Mirrors/hacktricks
2
0
Fork 0
mirror of https://github.com/carlospolop/hacktricks synced 2024-11-22 12:43:23 +00:00
Code Issues Projects Releases Packages Wiki Activity
hacktricks/mobile-pentesting/android-app-pentesting/react-native-application.md
Carlos Polop a2ca955cb9 a
2024-02-09 01:36:13 +01:00

4.4 KiB
Raw Blame History

Learn AWS hacking from zero to hero with htARTE (HackTricks AWS Red Team Expert)!

Other ways to support HackTricks:

React Native Application Analysis

To confirm if the application was built on the React Native framework, follow these steps:

  1. Rename the APK file with a zip extension and extract it to a new folder using the command cp com.example.apk example-apk.zip and unzip -qq example-apk.zip -d ReactNative.

  2. Navigate to the newly created ReactNative folder and locate the assets folder. Inside this folder, you should find the file index.android.bundle, which contains the React JavaScript in a minified format.

  3. Use the command find . -print | grep -i ".bundle$" to search for the JavaScript file.

To further analyze the JavaScript code, create a file named index.html in the same directory with the following code:

<script src="./index.android.bundle"></script>

You can upload the file to https://spaceraccoon.github.io/webpack-exploder/ or follow these steps:

  1. Open the index.html file in Google Chrome.

  2. Open the Developer Toolbar by pressing Command+Option+J for OS X or Control+Shift+J for Windows.

  3. Click on "Sources" in the Developer Toolbar. You should see a JavaScript file that is split into folders and files, making up the main bundle.

If you find a file called index.android.bundle.map, you will be able to analyze the source code in an unminified format. Map files contain source mapping, which allows you to map minified identifiers.

To search for sensitive credentials and endpoints, follow these steps:

  1. Identify sensitive keywords to analyze the JavaScript code. React Native applications often use third-party services like Firebase, AWS S3 service endpoints, private keys, etc.

  2. In this specific case, the application was observed to be using the Dialogflow service. Search for a pattern related to its configuration.

  3. It was fortunate that sensitive hard-coded credentials were found in the JavaScript code during the recon process.

References

Learn AWS hacking from zero to hero with htARTE (HackTricks AWS Red Team Expert)!

Other ways to support HackTricks: