React Native Application
Uchambuzi wa Programu ya React Native
Ili kuthibitisha kama programu ilijengwa kwenye mfumo wa React Native, fuata hatua hizi:
Badilisha jina la faili la APK kwa kiambishi cha zip na uondoe kwenye folda mpya kwa kutumia amri
cp com.example.apk example-apk.zipnaunzip -qq example-apk.zip -d ReactNative.Tembea kwenye folda mpya iliyoundwa ya ReactNative na pata folda ya mali. Ndani ya folda hii, unapaswa kupata faili
index.android.bundle, ambayo ina JavaScript ya React katika muundo wa minified.Tumia amri
find . -print | grep -i ".bundle$"kutafuta faili la JavaScript.
Ili kuchambua zaidi msimbo wa JavaScript, tengeneza faili lililo na jina index.html katika saraka hiyo hiyo lenye msimbo ufuatao:
You can upload the file to https://spaceraccoon.github.io/webpack-exploder/ or follow these steps:
Fungua faili la
index.htmlkatika Google Chrome.Fungua Developer Toolbar kwa kubonyeza Command+Option+J kwa OS X au Control+Shift+J kwa Windows.
Bonyeza "Sources" katika Developer Toolbar. Unapaswa kuona faili la JavaScript ambalo limegawanywa katika folda na faili, likiunda bundle kuu.
If you find a file called index.android.bundle.map, you will be able to analyze the source code in an unminified format. Map files contain source mapping, which allows you to map minified identifiers.
To search for sensitive credentials and endpoints, follow these steps:
Tambua maneno muhimu nyeti ili kuchambua msimbo wa JavaScript. Programu za React Native mara nyingi hutumia huduma za watu wengine kama Firebase, AWS S3 service endpoints, funguo za kibinafsi, n.k.
Katika kesi hii maalum, programu ilionekana ikitumia huduma ya Dialogflow. Tafuta muundo unaohusiana na usanidi wake.
Ilikuwa na bahati kwamba akreditif nyeti zilizowekwa kwa mikono zilipatikana katika msimbo wa JavaScript wakati wa mchakato wa recon.
References
Last updated
