com.techfond.hackode&hl=en) - All In One Android Pentest Tool * [zANTI](https://www.zimperium.com/zanti-mobile-penetration-testing) - Network mapping, port discovery, sniffing, packet manipulation, DoS, MITM blablabla!! * [FaceNiff](http://faceniff.ponury.net/) - Intercept and sniff WiFi network traffic for Social Media packets * [Droidsheep](http://droidsheep.downloadxapp.com/) - Android application that analyzes security in wireless networks and also captures Twitter, Linked, Facebook, and other accounts * [USB Cleaver](https://forum.xda-developers.com/showthread.php?t=1656497) - Silently recover information from a target Windows 2000 or higher computer, including password hashes, LSA secrets, IP information * [Shark]() - Network Packate analysis tool * [DroidBox](https://github.com/pjlantz/droidbox) - Dynamic analysis of Android apps * [Wi-Fi Kill](https://wifikillapk.com/) - Disable other Users from WiFi Access ## Books and Articles * [A survey of Android exploits in the wild](https://www.researchgate.net/profile/Huasong_Meng/publication/323635885_A_survey_of_Android_exploits_in_the_wild/links/5b308982a6fdcc8506cb92a7/A-survey-of-Android-exploits-in-the-wild.pdf?origin=publication_detail) - The Android operating system Exploitation Survey * [Popular Android Exploits](http://gauss.ececs.uc.edu/Courses/c653/lectures/PDF/security.pdf) - Introduction to Android Exploits. * [Own your Android! Yet Another Universal Root](https://www.blackhat.com/docs/us-15/materials/us-15-Xu-Ah-Universal-Android-Rooting-Is-Back-wp.pdf) - Android root exploitation * [ASDC12-Smart_Bombs_Mobile_Vulnerability_and_Exploitation](https://www.owasp.org/images/9/95/ASDC12-Smart_Bombs_Mobile_Vulnerability_and_Exploitation.pdf) - Mobile Vulnerability Exploitation * [BlueBorne - Android Exploit](https://go.armis.com/hubfs/BlueBorne%20-%20Android%20Exploit.pdf) - Exploiting an RCE Over the Air * [EVOLUTION OF ANDROID EXPLOITS](https://www.virusbulletin.com/uploads/pdf/conference_slides/2014/SzalayChandraiah-VB2014.pdf) - Evolution of Android exploits from a statistical analysis tool perspective * [Hacking Androids for Fun and for Profit](https://conference.hitb.org/hitbsecconf2011kul/materials/D1T1%20-%20Riley%20Hassell%20-%20Exploiting%20Androids%20for%20Fun%20and%20Profit.pdf) - Android Exploitation Creative Commons License
This work is licensed under a Creative Commons Attribution 4.0 International License.