> For the complete documentation index, see [llms.txt](https://docs.talsec.app/appsec-articles/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.talsec.app/appsec-articles/articles/how-to-hack-and-protect-flutter-apps-simple-and-actionable-guide-pt.-1-3.md).
# How to Hack & Protect Flutter Apps — Simple and Actionable Guide (Pt. 1/3)
*Either you want to hack Flutter apps, or you want to make them bulletproof. I will show you how it’s done. My name is Tomáš Soukal, and I am a security consultant at Talsec. This guide is unique in its focus on Flutter apps, so you don’t have to read through iOS or Android-only specific hacks over and over again.*
### Together we will:
*Part 1 (this article) ↓*
* **Disassemble app.**
* **Extract its secrets.**
*Part 2 (*[*link*](/appsec-articles/articles/how-to-hack-and-protect-flutter-apps-owasp-mas-and-rasp.-pt.-2-3.md)*) ↓*
* Make a fake clone.
* Check every transmitted JSON.
* Inject code.
*Part 3 (*[*link*](/appsec-articles/articles/how-to-hack-and-protect-flutter-apps-steal-firebase-auth-token-and-attack-the-api.-pt.-3-3.md)*) ↓*
* Steal authentication tokens.
* and attack the API.
After reading this short guide, you will know how to hack and how to protect against mobile threats.
*Disclaimer: Don’t do this to anyone with ill intent, as this is legit hacking. Use this only for learning purposes.*
## The BetterVission In-App Payments Theft
Back in the day, I had an opportunity to [interview a friend](https://medium.com/@talsec/5-things-john-learned-fighting-hackers-of-his-app-a-must-read-for-pms-and-ciso-s-463379b49410) of mine whose app was hacked. He created a popular app called BetterVision for the blind and visually impaired. There was a good reason for the over 100K installations John’s creation has achieved. BetterVision provided a ground-breaking feature. It could turn a phone’s camera into a powerful assistant easing a daily routine for disabled users worldwide. With success, however, soon came difficulties. John’s app suffered a cloning attack, and his In-App purchases got stolen. Profits are now four times smaller because of cracked versions being still available. The attacker replaced In-App payments code with his payment gate!
“They stole our apps by reverse engineering and republished.” Hacking and protection go hand in hand. I have seen dozens of questions on StackOverflow about mobile application security. Some people ask for remediation only after their app is hacked, and others take security in mind from the start. I collected a few of those posts:
Let’s examine what do hackers use.
## Hacker’s Shopping List
These are key tools you should know about. Hacking is a time-restricted activity. With proper tooling you will be able to dive deep into app’s internals in a no time. Time is money.
### Hacknig tools I like to use:
* [**Magisk** ](https://github.com/topjohnwu/Magisk)or **su** allows you to modify app’s internal files
* [**Frida**](https://frida.re/) gives me a relatively simple way to sniff into the app’s process during its run. I can modify return values and inspect processed data
* [**ApkTool**](https://ibotpeaches.github.io/Apktool/) can disassemble app, and then I can modify the app and assemble it again
* [**Mobile Security Framework (MobSF)**](https://github.com/MobSF/Mobile-Security-Framework-MobSF) is Swiss knife with many analysis, reconnaissance, and disassembling tools. (must have!)
* [**Lucky Patcher**](https://www.luckypatchers.com/) can repackage and mitigate common protections directly on device
* [**Runtime Mobile Security**](https://github.com/m0bilesecurity/RMS-Runtime-Mobile-Security) is IDE for Frida with many useful scripts and monitors
* [**Ghidra**](https://ghidra-sre.org/) **or IDA PRO** can create a readable code from app’s binary libs and modify the assembler
* [**reFlutter**](https://github.com/Impact-I/reFlutter) is the first Flutter-oriented reverse engineering tool necessary for MiTM attacks and binary inspection
* [**BurpSuite**](https://portswigger.net/burp)**'s Interceptor** mode to capture app’s network requests (typically JSON’s and raw data)
It’s nice to have a [rooted emulator](https://guptashubham.com/blog/lab-setup-for-android-pentesting-on-android-emulator-m1-macbook) with a feature-rich [Total Commander](https://www.ghisler.ch/board/viewtopic.php?t=76644\&sid=dc144c960fc0f820de6747bb84400f0b) file manager and [Termux](https://termux.dev/en/) terminal on board.
### MobSF Shout-out
MobSF is an automated, all-in-one mobile application (Android/iOS) pen-testing, malware analysis and security assessment framework capable of performing static and dynamic analysis. Run these three commands to install it, drag’n’drop any Flutter APK and watch the magic happen:
***Note**: don’t run random code found on the Internet. Check the original source and verify it’s safe to run.*
```
git clone https://github.com/MobSF/Mobile-Security-Framework-MobSF.git
cd Mobile-Security-Framework-MobSF
./setup.sh
```
Alternatively, you can run it in Docker or check this online [mobsf.live](https://mobsf.live/) site (be careful, scan results are public!)
MobSF can do compliance checks, search for secrets, embedded URLs and find common issues automatically. It can also help you to uncover vulnerable modules (3rd party libs) and unsecured entrypoints (receivers, deep links).
## Extract App’s Stored Data
Let’s proceed with some exciting stuff. I always imagine app’s stored data as a chest full of precious gold. Once the app lands on your rooted device (or enable Developer Settings), you can freely inspects it’s embedded data and assets. You will find databases, access tokens, API keys, bearer tokens, media assets, Shared Preferences. Shared Preferences files are particularly interesting as they are often misused to store sensitive data like login credentials.
Let’t check this example. I created demo app using standard [`shared_preferences`](https://pub.dev/packages/shared_preferences) plugin. The app just increases the counter with value preserved in the Shared Preferences.
Let’s open Total Commander.
In the Total Commander, I can see the XML file with this preference:
Here it is:
I can even modify this value and the app will immediately update (thanks, Flutter) the value in the UI! I hope you are at least a little worried about sensitive data in your shared preferences now. Before I will show you more (in the next part), let’s discuss the rooting issue.
*FYI, Talsec provides technologies like Secure Storage or Obfuscation to make attacker’s life harder ;)!*
## There is a root in the shadows
Some developers refuse to believe there are vulnerable mobile systems (in 2022). They are convinced that the Android/iOS sandboxing model and security practices are decent nowadays. They may be wrong.
Privileged access rights escalation breaching system security model is still possible in many scenarios. Check these vulnerable systems:
* Device or emulator can be rooted on purpose
* App may be jeopardized by a 3rd party dependency
* New OS exploits may be discovered / OS may be unpatched
* HW exploits
Have you heard about Dirty Cow, Log4j, and Janus vulnerabilities?
## Common Attacks and Solutions
I promised this guide to be actionable, so here is the table of most common attacks and possible remediations. The rooting attack which can help attacker to steal sensitive data (and more) can be prevented by usage of the right anti-root or RASP solution (premium: [Talsec RASP](https://www.talsec.app/flutter-security), free: [freeRASP](https://pub.dev/packages/freerasp), basic: [flutter\_jailbreak\_detection](https://pub.dev/packages/flutter_jailbreak_detection)). You will see more attacks in action in the next part :)
Subscribe Talsec and maybe try to crack-open some Flutter app in the meantime!
*written by Tomáš Soukal, Security Consultant at Talsec*
---
# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.
## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.
Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:
```
GET https://docs.talsec.app/appsec-articles/articles/how-to-hack-and-protect-flutter-apps-simple-and-actionable-guide-pt.-1-3.md?ask=&goal=
```
`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.
Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.