The Mobile Playbook: Dissecting iOS and Android Apps (Available as hybrid - in Person or online)
No ratings
Presented at DeepSec 2024 by
This two-day hands-on course teaches penetration testers and developers how to analyse Android and iOS applications for security vulnerabilities by going through the different phases of testing, including dynamic testing, static analysis and reverse engineering, using the OWASP Mobile Application Security Testing Guide (MASTG). The OWASP MASTG is a comprehensive and open source guide to mobile security testing for both iOS and Android, providing a methodology and very detailed technical test cases to ensure completeness and using the latest attack techniques against mobile applications. This course will give you hands-on experience with open source tools and advanced methodologies by guiding you through real-world scenarios. This course is delivered by one of the main authors of the MASTG. ## Description We'll start the first day with an introduction into the OWASP MASTG and Mobile AppSec Verification Standard (MASVS) and dive afterwards into the Android platform and its security architecture. > It is no longer mandatory for students to bring their own Android or iOS device, instead cloud-based virtualised devices will be provided to each student using Corellium. Topics include: - Reverse engineering a Kotlin app and identifying and exploiting a real-world deep link vulnerability through manual source code review. - Frida crash course to get started with dynamic instrumentation on Android apps - Intercepting network traffic from applications written in mobile application frameworks such as Google's Flutter - Bypass different implementations of SSL pinning using Frida - Explore the differences and effectiveness of reverse engineering Android apps using Smali patching and Dynamic Instrumentation with Frida - Analyse the local storage of an Android application - Use dynamic instrumentation with Frida to - Bypass multiple root detection mechanisms - Bypass Frida detection mechanisms Day 2 focuses on iOS, starting with an overview of the iOS platform and security architecture and we will begin to create an iOS test environment using Corellium and dive into several topics, including: - Statically scanning Swift source code, identifying vulnerabilities and eliminating false positives. - Intercepting network traffic and examining stateless authentication (JWT) in a mobile application - A Frida crash course to get started with dynamic instrumentation for iOS applications - Analysing data stored in the iOS application sandbox - Demonstration on how to test watchOS apps and it's limitations - Testing methodology with a non-jailbroken device by repackaging an IPA with the Frida gadget - Using Frida to bypass runtime instrumentation of iOS applications - Anti-Jailbreaking Mechanisms - Frida's detection mechanism At the end of each day there will be a Capture-the-Flag (CTF) to test two apps using the newly learned skills and you can win a prize! Whether you are a beginner who wants to learn mobile app testing from the ground up, or an experienced professional who wants to improve your existing skills to perform more advanced attack techniques, or just for fun, this training will help you achieve your goals. The course consists of many different labs developed by the instructor and is approximately 65% hands-on and 35% lecture. Upon successful completion of this course, students will have a better understanding of how to test for vulnerabilities in mobile applications, how to suggest the right mitigation techniques to developers, and how to perform tests consistently. ### What students will receive - Slide decks for the iOS and Android training and all videos for all demonstrations shared in class. - All vulnerable apps used during the training, either as APK or IPA. - Detailed write-ups for all labs so you can do them at your own pace after the course. - Dedicated Slack channel used to help students prepare before the course, communicate during the course and stay in touch after the course for any questions. - Certificate of completion. ### Prerequisites The following prerequisites need to be fulfilled by the student in order to be able to follow all exercises and fully participate: - Laptop (Windows/Linux/macOS) with at least 16 GB Ram and 50GB of free disk space - Full administrative access, in case of any issues with the laptop environment (e.g. being able to deactivate VPN) - Virtualization software (e.g. VMware, VirtualBox, UTM); a Virtual Machine will be provided (either X86 or ARM for M1/M2/M3 macBooks) with all tools needed for the training. An iOS and Android device is NOT needed, as an emulated instance will be provided for each student that is hosted in Corellium. This is a cloud-based environment that allows each student access to a jailbroken iOS device and rooted Android device during the training.