Android Hacking Tools

1) AnDOSid:

Information:

AnDOSid simulates a DOS attack on a web server.

Tutorial how-to:

1. Launch the app

2. Type the URL you want to run the DOS attack on

3. Set the payload size (the size of the data sent), and the time between sendings

4. Press 'Start'"

Requirements:

1. Android 1.5+

2. ***This app has a price of 1.50 USD***

♠ DroidSheep

Information:

DroidSheep is a one-click session hijacking using your Android smartphone or tablet. Session hijacking is when a 'session key' is stolen from over the air, and then planted in the attacker's web browser. The 'session key' is usually a special cookie given by the website so you don't have to keep typing in your password on a webpage refresh. The website grants you a 'session'. After the attacker gets the key, they have full access to the account. DroidSheep supports almost every website, including eBay, Facebook, Twitter, and LinkedIn.

Tutorial how-to:

1. Launch the app, and accept the disclaimer

2. Press 'Start'

3. Select the a session to begin hijacking

4. If there are no sessions, check/uncheck 'Generic Mode'

Requirements:

1. Android 2.1+

2. Root access

♠ DroidSniff

Information:

Almost an exact duplicate to DroidSheep, with a few UI changes.

Tutorial how-to:

1. Launch the app, and accept the disclaimer

2. Press 'Start'

3. Select the a session to begin hijacking

4. If there are no sessions, check/uncheck 'Generic Mode'

Requirements:

1. Android 2.1+

2. Root access

♠ DroidSQLi

Information:

DroidSQLi is the first automated MySQL Injection tool for Android. It allows you to test your MySQL-based web application against SQL injection attacks. It supports the following injection techniques: Time based injection, Blind injection, Error based injection, and Normal injection. It automatically selects the best technique to use and employs some simple filter evasion methods. Very easy to use.

Tutorial how-to:

1. Launch the app

2. Type in the URL of your target (a list of vulnerable websites can be found using the 'inurl:' command in Google. These are called Google Dorks. A compiled list can be found below)

Examples:

inurl:index.php?id=
inurl:gallery.php?id=
inurl:article.php?id=
inurl:pageid=)

3. Once you found a vulnerable website/database, press 'Inject' to launch the attack

4. DroidSQLi will give you database and server info

Warning: Use Orbot (found in the 'Anonymity' section of this app), and route DroidSQLithrough it.

Google Dorks:

https://www.dropbox.com/s/qdyvc0f564id8mw/All%20Google%20Dork%20List.txt

Requirements:

1. Android 1.5+

♠ dSploit

Information:
dSploit is an Android network analysis and penetration suite which aims to offer to IT security experts/geeks the most complete and advanced professional toolkit to perform network security assesments on a mobile device. Once dSploit is started, you will be able to easily map your network, fingerprint alive hosts operating systems and running services, search for known vulnerabilities, crack logon procedures of many tcp protocols, perform man in the middle attacks such as password sniffing (with common protocols dissection), real time traffic manipulation, etc, etc.
Tutorial how-to:
Session Hijacking:
1. Launch the app

2. Select the device you want to target

3. Scroll down to 'MITM'

4. Select 'Session Hijacker'

5. Select 'Start'

6. When a session pops up, select it to begin hijacking
Sniffing:
1. Launch the app

2. Select the device you want to target

3. Scroll down to 'MITM'

4. Select 'Simple Sniff'

5. Select 'Yes' to the popup

6. Select 'Start'

7. When enough data is collected, press 'Stop'

8. Now open up "Shark Reader" (found in the 'Mobile' section of this app)

9. Select the '.pcap' file you want to read
Requirements:
1. Android 2.3+

2. Root access

3. A full BusyBox install (can be found in the "Essentials" section of this app

4. Device must have an ARM CPU
♠   FaceNiff

Information:
FaceNiff is an Android app that allows you to sniff and intercept web session profiles over the WiFi that your mobile is connected to. Supported websites: Facebook, Twitter, Youtube, Amazon, VKontakte, Tumblr, MySpace, Tuenti, MeinVZ/StudiV, Zblogger, and Nasza-Klasa.
Tutorial how-to:
1. Launch the app, and press 'Start'

2. A list of sessions will appear, and select one to begin hijacking

3. SSL Strip: If the user is logged in without SSL then you could log in as them and logout, and they will be logged out too
Requirements:
1. Android 2.0+

2. Root access

3. ***The free version of this app allows only 3 hijacked profiles. Upgrade for more.***
♠   LOIC - Low Orbit Ion Cannon

Information:
LOIC is software used for flooding packets. It is used to carry out DOS attacks.
Tutorial how-to:
1. Launch the app

2. Type in the URL or IP address of your target

3. Press 'Lock On'

4. Select your desired 'Timeout', in milliseconds (or leave as default)

5. Select your desired 'Port', or leave as default (change if certain ports are blocked)

6. Select your 'Method' (Stick to TCP or UDP, as HTTP is detected easier by firewalls)
7. Select your desired 'Threads' amount (more threads is more effective, but also hogs CPU and bandwidth)
8. Select the 'Speed' by moving the slider
9. Press 'Fire' to launch the attack
Warning: LOIC reveals your IP address! Use Orbot (found in the 'Anonymity' section of this app), and route LOIC through it to hide your IP address.
Requirements:
1. Android 2.1+
♠  OFS - Mobile DoSer

Information:
OFS - Mobile DoSer is a tool used to carry out DOS attacks.
Tutorial how-to:
1. Launch the app

2. Type in the URL (without 'http' and/or trailing '/') or IP address of your target

3. Select the type of 'Server' your want to attack (PHP or Java server)

4. Select your desired 'Packet Size' (size of the data sent)
5. Select your desired 'Threads' amount (more threads is more effective, but also hogs CPU and bandwidth)
6. Press 'DoS not running' to launch the attack
Warning: Use Orbot (found in the 'Anonymity' section of this app), and route OFS through it.
Requirements:
1. Android 2.2+
♠  Shark

Information:
Shark is a traffic sniffer that works on 3G and WiFi. It can also be used with 3rd party apps, such as Network Spoofer.
Tutorial how-to:
1. Set up a Wifi hotspot on your phone (unlimited data recommended)

2. Wait for users to connect

3. Start Shark, and press 'Start' with the default parameters

4. After enough data is collected, click 'Stop'

5. Open the .pcap file in Shark Reader, and read the traffic by clicking on a section that is greater than 0, and without the word "NULL".
Requirements:
1. Android 1.6+

2. Root access
♠ Shark Reader

Information:
Shark Reader is an application for reading pcap files. Shark outputs the pcap to this app.
Tutorial how-to:
1. Run Shark.

2. When enough data is collected, select 'Open in Shark Reader'
Requirements:
1. Android 1.6+ 
♠  Slowloris

Information:
Slowloris is a tool for network and security professionals to simulate a Layer 7 HTTP denial of service attack. Features: multi-threaded; runs in the background; does both GET and POST requests.

Tutorial how-to:
1. Launch the app

2. Type in the URL (without 'http' and/or trailing '/') of your target

3. Select the type of attack (GET or POST requests)
6. Press 'Start' to launch the attack
Warning: Use Orbot (found in the 'Anonymity' section of this app), and route Slowloris through it.
Requirements:
1. Android 2.3.3+