Tuesday, May 29, 2012

Setting up GoatDroid properly

GoatDroid is a vulnerable android application for mobile security enthusiasts to learn & practice. I used to face a lot of challenges using GoatDroid. Most of the times I had no clue as to what went wrong in my installation, which is giving me a particular error. This makes me write a blog documenting the correct steps for proper functioning of this application.

Most of the errors I got included "Something Weird Happened", "An unexpected error has occured", "Login Failed", "Unable to Register" and Blank/No error. So here are the steps to follow for a proper setup (ofcourse you will be using QuickStartGuide)-

  • Make sure your MySQL database is properly set, with Login Name as "goatboy", Password as "goatdroid" and Limit Connectivity to Hosts Matching "localhost". Also "goatboy" needs to have insert, delete, update, select on fourgoats database.
  • When you run the jar file first time, point the SDK Path to the SDK installation (....\android-sdk in Windows) and Virtual Devices Path to the avd directory (C:\Documents and Settings\<current-user>\.android\avd)
  • Once your application is well installed in the emulator, you need to get the "Destination Info" correct. You can use as the Destination IP with 8888 as the port number (Webservices is running on this port). Do not use Emulator considers as itself and as the host machine. This is explained in details here.
  • Register & Login, everything goes well now.
The above ones are those silly mistakes which result in the errors mentioned earlier. If these are done, properly you are set.

Now if anyone is not able to capture the traffic in a proxy, here are the steps-

Normally you set & port 8888 in "Destination Info" in emulator. But for setting the Burp Proxy v1.4.01, 
  • Run Burp Proxy on 7000 port, loopback should not be selected, "support invisible" should be enabled. Set the upstream proxy servers to host and port 8888.
  • Start the emulator with this command- emulator.exe -avd <name> -http-proxy
  • Set & port 7000 as "Destination Info" in the application running on emulator.
Ofcourse you can run Burp Proxy on your favorite port other that 8888, I preferred 7000.

Have Fun with Android and GoatDroid!