- Reverse Engineering and Static Analysis
- Dynamic and Runtime Analysis
- Network Analysis and Server Side Testing
- Bypassing Root Detection and SSL Pinning
- Security Libraries
- Access Filesystem on iDevice
- Reverse Engineering and Static Analysis
- Dynamic and Runtime Analysis
- Network Analysis and Server Side Testing
- Bypassing Root Detection and SSL Pinning
- Security Libraries
Mobile Application Security Testing Distributions
- Appie - A portable software package for Android Pentesting and an awesome alternative to existing Virtual machines.
- Android Tamer - Android Tamer is a Virtual / Live Platform for Android Security professionals.
- Androl4b - A Virtual Machine For Assessing Android applications, Reverse Engineering and Malware Analysis
- Vezir Project - Mobile Application Pentesting and Malware Analysis Environment.
- Mobexler - Mobexler is a customised virtual machine, designed to help in penetration testing of Android & iOS applications.
All-in-One Mobile Security Frameworks
- Mobile Security Framework - MobSF - Mobile Security Framework is an intelligent, all-in-one open source mobile application (Android/iOS) automated pen-testing framework capable of performing static and dynamic analysis.
- python manage.py runserver 127.0.0.1:1337
Android Application Penetration Testing
Reverse Engineering and Static Analysis
- APKTool - A tool for reverse engineering 3rd party, closed, binary Android apps. It can decode resources to nearly original form and rebuild them after making some modifications.
- Disassembling Android apk file
- apktool d
- apktool b
- keytool -genkey -v -keystore keys/test.keystore -alias Test -keyalg RSA -keysize 1024 -sigalg SHA1withRSA -validity 10000
- jarsigner -keystore keys/test.keystore dist/test.apk -sigalg SHA1withRSA -digestalg SHA1 Test
- Deoptimize boot classes (The output will be in "odex" and "dex" folders)
- java -jar oat2dex.jar boot
- java -jar oat2dex.jar
- Get odex from oat
- java -jar oat2dex.jar odex
- java -jar oat2dex.jar smali
- simplify.jar -i "input smali files or folder" -o
- adb backup
- dd if=backup.ab bs=1 skip=24 | python -c "import zlib,sys;sys.stdout.write(zlib.decompress(sys.stdin.read()))" > backup.tar
Dynamic and Runtime Analysis
- Cydia Substrate - Cydia Substrate for Android enables developers to make changes to existing software with Substrate extensions that are injected in to the target process's memory.
- Xposed Framework - Xposed framework enables you to modify the system or application aspect and behaviour at runtime, without modifying any Android application package(APK) or re-flashing.
- PID Cat - An update to Jeff Sharkey's excellent logcat color script which only shows log entries for processes from a specific application package.
- Inspeckage - Inspeckage is a tool developed to offer dynamic analysis of Android applications. By applying hooks to functions of the Android API, Inspeckage will help you understand what an Android application is doing at runtime.
- Frida - The toolkit works using a client-server model and lets you inject in to running processes not just on Android, but also on iOS, Windows and Mac.
- Diff-GUI - A Web framework to start instrumenting with the avaliable modules, hooking on native, inject JavaScript using Frida.
- Fridump - Fridump is using the Frida framework to dump accessible memory addresses from any platform supported. It can be used from a Windows, Linux or Mac OS X system to dump the memory of an iOS, Android or Windows application.
- House - A runtime mobile application analysis toolkit with a Web GUI, powered by Frida, is designed for helping assess mobile applications by implementing dynamic function hooking and intercepting and intended to make Frida script writing as simple as possible.
- AndBug - AndBug is a debugger targeting the Android platform's Dalvik virtual machine intended for reverse engineers and developers.
- Identifying application process using adb shell
- adb shell ps | grep -i "App keyword"
- andbug shell -p
- ct
- adb forward tcp: jdwp:
- jdb -attach localhost:
- Starting a session
- adb forward tcp:31415 tcp:31415
- drozer console connect
- run app.package.list -f
- run app.package.info -a
- run app.package.attacksurface
- run app.activity.info -a -u
- run app.activity.start --component
- Exploiting Content Provider
- run app.provider.info -a
- run scanner.provider.finduris -a
- run app.provider.query
- run app.provider.update --selection
- run scanner.provider.sqltables -a
- run scanner.provider.injection -a
- run scanner.provider.traversal -a
- run app.broadcast.info -a
- run app.broadcast.send --component --extra
- run app.broadcast.sniff --action
- run app.service.info -a
- run app.service.start --action --component
- run app.service.send --msg --extra --bundle-as-obj
Network Analysis and Server Side Testing
- Tcpdump - A command line packet capture utility.
- Wireshark - An open-source packet analyzer.
