# LAB - Insecure Network Transmission

In this lab environment, you will have GUI access to a Debian machine. The **InsecureBankv2** application is available on the Android Emulator.

**Objective:** Intercept the app traffic with Burp Suite to capture sensitive credentials transmitted in plaintext.

The valid credentials for InsecureBankv2 are as follows:

* **Username:** jack
* **Password:** Jack\@123$

> **Note:** You can start the emulator using the script located on the Desktop. Additionally, check the **/root/Tools** directory for available tools.

***

### Tools

The best tools for this lab are:

* Burp Suite

***

Frist excute the emulator with `./emulator`, then the app and it request us credentials -->

<figure><img src="/files/uvIozhWoHihEDpfDWcFC" alt=""><figcaption></figcaption></figure>

> This application relies on a back-end server to function properly

To start the back-end server, run the following command:

```bash
## Wake up a server with python tool
cd /root/Tools/AndroLabServer
python2.7 app.py
```

<figure><img src="/files/0rWx8iVIdvgntcVfBl3N" alt=""><figcaption></figcaption></figure>

Then, into the app go to the "Preferences" settings -->

<figure><img src="/files/u95GzrsmaraqYn1ePukb" alt=""><figcaption></figcaption></figure>

Enter the IP address of the host machine where the back-end server is running, then click **Submit**

> **Note:** (use the `ifconfig` command to find the IP address). Use the device’s on-screen keyboard to enter your input.

<figure><img src="/files/DUt7CUbZCW5xOmziK6FZ" alt=""><figcaption></figcaption></figure>

Now, try to log in and if all configurations are good, we can see the user and password in text plain, try (test:test)

<figure><img src="/files/vtOOkJ457xEt0v1ZUeZU" alt=""><figcaption></figcaption></figure>

### BurpSuite Configuration

So... now, we can try to intercept all trafict with burp -->

<figure><img src="/files/q0salyA31vR7Zin7bC5E" alt=""><figcaption></figcaption></figure>

Here, we need remplace the localhost ip (127.0.0.1) to us IP -->

<figure><img src="/files/iK0MbluZk7zs33cyUFIG" alt=""><figcaption></figcaption></figure>

Now, we need to add a proxy on the Android device. Open **Settings** and click on **Network & internet**.

<figure><img src="/files/tqaFVlhKYSNomrCP8Cxd" alt=""><figcaption></figcaption></figure>

<figure><img src="/files/gaCAO6XTD7ZSeXp5VN1l" alt=""><figcaption></figcaption></figure>

<figure><img src="/files/KBo8Mw17BfnKOO7oqUMC" alt=""><figcaption></figcaption></figure>

<figure><img src="/files/zlNQzY4KJgUTsTYzmHLB" alt=""><figcaption></figcaption></figure>

<figure><img src="/files/osBJY0nkr6RCR29GnLuD" alt=""><figcaption></figcaption></figure>

<figure><img src="/files/lRsFQvfAgRoW0wc8NjjR" alt=""><figcaption></figcaption></figure>

<figure><img src="/files/kGBn6DvAvIu0zYreoWN6" alt=""><figcaption></figcaption></figure>

Now, turn on the **Intercept** in Burp and navegate/login -->

<figure><img src="/files/fIRRoYjzLJUL80GU4yD6" alt=""><figcaption></figcaption></figure>


---

# Agent Instructions: Querying This Documentation

If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter:

```
GET https://eldeim.gitbook.io/brain_fuck/notes/certifications/eastereggs/ine-emapt/owasp-mobile-top-10-vulnerabilities/lab-insecure-network-transmission.md?ask=<question>
```

The question should be specific, self-contained, and written in natural language.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.