CDIC 2013-Mobile Application Pentest Workshop

CDIC 2013 : Cyber Defense Initiative Conference 2013 www.cdicconference.com

Advanced Mobile Penetration Testing

Application Attacks and Defense

27th – 28th February 2013, Centara Grand & Bangkok Convention Centre at Central World, Bangkok

www.cdicconference.com

Mr. Prathan PhongthiproekConsulting ManagerGIAC GPEN, E|CSA, C|EH, eCPPT, CPTS, CIW Security Analyst, CWNA, CWSP, Security+

Speaker Profile

อ. ประธาน พงศ์�ทิ�พย์�ฤกษ์�

Mr. Prathan Phongthiproek

GIAC GPEN, E|CSA, C|EH, eCPPT, CPTS, CIW Security Analyst, CWNA, CWSP, Security+

ACIS Professional Center

E-mail: Prathan@acisonline.net

Let’s Talk and Workshop

Introduction

Attack Vectors for Pentest

Pentest iOS App

Pentest Android App

Workshop !!

INTRODUCTION

Past few years…..

Just Mobile phone

– Phone calls

– Sending text message or MMS

– Alarm clock

– Calculator

– Listen music

Edge for Surf internet !!

Now…

3G, 4G and WIFI support on Mobile network

Became more intelligent – Smart Phones

– Sending email

– Surf internet

– Check-in for flights

– Online Banking transactions

– Social network (Facebook, Twitter, Instagram)

Now…

Companies started creating mobile applications to offer services to clients

– Storing and synchronizing data files in the cloud

– Participating in social network sites

– As the data that stored, processed and transferred can often be considered sensitive.

ATTACK VECTORS FOR PENTEST

Three Attack Surfaces

Server Side Infrastructu

Comm. Chann

Client Softwar

Client Software on Mobile device

Communications Channel

Server Side Infrastructure

Client Software

Packages are typically downloaded from an AppStore, Google Play or provided via Company website

Testing requires a device that is rooted or jailbroken for access to all files and folders on the local file system

Be able to decompiled, tampered or reverse engineered

Client Software

Attention points

– Files on the local file system

– Application authentication & authorization

– Error Handling & Session Management

– Business logic

– Decompiling and analyzing

iExplorer for iPhone

Profile.properties and user_info.pref.xml

Plist files

Decompiled

Channel between the client and the server (HTTPs, Edge-3G)

Testing with HTTP Proxy (Burp, ZAP) to intercept and manipulate alter traffic

If the application does not use the HTTP protocol, can use transparent TCP and UDP proxy like Mallory

Attention points

– Replay attack vulnerabilities

– Secure transfer of sensitive information

– SSLStrip for HTTPS via Wifi

– Setup SSL for Proxy

Sniff traffic

Server-Side Infrastructure

The attack vectors for the web servers behind a mobile application is similar to those use for regular websites

Perform host and service scans on the target system to identify running services

Attention points

– OWASP Top 10 vulnerabilities (SQL Injection, XSS, ...)

– Running services and versions

– Infrastructure vulnerability scanning

Real Case Study: Mobile App Pentest

Client Software

– Found backend path in Localizable.strings

– Access to port 8080 (Tomcat)

– Logged in with default tomcat username and password

– Upload Malicious JSP code into webserver (Bypass Symantec AV)

– Access to configuration file that contain database credentials

– OWNED !! Database Server

– Capture the Flag !!

Localizable.strings

Logged in with Default Tomcat credentials

Upload Malicious code

Backend Compromised

Database Compromised

PENTEST IOS APPLICATION

Fast Track

iOS Application

Distributed as “.ipa” file (Simply zip file)

Deployed as “.app” directories (Same as Mac OSX)

Objective-C

Data storage

– Plist files

– SQLite

– Binary data files28

Fast and Furious Step

Preparing a Device

– Jailbreak

Install Tools on Device

– Cydia (OpenSSH, MobileTerminal, Etc)

Install Tools on Workstation

– SSH Client

– Plist Editor

– SQLite Database Browser

– Wireshark, Burp proxy29

Read application’s data files

Setup Proxy for Intercept and Manipulate traffic data

PENTEST ANDROID APPLICATION

Fast and Furious

Android Application

Distributed as “.apk” file (Simply zip file)

Multiuser OS running DalvikVM

Android runs .dex files on DalvikVM

Data storage

– XML files

– SQLite

Android Application

Android and Java

Preparation Tools for Pentest

Android SDK Tools

– AVD Manager and ADK Manager

Java 5,6, or 7

Eclipse for code review purpose

MITM proxy Tools such as Burp

Dex2jar, JD GUI

Setting up the environment

Adb install <apk path>

Configuring the proxy

Adb shell

Access Database via adb shell

Android Debug Bridge (ADB)

Packaged with the Android Software Development Kit

Essential adb commands:

– Adb devices: returns serial number of device(s) attached

– Adb kill-server: shuts down the adb daemon

– Adb shell: remote terminal

– Adb push: moves files from the local workstation to device

– Adb pull: moves files from the device to local workstation

– Adb remount: remounts the system partition on the device as read-write or write, depending on switch

– Adb forward: forwards adb traffic from one port to another

– Adb –h: help file for adb commands

Source Code Review

Convert the .apk file into .zip

Extract the zipped file, Found classes.dex

Dex2jar for convert .dex to .jar

Using JD GUI to open JAR file and review source code

Decompiled Application

Java Decompiler

Tip!! Prevent Application Reverse Engineering

ProGuard (Free) and DexGuard

– Obfuscator for Android

– Encrypt strings

– Encrypt entire classes

– Add tamper detection

WORKSHOP !!

Thank You

www.cdicconference.com

CDIC 2013-Mobile Application Pentest Workshop

Technology

Transcript of CDIC 2013-Mobile Application Pentest Workshop

PenTest Starterkit 1/2012

CDIC Webinar Understanding CDIC Coverage of Brokered …...Understanding CDIC Coverage of Brokered Deposits ... Disclaimer The presentation and discussion do not replace legal advice

Pentest+ Certification Review

PenTest Regular 11/12

Sap Pentest 15954

Input Validation PenTest Regular

Provider Pentest a Payment - sdmay21-06 • Pentest a ...

CDiC - India Newsletter - Changing Diabetes in Childrencdicindia.org/cdicadmin/uploads/medianewsletters/CDiC-e...Page 5 CDiC India Newsletter CDiC India Newsletter CDiC India Newsletter

Pentest with Metasploit

Web PenTest Sample Report

Wireless Pentest: casos prácticos

The Pentest is Dead, Long Live the Pentest. - DEF CON Overview 1 the pentest is dead 1.1 history of the pentest 1.2 pentesting goes mainstream 2 long live the pentest 2.1 the value

Pentest Open 08 2013

SUMMARY OF THE CORPORATE PLAN - CDIC

Checkpoint Hack Pentest

The Pentest is Dead, Long Live the Pentest. - Defcon

PenTest For Government Agencies and Contractors · Go on Cyber Offense with PenTest+ Certification PenTest+For Government Agencies and Contractors “PenTest+ demonstrates knowledge

Hallmark CDIC Progress Report 2011

CDIC NBD Compliance Framework - Approach Overview

Mobil Pentest Örnek Not