JADX Tutorial Demonstrates Recovering Credentials from an Insecure Android App

Summary

The tutorial uses ADB shell access and JADX to inspect a deliberately insecure Android banking app, showing how a Base64-encoded username and AES-CBC-encrypted password can be recovered from app preferences when the key and IV are exposed.

Key points

• The demonstration connects to an Android device over Wi-Fi with ADB and opens a root shell.
• The presenter locates the demo app’s stored login values in its shared preferences.
• JADX is used to decompile the APK and inspect its login and cryptography code.
• The username is Base64-encoded, while the password uses AES-256-CBC with a key in the app and an all-zero initialization vector.
• Using the values found in the app and its code, the presenter recovers the demo credentials and logs into the app.