diff --git a/README.md b/README.md index 8f731a9..471b700 100644 --- a/README.md +++ b/README.md @@ -32,6 +32,7 @@ I tried to put as much vulnerabilities as possible in a short period of time. I 11. Access Control Issues – Part 3 12. Hardcoding Issues – Part 2 13. Input Validation Issues – Part 3 +14. Bluetooth Replay Issues ## Can I contribute? Yes, you can help by sending us the details of vulnerabilities that we can implement in future versions of Diva. Please send an email to info [at] payatu.com with subject “DIVA Contribution”. diff --git a/app/src/main/AndroidManifest.xml b/app/src/main/AndroidManifest.xml index b3d7e83..2d6597b 100644 --- a/app/src/main/AndroidManifest.xml +++ b/app/src/main/AndroidManifest.xml @@ -5,6 +5,7 @@ + + + diff --git a/app/src/main/ic_launcher-web.png b/app/src/main/ic_launcher-web.png new file mode 100644 index 0000000..65744b2 Binary files /dev/null and b/app/src/main/ic_launcher-web.png differ diff --git a/app/src/main/java/jakhar/aseem/diva/BluetoothReplayActivity.java b/app/src/main/java/jakhar/aseem/diva/BluetoothReplayActivity.java new file mode 100644 index 0000000..f6fc423 --- /dev/null +++ b/app/src/main/java/jakhar/aseem/diva/BluetoothReplayActivity.java @@ -0,0 +1,130 @@ +/* + * DIVA Android - Damn Insecure and Vulnerable App for Android + * + * Copyright 2017 © Payatu + * Author: Sudhakar Verma sudhakar[at]payatu[dot]com + * Websites: www.payatu.com www.nullcon.net www.hardwear.io www.null.co.in + * + * This program is free software: you can redistribute it and/or modify + * it under the terms of the GNU General Public License as published by + * the Free Software Foundation, either version 3 of the License, or + * (at your option) any later version. + * + * This program is distributed in the hope that it will be useful, + * but WITHOUT ANY WARRANTY; without even the implied warranty of + * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the + * GNU General Public License for more details. + * + * You should have received a copy of the GNU General Public License + * along with this program. If not, see . + * + * THIS SOFTWARE IS PROVIDED ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, + * BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A + * PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS + * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL + * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; + * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY + * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE + * OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE + * POSSIBILITY OF SUCH DAMAGE. + * + */ +package jakhar.aseem.diva; + +import java.io.IOException; +import java.io.OutputStream; +import java.util.Set; +import java.util.UUID; + +import android.os.Bundle; +import android.view.View; +import android.support.v7.app.AppCompatActivity; +import android.widget.RadioGroup; +import android.widget.Toast; +import android.content.Intent; +import android.bluetooth.BluetoothAdapter; +import android.bluetooth.BluetoothDevice; +import android.bluetooth.BluetoothSocket; + +public class BluetoothReplayActivity extends AppCompatActivity { + + BluetoothSocket mmSocket; + BluetoothDevice mmDevice = null; + + final class senderThread implements Runnable { + + private String btMsg; + + public senderThread(String msg) { + btMsg = msg; + } + + public void run() + { + sendBtMsg(btMsg); + } + + } + public void sendBtMsg(String message){ + UUID uuid = UUID.fromString("94f39d29-7d6d-437d-973b-fba39e49d4ee"); //Standard SerialPortService ID + try { + + mmSocket = mmDevice.createRfcommSocketToServiceRecord(uuid); + if (!mmSocket.isConnected()){ + mmSocket.connect(); + } + + String msg = message; + OutputStream mmOutputStream = mmSocket.getOutputStream(); + mmOutputStream.write(msg.getBytes()); + + } catch (IOException e) { + e.printStackTrace(); + } + + } + + @Override + protected void onCreate(Bundle savedInstanceState) { + super.onCreate(savedInstanceState); + setContentView(R.layout.activity_bluetooth_replay); + BluetoothAdapter mBluetoothAdapter = BluetoothAdapter.getDefaultAdapter(); + + if(!mBluetoothAdapter.isEnabled()) + { + Intent enableBluetooth = new Intent(BluetoothAdapter.ACTION_REQUEST_ENABLE); + startActivityForResult(enableBluetooth, 0); + } + + Set pairedDevices = mBluetoothAdapter.getBondedDevices(); + boolean found_diva = false; + if(pairedDevices.size() > 0) + { + for(BluetoothDevice device : pairedDevices) + { + if(device.getName().equals("diva")) + { + found_diva = true; + Toast.makeText(this, "Found diva", Toast.LENGTH_SHORT).show(); + mmDevice = device; + break; + } + } + } + if(!found_diva){ + Toast.makeText(this, "Pair with diva first", Toast.LENGTH_SHORT).show(); + } + } + + public void doIt(View view){ + RadioGroup radioGroup = (RadioGroup) findViewById(R.id.brgroup); + int selectedId = radioGroup.getCheckedRadioButtonId(); + if (selectedId == R.id.br_on){ + (new Thread(new senderThread("ON+17"))).start(); + } + else{ + (new Thread(new senderThread("OFF+17"))).start(); + } + Toast.makeText(this, "Done!!", Toast.LENGTH_SHORT).show(); + } +} diff --git a/app/src/main/java/jakhar/aseem/diva/MainActivity.java b/app/src/main/java/jakhar/aseem/diva/MainActivity.java index 4feea22..d43de35 100644 --- a/app/src/main/java/jakhar/aseem/diva/MainActivity.java +++ b/app/src/main/java/jakhar/aseem/diva/MainActivity.java @@ -128,5 +128,9 @@ else if (view == findViewById(R.id.d13button)) { Intent i = new Intent(this, InputValidation3Activity.class); startActivity(i); } + else if (view == findViewById(R.id.d14button)) { + Intent i = new Intent(this, BluetoothReplayActivity.class); + startActivity(i); + } } } diff --git a/app/src/main/res/layout/activity_bluetooth_replay.xml b/app/src/main/res/layout/activity_bluetooth_replay.xml new file mode 100644 index 0000000..11b4f57 --- /dev/null +++ b/app/src/main/res/layout/activity_bluetooth_replay.xml @@ -0,0 +1,55 @@ + + + + + + + + + + + +