# API BFLA in Android

In this lab environment, you will get access to a Debian machine, which has all the required tools installed on it for this lab, along with an Android emulator. To start the Android emulator, run the "startemulator.sh" script present at "Desktop."

**Objective:** Identify and exploit a Broken Function Level Authorization (BFLA) vulnerability.

The following Android application can be useful:

* NovaTech.apk: Intentionally vulnerable Android application. (Pre-installed on the emulator).

The following credentials can be useful:

```
Username: alice
Password: pass
```

***

The frist thing we do is exec the android emulator and login with the credentials getting -->

<figure><img src="https://3697469405-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FSrcwXlKGkwhzbrKa8vLU%2Fuploads%2FvBKhucs8coptwHv1PcUy%2Fimage.png?alt=media&#x26;token=daabf388-133a-438b-b6aa-bbafe0d79a44" alt=""><figcaption></figcaption></figure>

We have logged into the user profile of "Alice," where we can view the associated user data and account details.

Click on the "Dashboard" button.

<figure><img src="https://3697469405-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FSrcwXlKGkwhzbrKa8vLU%2Fuploads%2Fp6bzDSKnIFx96kThyI6a%2Fimage.png?alt=media&#x26;token=fc76ec13-e2b7-407e-bc85-659b9191dd66" alt=""><figcaption></figcaption></figure>

We are presented with the user dashboard overview. Here we can see some more user details.

<figure><img src="https://3697469405-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FSrcwXlKGkwhzbrKa8vLU%2Fuploads%2F9W6yFX8LT49oh4fzs0ch%2Fimage.png?alt=media&#x26;token=7e9184bc-5e3b-46bf-b76b-64f64324727d" alt=""><figcaption></figcaption></figure>

Open a new terminal and check the system IP, and set the global HTTP proxy on the Android device to the system IP address.

```
## View us IP
ip addr
## Set Proxy with us IP
adb shell settings put global http_proxy <IP>:8080
```

Now, config the Burp Proxy

<figure><img src="https://3697469405-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FSrcwXlKGkwhzbrKa8vLU%2Fuploads%2FmJemKtvdnOmB1EPE7UFy%2Fimage.png?alt=media&#x26;token=2e4dbe16-c85b-4ac3-af8e-a092bb0c516d" alt="" width="563"><figcaption></figcaption></figure>

<figure><img src="https://3697469405-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FSrcwXlKGkwhzbrKa8vLU%2Fuploads%2F7LvHZFvhbpbu3OVYI7xO%2Fimage.png?alt=media&#x26;token=c4fd6335-3517-4573-bed6-1c8fa4462de2" alt=""><figcaption></figcaption></figure>

With it, we can see that the proxy its woking weel. So... Now intercept "Dashboard"peticions -->

<figure><img src="https://3697469405-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FSrcwXlKGkwhzbrKa8vLU%2Fuploads%2Fc68jREaCUKDbSUhJ6ER6%2Fimage.png?alt=media&#x26;token=4cfa9588-4d95-4f2b-bc37-9ab94ce18a8b" alt=""><figcaption></figcaption></figure>

We can manipulate the user\_id, and see information about others user (IDOR)

<figure><img src="https://3697469405-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FSrcwXlKGkwhzbrKa8vLU%2Fuploads%2FHxtuOr4HaeLljg05CmZG%2Fimage.png?alt=media&#x26;token=c2bb10f2-634f-4f12-a77f-9c581f8736c7" alt=""><figcaption></figcaption></figure>
