Mobile Application Penetration Testing

Read it now on the O’Reilly learning platform with a 10-day free trial.

O’Reilly members get unlimited access to books, live events, courses curated by job role, and more from O’Reilly and nearly 200 top publishers.

Book description

Explore real-world threat scenarios, attacks on mobile applications, and ways to counter them

About This Book

• Gain insights into the current threat landscape of mobile applications in particular
• Explore the different options that are available on mobile platforms and prevent circumventions made by attackers
• This is a step-by-step guide to setting up your own mobile penetration testing environment

Who This Book Is For

If you are a mobile application evangelist, mobile application developer, information security practitioner, penetration tester on infrastructure web applications, an application security professional, or someone who wants to learn mobile application security as a career, then this book is for you. This book will provide you with all the skills you need to get started with Android and iOS pen-testing.

What You Will Learn

• Gain an in-depth understanding of Android and iOS architecture and the latest changes
• Discover how to work with different tool suites to assess any application
• Develop different strategies and techniques to connect to a mobile device
• Create a foundation for mobile application security principles
• Grasp techniques to attack different components of an Android device and the different functionalities of an iOS device
• Get to know secure development strategies for both iOS and Android applications
• Gain an understanding of threat modeling mobile applications
• Get an in-depth understanding of both Android and iOS implementation vulnerabilities and how to provide counter-measures while developing a mobile app

Mobile security has come a long way over the last few years. It has transitioned from "should it be done?" to "it must be done!"Alongside the growing number of devises and applications, there is also a growth in the volume of Personally identifiable information (PII), Financial Data, and much more. This data needs to be secured.

This is why Pen-testing is so important to modern application developers. You need to know how to secure user data, and find vulnerabilities and loopholes in your application that might lead to security breaches.

This book gives you the necessary skills to security test your mobile applications as a beginner, developer, or security practitioner. You'll start by discovering the internal components of an Android and an iOS application. Moving ahead, you'll understand the inter-process working of these applications. Then you'll set up a test environment for this application using various tools to identify the loopholes and vulnerabilities in the structure of the applications. Finally, after collecting all information about these security loop holes, we'll start securing our applications from these threats.

Style and approach

This is an easy-to-follow guide full of hands-on examples of real-world attack simulations. Each topic is explained in context with respect to testing, and for the more inquisitive, there are more details on the concepts and techniques used for different platforms.

