# LAB -  Sensitive Information Leakage

In this lab environment, you will have GUI access to a Debian machine. An application named **HeyDoc** is available on the Android Emulator.

**Objective:** Identify sensitive information leaked by the HeyDoc app by intercepting and analyzing network requests using Burp Suite.

**Note:** Allow the app to make and manage phone calls by granting the required permission when prompted.

The valid credentials for **HeyDoc** app are as follows:

* **Username:** alice
* **Password:** Bazinga@12345#

> **Note:** You can start the emulator using the script located on the Desktop. Additionally, check the **Tools** directory located on the Desktop for available tools.

***

Frist, ejecute the APK and see that que APP make and manage the Phone Calls, after accept, we have in front of us a login panel, and insert the credentials  to log in-->

<figure><img src="https://3697469405-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FSrcwXlKGkwhzbrKa8vLU%2Fuploads%2F5NJsggdc7QjRQz7To8RB%2Fimage.png?alt=media&#x26;token=fbeaa932-8e7a-427f-914a-12a45dc105f0" alt=""><figcaption></figcaption></figure>

<figure><img src="https://3697469405-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FSrcwXlKGkwhzbrKa8vLU%2Fuploads%2FaJYr40RpWZhc3N2vr0tR%2Fimage.png?alt=media&#x26;token=d7b153a6-1e58-44d6-9c8f-573ff4d1f1d5" alt=""><figcaption></figcaption></figure>

With it, configure the Burp Porixy and navagete into the APK to intercep all peticions -->

<figure><img src="https://3697469405-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FSrcwXlKGkwhzbrKa8vLU%2Fuploads%2FyBgCGLJqxPgQKH4Ugutg%2Fimage.png?alt=media&#x26;token=678a5057-850b-41b7-bec3-2b789d6b470b" alt=""><figcaption></figcaption></figure>

Now, or configure the Wifi proxy same as burp of do it about command line -->

```
adb shell settings put global http_proxy <host-ip>:8080
```

<figure><img src="https://3697469405-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FSrcwXlKGkwhzbrKa8vLU%2Fuploads%2FHq45JcieLtLGtTdS7XuD%2Fimage.png?alt=media&#x26;token=63de24f9-5301-4af6-9959-87d2cfd392db" alt=""><figcaption></figcaption></figure>

With it made, navegate on the APK -->

<figure><img src="https://3697469405-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FSrcwXlKGkwhzbrKa8vLU%2Fuploads%2FacKgifpp7UnDzjVhgm5Z%2Fimage.png?alt=media&#x26;token=d34303a4-1b25-478b-b26e-ba158c1d6457" alt=""><figcaption></figcaption></figure>

<figure><img src="https://3697469405-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FSrcwXlKGkwhzbrKa8vLU%2Fuploads%2FoAnhs0EJRkc33l00BYoM%2Fimage.png?alt=media&#x26;token=66cf610e-221b-4c6e-b8a8-134a43690e6f" alt=""><figcaption></figcaption></figure>

1. `Authorization: Bearer token_101_20250602080848`: This header typically includes an access token prefixed with "Bearer", which is used to authenticate the request.
2. `_ygs: SU1FST0zNTgyNDAwNTExMTExMTA7VXNlcm5hbWU9YWxpY2U=`: This appears to be a base64 encoded data

So, decode Base64 the \_ygs paraphers -->

```
echo "SU1FST0zNTgyNDAwNTExMTExMTA7VXNlcm5hbWU9YWxpY2U=" | base64 --decode
```

<figure><img src="https://3697469405-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FSrcwXlKGkwhzbrKa8vLU%2Fuploads%2FzVuJBBlSOVuf3MOkSiIv%2Fimage.png?alt=media&#x26;token=318d4410-0839-4169-9bbe-5297b41364d1" alt=""><figcaption></figcaption></figure>

We have found that an **IMEI number** and the **logged-in username** are being sent with the request in an inconspicuous parameter within the request header.