- Live packet captures in real time
- adb shell "tcpdump -s 0 -w - | nc -l -p 4444"
- adb forward tcp:4444 tcp:4444
- nc localhost 4444 | sudo wireshark -k -S -i –
- Installing trusted CA at the Android OS level (Root device/Emulator) for Android N+ as the following:
- openssl x509 -inform PEM -subject_hash -in BurpCA.pem | head -1
- cat BurpCA.pem > 9a5ba580.0
- openssl x509 -inform PEM -text -in BurpCA.pem -out /dev/null >> 9a5ba580.0
- adb root
- abd remount
- adb push 9a5ba580.0 /system/etc/security/cacerts/
- adb shell “chmod 644 /system/etc/security/cacerts/9a5ba580.0”
- adb shell “reboot”
- Check Settings > Security > Trusted Credentials > SYSTEM to confirm your newly added CA is listed.
Bypassing Root Detection and SSL Pinning
- Magisk - Magisk suites provide root access to your device, capability to modify read-only partitions by installing modules and hide Magisk from root detections/system integrity checks.
- Xposed Module: Just Trust Me - Xposed Module to bypass SSL certificate pinning.
- Xposed Module: SSLUnpinning - Android Xposed Module to bypass SSL certificate validation (Certificate Pinning).
- Cydia Substrate Module: Android SSL Trust Killer - Blackbox tool to bypass SSL certificate pinning for most applications running on a device.
- Cydia Substrate Module: RootCoak Plus - Patch root checking for commonly known indications of root.
- Android-ssl-bypass - an Android debugging tool that can be used for bypassing SSL, even when certificate pinning is implemented, as well as other debugging tasks. The tool runs as an interactive console.
- Apk-mitm - A CLI application that automatically prepares Android APK files for HTTPS inspection
- Frida CodeShare - The Frida CodeShare project is comprised of developers from around the world working together with one goal - push Frida to its limits in new and innovative ways.
- Bypassing Root Detection
- frida --codeshare dzonerzy/fridantiroot -f YOUR_BINARY
- frida --codeshare pcipolloni/universal-android-ssl-pinning-bypass-with-frida -f YOUR_BINARY
Security Libraries
- PublicKey Pinning - Pinning in Android can be accomplished through a custom X509TrustManager. X509TrustManager should perform the customary X509 checks in addition to performing the pinning configuration.
- Android Pinning - A standalone library project for certificate pinning on Android.
- Java AES Crypto - A simple Android class for encrypting & decrypting strings, aiming to avoid the classic mistakes that most such classes suffer from.
- Proguard - ProGuard is a free Java class file shrinker, optimizer, obfuscator, and preverifier. It detects and removes unused classes, fields, methods, and attributes.
- SQL Cipher - SQLCipher is an open source extension to SQLite that provides transparent 256-bit AES encryption of database files.
- Secure Preferences - Android Shared preference wrapper than encrypts the keys and values of Shared Preferences.
- Trusted Intents - Library for flexible trusted interactions between Android apps.
- RootBeer - A tasty root checker library and sample app.
- End-to-end encryption - Capillary is a library to simplify the sending of end-to-end encrypted push messages from Java-based application servers to Android clients.
iOS Application Penetration Testing
Access Filesystem on iDevice
- FileZilla - It supports FTP, SFTP, and FTPS (FTP over SSL/TLS).
- Cyberduck - Libre FTP, SFTP, WebDAV, S3, Azure & OpenStack Swift browser for Mac and Windows.
- itunnel - Use to forward SSH via USB.
- iProxy - Let's you connect your laptop to the iPhone to surf the web.
- iFunbox - The File and App Management Tool for iPhone, iPad & iPod Touch.
Reverse Engineering and Static Analysis
- otool - The otool command displays specified parts of object files or libraries.
- Clutch - Decrypted the application and dump specified bundleID into binary or .ipa file.
- Dumpdecrypted - Dumps decrypted mach-o files from encrypted iPhone applications from memory to disk. This tool is necessary for security researchers to be able to look under the hood of encryption.
- iPod:~ root# DYLD_INSERT_LIBRARIES=dumpdecrypted.dylib /var/mobile/Applications/xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx/Scan.app/Scan
- iPod:~ root# cycript -p Skype weak_classdump.cy; cycript -p Skype
- #cy weak_classdump_bundle([NSBundle mainBundle],"/tmp/Skype")
- A Simple Test
- bash bfinject -P Reddit -L test
- bash bfinject -P Reddit -L decrypt
- bash bfinject -P Reddit -L cycript
Dynamic and Runtime Analysis
- cycript - Cycript allows developers to explore and modify running applications on either iOS or Mac OS X using a hybrid of Objective-C++ and JavaScript syntax through an interactive console that features syntax highlighting and tab completion.
- Show currently visible view controller
- cy# UIApp.keyWindow.rootViewController.visibleViewController
- cy# UIApp.keyWindow.rootViewController.topViewController
- cy# choose(UIViewController)
- cy# [[UIApp keyWindow] _autolayoutTrace].toString()
- cy# [[[UIApp keyWindow] rootViewController] _printHierarchy].toString()
- cy# classname.messages or cy# function printMethods(className, isa) < var count = new new Type("I"); var classObj = (isa != undefined) ? objc_getClass(className)->isa : objc_getClass(className); var methods = class_copyMethodList(classObj, count); var methodsArray = []; for(var i = 0; i < *count; i++) < var method = methods[i]; methodsArray.push(); > free(methods); return methodsArray; >
- cy# printMethods("")
- cy# a=#0x15d0db80
- cy# *a or
- cy# function tryPrintIvars(a)< var x=<>; for(i in *a) < try< x[i] = (*a)[i]; >catch(e)<> > return x; >
- cy# a=#0x15d0db80
- cy# tryPrintIvars(a)
- cy# [a pinCode]
- cy# [a setPinCode: @"1234"] or cy# a.setPinCode= @"1234"
- cy# [a isValidPin]
- cy# .prototype.isValidPin = function()
- cy# [Pin isValidPin]
- cy# Pin.contructor.prototype.['isValidPin'] = function()
Network Analysis and Server Side Testing
- Mallory - A Man in The Middle Tool (MiTM) that use to monitor and manipulate traffic on mobile devices and applications.
