Assume you could exploit a vulnerability on an old Android 2.2, the questions are:

1- Is there anyway you could see stored passwords on that operating system, specially Facebook password.

2- Can you send a message on behalf of the Facebook user from that device from the command line ? Or in other word how you can send a message on behalf of the user.

I need this as part of my research for social network bots and I appreciate any help.

  • 3
    If you have root can do whatever the hell you want. – rook Oct 29 '14 at 5:34

If you have a rooted device , and if any application stores password in clear text in their database , then yes , you can view them if you have root access. About sending messages as a different user ,it depends on how that particular app works . Lets consider that FB USES A DB for maintaining all the messages which needs to be sync'ed once the device is online. Since you have root access , you can make ur own entry in that particular table and messenger would happily sync it once the phone is online. All this is possible if the database of the application is not encrypted, if not , you will have to find out the encryption key and then replace the database after making the necessary modifications. To find the encryption key , you can reverse engineer the application or use run-time hooking methods , like the once offered by cydia substrate to do your bidding .

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.