好的，用户让我帮忙总结一篇文章的内容，控制在100字以内，而且不需要特定的开头。首先，我需要仔细阅读用户提供的文章内容，了解主要讨论的内容。 文章主要讲的是Android备份漏洞，作者在进行移动应用渗透测试时经常遇到这类问题。他提到这个漏洞的影响，尤其是在应用存在不安全数据存储的情况下，备份文件可能被窃取，即使设备没有root权限。接着，他介绍了如何检查这个漏洞：查看AndroidManifest.xml文件中的android:allowBackup属性是否为true。然后是通过ADB工具备份应用数据，并使用ABE工具提取备份文件进行分析。 用户的需求是用中文总结这篇文章，并且控制在100字以内。所以我要抓住关键点：Android备份漏洞、如何检测（检查allowBackup）、利用方法（ADB备份和ABE提取）。同时要注意语言简洁明了。 现在我需要把这些要点整合成一段话，确保不超过100字。可能会这样写：“文章探讨了Android应用的备份漏洞问题，指出当应用允许备份且存在不安全数据存储时，攻击者可通过ADB工具获取内部文件。检测方法是查看AndroidManifest.xml中的allowBackup属性是否为true。” 这样既涵盖了问题、影响、检测方法和利用方式，又符合字数要求。 最后检查一下是否符合用户的所有要求：中文、100字以内、直接描述内容。看起来没问题。 </think> 文章探讨了Android应用的备份漏洞问题，指出当应用允许备份且存在不安全数据存储时，攻击者可通过ADB工具获取内部文件。检测方法是查看AndroidManifest.xml中的allowBackup属性是否为true。 2025-11-3 09:10:39 Author: infosecwriteups.com(查看原文) 阅读量:51 收藏
Summary
hello everyone today I will share about Android Backup Vulnerabilities, this is one of the findings that I often find when doing pentest on android applications, especially on mobile applications. I made this article because it was quite inspired by this blog, Now lets just go straight to the discussion.
Android Backup Vulnerabilities are vulnerabilities where an application allows backups for the application, this vulnerability will be very impactful if the same application has Insecure data storage vulnerabilities, because the application’s internal files can be stolen without root, even though the android device must turn on usb debugging
How to look for it?
Check the androidmanifest.xml file and highlight the android:allowBackup text, if android:allowBackup = "true" this means that the application is vulnerable to android backup vulnerabilities, and vice versa if the value is false, it means that the android application is not vulnerable to Android Backup Vulnerabilities, it's easy, right? okay, continue to the demo.
Unpack the app using jadx and then open the Androidmanifest.xml file, this file is usually found in Resource
Press enter or click to view image in full size
Using the adb (android debug brigde) tool, we try to backup the application folder with commands more or less like this, and don’t forget to connect the adb via usb or wireless.
adb backup -f <backup-name.ab> <app-package-name>
adb backup -f application com.app.info// Create Password
12345678
Press enter or click to view image in full size
Using ABE (Android Backup Extractor) convert .ab files to .tar so that they can be extracted, look like the picture below the internal application folder can be retrieved. When converting the abe tool, it will ask for the password that we created before
Press enter or click to view image in full size
Press enter or click to view image in full size
Refrence
如有侵权请联系:admin#unsafe.sh