Mango

Starting a session

When starting mango you have the option to start a new session or continue an existing one. A session is nothing more than a SQLite db file which is used by Mango to save a batch of parsed APKs. Imagine for example that you are working on a malware family or a vulnerability pattern, then you can import APKs in to a db (we will see how) and perform useful queries among the analysed entries. That being said when you run mango, you have one of the following options:

If you already have been working on a session you can resume it by giving it as an argument to the mango script:

Mango will present you the already analysed APKs and ask you to choose one:

Enter the index of  application to load: 

Doing so, mango will present the following screen:

After this, mango will prompt you to connect to an existing mobile device in order to continue your session.

Importing an APK

There are two ways to import an APK in to the Mango's database. This is either by typing:

mango> import /full/path/to/foo.apk

Or you can pull one from the connected device and then import it:

mango> pull package_name

mango> import base.apk

After doing so, mango will parse the APK and add db entries for its activities, services, receivers, providers, deeplinks, intent filters, permissions and resource strings. Out of mango, you can open the session file using a SQLite editor:

Finally, you can load an APK which has already been analysed using the load command followed by the package name:

mango> load package_name

Important: you can always use the tab key after typing a command to see the available options

Working with application components

After loading an application mango will parse the AndroidManifest and create entries in your session db for the application's components. You can start exploring these components using the show command followed by one of the following options:

• activities, e.g. mango> show activities

Prints the application's activities in the following form:

You can filter for exported only activities by using the -e additional option. The activityAlias, services, receivers, providers, permissions, deeplinks and intentFilters work in exactly similar way.

• exposure, e.g. mango> show exposure

Prints the application's "attack surface", including deeplinks, exported activities, activity aliases, services, receivers and providers:

• info, e.g. mango> show info

Prints handy information about the loaded application:

• manifest, e.g. mango> show info

Prints the application's manifest

• strings, e.g. mango> show strings

Prints the application's string resources

• database, e.g. mango> show database

Prints the structure of the database file. The output can be used to construct raw sql queries (see query command).

• applications, e.g. mango> show applications

This option can be used to load a different application or manage the existing applications:

You can issue "raw" SQL queries to the db of your current session by typing query followed by the query body:

Important: mango as well as medusa supports the redirection of the output to another command using common pipes.

Example:

Interacting with application components

• You can force the currently loaded application to start an activity by typing start followed by tab or the full name of an activity:

• Similarly you can force the application to start a service by typing startsrv followed by tab or the full name of a service:

• To stop a service, type: stopsrv followed by tab or the full name of the service.

Note: The components don't have to be exported

• To trigger a deeplink, type deeplink followed by tab or the full uri of the deeplink:

• Additionally, you can kill or start an application by typing kill or spawn respectively followed by the application's name:

mango> kill com.example.package

Interacting with the device

Mango provides multiple commands that can help you to interact with a mobile device or emulator in multiple ways. What follows is a full list of the relative commands and their usage:

• You can install an application by using the mango> install /full/path/to/foo.ak or uninstall one by typing mango> uninstall [package name]
• To install a burp certificate, type installBurpCert and follow the steps indicated by mango
• To modify the device's proxy settings, type proxy followed by one of the following options:
  • get to print the current proxy configuration
  • set ip:port to set a proxy configuration. Adding -t (e.g. mango> proxy set -t 192.168.1.2:8080 will set a transparent proxy
  • reset will clear the device's proxy

Examples:

• To start an interactive adb session, type adb
• To start an interactive shell with busybox support type box and follow the given instructions:

• To get a package specific logcat, type logcat [package name]. You can also get the device's native logs by using nlog or the Java crash logs by using jlog:

• To get a screenshot, type screencap -o [filename.png]

• To run a shell command to the connected device, type: cc [command]:

• You can send a notification to the device by typing notify notification_title notification_body. The command requires the installation of the medusa agent which can be done by using the ìnstallagent command.

Patching an APK

• You can set the debuggable flag to true of a given APK by typing patch /full/path/to/foo.apk. This option requires the apksigner and zipalign to be installed in the device. If they aren't mango will download them locally and use them.

• Setting the debuggable flag can give you (among others) the option to dynamically debug an APK. You can do that by using the jdwp [package name] command or (out of mango) you can use Android studio or the latest jadx version.

• Finally, you can use the trace followed by one of the options below to start a frida-trace session:

• -j to trace all the functions of a java class. Example: trace -j com.myapp.name* // Trace all the functions of the com.myapp.name* class

• -n to trace a native function. Example: trace -n name*

• -a to trace the all the functions of a native library. Example trace -a libfoo.so