Magnet CTF: Question 2 Solution Walk-Through

Challenge 2 (OCT 12-18) PIP Install: What domain was most recently viewed via an app that has picture-in-picture capability?

For the week 2 challenge, we’re using the same Android image we examined last week. From the question there’s two factors involved, application capability and application usage.

The first thing to understand is what applications on the device have PIP (Picture in Picture) capability.

Picture2

 

 

 

 

 

 

 

 

 

 

I reviewed the installed applications on the device looking for anything that could be PIP related. A screen recording application caught my attention (googled to understand capability), but this was not the ‘Droid (app) we’re looking for.

One of the Discord users shared this helpful link describing the capability and what applications featured PIP support.

How to enable & use Android Picture in Picture (PIP) Mode. List of apps supporting PIP mode

Back to the applications I tagged anything listed that showed up in the PIP article.

From here I proceeded to look at the Application Activity – Android.  One of the applications we can see recent activity for is Google Chrome. From the previously referenced article we know this app supports PIP.

Picture3

 

 

 

 

 

 

 

 

 

 

In the preview card we can see that it was captured that Chrome was used to visit a URL beginning with MallieSae.com. 

The artifact for this can be found at MUS_Android.tar\data\system_ce\0\snapshots\320.jpg

Answer: Google Chrome, an app that supports PIP, was recently used visit the domain malliesae.com

 

PDF: MagnetWeeklyCTF Write-Up 2.pdf

One thought on “Magnet CTF: Question 2 Solution Walk-Through

Leave a Reply

Fill in your details below or click an icon to log in:

WordPress.com Logo

You are commenting using your WordPress.com account. Log Out /  Change )

Google photo

You are commenting using your Google account. Log Out /  Change )

Twitter picture

You are commenting using your Twitter account. Log Out /  Change )

Facebook photo

You are commenting using your Facebook account. Log Out /  Change )

Connecting to %s

%d bloggers like this: