search

t0thkr1s / allsafe

Intentionally vulnerable Android application.
https://medium.com/infosec-adventures
Apache License 2.0
196 stars 68 forks source link

Environment.DIRECTORY_DOWNLOADS #2

Open cTFk1ller opened 1 year ago

cTFk1ller commented 1 year ago

Hello Developer, 

I found an issue: the returned path of this line code shouldn't be true. _File file = new File(Environment.DIRECTORY_DOWNLOADS + "/allsafe_updater.apk"); should return this path  /Download/allsafe_updater.apk_ and the download directory does not exist and can't even be created.

It should be written this way: _File file = new File("/sdcard/" + Environment.DIRECTORY_DOWNLOADS + "/allsafe_updater.apk");_

Tested ..

cTFk1ller commented 1 year ago

function invokeUpdate() in ArbitraryCodeExecution class won't work on real device, do you know why !?