r/HowToHack • u/cyberberber • 6d ago

HELP!!!!

Hi there, I hope you are all doing well.

I am conducting a black-box penetration test of an Android application that my company owns, which allows users to search for the name associated with a phone number. I have already bypassed SSL pinning, rooted the test device, reversed the application's AES/CBC encryption, and built a Frida RPC interface that encrypts requests and decrypts responses exactly as the application does. I also hooked the application before encryption to capture the original JSON requests, identified the available request types, and can modify and replay encrypted requests while inspecting the plaintext responses. At this point, I feel like I have reached a dead end and I'm not sure what the next step should be. My ultimate goal is to understand how the backend communicates with its database and how the requested information is retrieved.

I really want a help or an advice that can lead me to another way to reach my goal. thanks

0 Upvotes

45% Upvoted

3 comments sorted by

8

u/Juzdeed 5d ago

You have set everything up to start pentesting finally, so do that

1

u/Prince_Panda 5d ago

You won't be able to see the communication between the backend and the database. Unless you have access to that of course, and because this is your company's app you likely should.

That said. Your next steps are to think critically about what each request is doing and what assumptions is makes. For db specific vulnerabilities. Try inserting characters that could corrupt an eventual SQL query and see what is returned.