Table of contents

1. Mobile Application Penetration Testing
   1. Table of Contents
   2. Mobile Application Penetration Testing
   3. Credits
   4. About the Author
   5. About the Reviewers
   6. www.PacktPub.com
      1. eBooks, discount offers, and more
         1. Why subscribe?
         1. What this book covers
         2. What you need for this book
         3. Who this book is for
         4. Conventions
         5. Reader feedback
         6. Customer support
            1. Downloading the color images of this book
            2. Errata
            3. Piracy
            4. Questions
            1. The smartphone market share
               1. The android operating system
               2. The iPhone operating system (iOS)
               1. Native apps
               2. Mobile web apps
               3. Hybrid apps
               1. Android vulnerabilities
               2. iOS vulnerabilities
               1. The impact of mobile application security
               2. The need for mobile application penetration testing
                  1. Current market reaction
                  1. Discovery
                  2. Analysis/assessment
                  3. Exploitation
                  4. Reporting
                  1. Vulnerable applications to practice
                  1. The importance of architecture
                  2. The Android architecture
                     1. The Linux kernel
                        1. Confusion between Linux and the Linux kernel
                        1. Zygote
                        1. Native Android or system apps
                        2. User-installed or custom apps
                        3. The Android software development kit
                        4. Android application packages (APK)
                           1. AndroidManifest.xml
                              1. The structure of the Android manifest file
                              1. Intent
                              2. Activity
                              3. Services
                                 1. Unbound or start services
                                 2. Bound service
                                 1. The Binder process
                                 1. Cocoa Touch
                                 2. Media
                                 3. Core services
                                 4. Core OS
                                 1. Objective-C
                                    1. The Objective-C runtime
                                    1. Device-level security
                                    2. System-level security
                                       1. An introduction to the secure boot chain
                                       2. System software authorization
                                       3. Secure Enclave
                                          1. Touch ID
                                          1. Data-protection classes
                                          2. Keychain data protection
                                          1. Network-level security
                                          2. Application-level security
                                             1. Application code signing
                                             1. Process isolation
                                             2. Filesystem isolation
                                             3. ASLR
                                             4. Stack protection (non-executable stack and heap)
                                             1. Why jailbreak a device?
                                             2. Types of jailbreaks
                                                1. Untethered jailbreaks
                                                2. Tethered jailbreaks
                                                3. Semi-tethered jailbreaks
                                                1. Inspecting a Mach-O binary
                                                1. Mobile app penetration testing environment setup
                                                2. Android Studio and SDK
                                                   1. The Android SDK
                                                   1. Connecting to the device
                                                   2. Getting access to the device
                                                   3. Installing an application to the device
                                                   4. Extracting files from the device
                                                   5. Storing files to the device
                                                   6. Stopping the service
                                                   7. Viewing the log information
                                                   8. Sideloading apps
                                                   9. Monkeyrunner
                                                   1. Creating an Android virtual emulator
                                                   2. Installing an application to the Genymotion emulator
                                                   3. Installing the vulnerable app to Genymotion
                                                   4. Installing the Genymotion plugin to Android Studio
                                                   5. ARM apps and Play Store in Genymotion
                                                   1. Setting up the proxy in Wi-Fi settings
                                                   2. Setting up the proxy on mobile carrier settings
                                                   1. Cydia
                                                      1. BigBoss tools
                                                      2. Darwins CC tools
                                                      3. iPA Installer
                                                      4. Tcpdump
                                                      5. iOS SSL kill-switch
                                                      6. Cycript, Clutch, and class-dump
                                                      1. iFunbox at glance
                                                      2. Accessing SSH without Wi-Fi
                                                      3. Accessing SSH with Wi-Fi
                                                      4. Installing DVIA to the device
                                                      5. Configuring the HTTP proxy in Apple devices
                                                      1. Simulators
                                                      2. Emulators
                                                         1. Pros
                                                         2. Cons
                                                         1. Pros
                                                         2. Cons
                                                         1. Android security tools
                                                            1. APKAnalyser
                                                            2. The drozer tool
                                                               1. Installing drozer on Genymotion
                                                               1. How to make apps debuggable?
                                                               1. Isn't Androguard only a malware analysis tool?
                                                               2. Androguard's androlyze shell environment
                                                               3. Automating the analysis of multiple files
                                                               1. Debugging
                                                               2. Attaching
                                                               3. Installing Burp CA certificate to the device
                                                               1. oTool
                                                               2. SSL Kill Switch
                                                               3. The keychain dumper
                                                               4. LLDB
                                                               5. Clutch
                                                               6. Class-dump-z
                                                               7. Instrumenting with Cycript
                                                               8. Instrumentation using Frida
                                                               9. Hopper
                                                               10. Snoop-it
                                                               11. Installing Burp CA certificate to an iOS device
                                                               1. Assets
                                                               2. Threats
                                                                  1. Threat agents
                                                                  1. Mobile application architecture
                                                                     1. Mobile applications and device data
                                                                     2. Identifying threat agents
                                                                     3. Modes of attacks
                                                                     4. Security controls
                                                                     1. The attacker view
                                                                     2. The device or system view
                                                                     3. Discovering potential threats
                                                                     1. STRIDE
                                                                     2. PASTA
                                                                     3. Trike
                                                                     1. Spoofing
                                                                     2. Tampering
                                                                     3. Repudiation
                                                                     4. Information disclosure
                                                                     5. Denial of service (DoS)
                                                                     6. Elevation of privilege
                                                                     1. Attack scenarios
                                                                     2. A sample attack tree for a stolen or missing device
                                                                     3. A list of free tools
                                                                     4. A commercial tool
                                                                     1. Business risk
                                                                     2. Technical risk
                                                                     1. Setting up the target app
                                                                        1. Backend server setup
                                                                        1. Attacking activities
                                                                        2. Attacking services
                                                                        3. Attacking broadcast receivers
                                                                        4. Attacking content providers
                                                                        1. SSL pinning
                                                                        1. Setting up the target
                                                                        2. Storage/archive analysis
                                                                           1. Plist files
                                                                           2. Client-side data stores
                                                                           3. The keychain data
                                                                           4. HTTP response caching
                                                                           1. Extracting the class information
                                                                           2. Strings
                                                                           3. Memory management
                                                                           4. Stack smashing protection
                                                                           1. OpenURL schemes
                                                                           1. The Bypass login method
                                                                           2. Sensitive information in the memory
                                                                           1. SQL injection
                                                                           2. UIWebView injections
                                                                           1. Beating the SSL cert pinning
                                                                           1. Pasteboard information leakage
                                                                           2. Keyboard logs
                                                                           3. App state preservation
                                                                           1. Secure by design
                                                                           2. Security mind map for developers (iOS and Android)
                                                                           3. Device level
                                                                              1. Platform (OS) level
                                                                                 1. Screenshots/snapshots
                                                                                 2. System caching and logs
                                                                                 3. Cut, copy, and paste
                                                                                 4. iOS cookie and keychains
                                                                                    1. BinaryCookies
                                                                                    2. Keychains
                                                                                    1. App storage protection
                                                                                       1. Property lists/shared preferences
                                                                                          1. Property lists in iOS
                                                                                          2. Shared preferences in Android
                                                                                          1. Backup settings
                                                                                          2. Disable debug
                                                                                          3. Use the latest API version
                                                                                          4. Securing Android components
                                                                                          5. Securing activities
                                                                                          6. Securing services
                                                                                          7. Securing content providers
                                                                                          8. Securing broadcast receivers
                                                                                          9. Verify exported components
                                                                                          1. iOS
                                                                                          2. Android
                                                                                          3. Key management
                                                                                          1. iOS
                                                                                          2. Android
                                                                                          1. Jailbreak detection
                                                                                             1. Filesystem-based detection
                                                                                             2. API-based detection
                                                                                             1. Command detection method
                                                                                             1. Stack-smashing protection
                                                                                             2. Runtime protection
                                                                                             1. Certificate pinning
                                                                                             2. Cipher suites
                                                                                             3. CFNetwork usage
                                                                                             4. Secure caching
                                                                                             1. Authentication
                                                                                             2. Authorization
                                                                                             3. Input/output validations
                                                                                             4. Injection flaws
                                                                                             5. Session management
                                                                                             6. Information leakage
                                                                                             1. Mobile app developers checklist
                                                                                             1. Android
                                                                                             2. iOS
                                                                                             3. Vendor-neutral advice
                                                                                             4. Developer cheat sheet
                                                                                             5. Developer policies
                                                                                             1. Keeping up to date
                                                                                             Show and hide more

                                                                                             Product information

                                                                                             • Title: Mobile Application Penetration Testing
                                                                                             • Author(s): Vijay Kumar Velu
                                                                                             • Release date: March 2016
                                                                                             • Publisher(s): Packt Publishing
                                                                                             • ISBN: 9781785883378