- Burp Suite - Burp Suite is an integrated platform for performing security testing of applications.
- OWASP ZAP - OWASP Zed Attack Proxy Project is an open-source web application security scanner. It is intended to be used by both those new to application security as well as professional penetration testers.
- Charles Proxy - HTTP proxy / HTTP monitor / Reverse Proxy that enables a developer to view all of the HTTP and SSL / HTTPS traffic between their machine and the Internet.
Bypassing Root Detection and SSL Pinning
- SSL Kill Switch 2 - Blackbox tool to disable SSL certificate validation - including certificate pinning - within iOS and OS X Apps.
- iOS TrustMe - Disable certificate trust checks on iOS devices.
- tsProtector - Another tool for bypassing Jailbreak detection.
- JailProtect - Apart from bypassing jailbreak detection, it also allows you to spoof your iOS firmware version easily.
- Shadow - Shadow is a tweak to bypass jailbreak detection that defeats basic detection methods used by many App Store apps.
- Frida CodeShare - The Frida CodeShare project is comprised of developers from around the world working together with one goal - push Frida to its limits in new and innovative ways.
- Bypassing SSL Pinning
- frida --codeshare lichao890427/ios-ssl-bypass -f YOUR_BINARY
- frida --codeshare dki/ios10-ssl-bypass -f YOUR_BINARY
Security Libraries
- PublicKey Pinning - iOS pinning is performed through a NSURLConnectionDelegate. The delegate must implement connection:canAuthenticateAgainstProtectionSpace: and connection:didReceiveAuthenticationChallenge:. Within connection:didReceiveAuthenticationChallenge:, the delegate must call SecTrustEvaluate to perform customary X509 checks.
- Swiftshield - SwiftShield is a tool that generates irreversible, encrypted names for your iOS project's objects (including your Pods and Storyboards) in order to protect your app from tools that reverse engineer iOS apps, like class-dump and Cycript.
- IOSSecuritySuite - iOS Security Suite is an advanced and easy-to-use platform security & anti-tampering library written in pure Swift! If you are developing for iOS and you want to protect your app according to the OWASP MASVS standard, chapter v8, then this library could save you a lot of time.
- OWASP iMAS - iMAS is a collaborative research project from the MITRE Corporation focused on open source iOS security controls.
Mobile Penetration Testing Lab
- WaTF Bank - What-a-Terrible-Failure Mobile Banking Application (WaTF-Bank), written in Java, Swift 4, Objective-C and Python (Flask framework) as a backend server, is designed to simulate a "real-world" web services-enabled mobile banking application that contains over 30 vulnerabilities based on OWASP Mobile Top 10 Risks.
- InsecureBankv2 - WThis vulnerable Android application is named "InsecureBankv2" and is made for security enthusiasts and developers to learn the Android insecurities by testing this vulnerable application. Its back-end server component is written in python.
- DVIA-v2 - Damn Vulnerable iOS App (DVIA) is an iOS application that is damn vulnerable. Its main goal is to provide a platform to mobile security enthusiasts/professionals or students to test their iOS penetration testing skills in a legal environment.
- DIVA Android - DIVA (Damn insecure and vulnerable App) is an App intentionally designed to be insecure.The aim of the App is to teach developers/QA/security professionals, flaws that are generally present in the Apps due poor or insecure coding practices.
- DVHMA - Damn Vulnerable Hybrid Mobile App (DVHMA) is an hybrid mobile app (for Android) that intentionally contains vulnerabilities. Its purpose is to enable security professionals to test their tools and techniques legally, help developers better understand the common pitfalls in developing hybrid mobile apps securely.
- MSTG Hacking Playground - This is a collection of iOS and Android mobile apps, that are intentionally build insecure. These apps are used as examples to demonstrate different vulnerabilities explained in the the OWASP Mobile Security Testing Guide.
- UnCrackable Mobile Apps - UnCrackable Apps for Android and iOS, a collection of mobile reverse engineering challenges. These challenges are used as examples throughout the Mobile Security Testing Guide.
- OWASP iGoat - Goat is a learning tool for iOS developers (iPhone, iPad, etc.) and mobile app pentesters. It was inspired by the WebGoat project, and has a similar conceptual flow to it.
Contribution
Your contributions and suggestions are welcome.
- Bypassing SSL Pinning
- Show currently visible view controller
- Bypassing Root Detection
- Live packet captures in real time
- Identifying application process using adb shell
- Disassembling Android apk file