POC
Mobile applications and services are vital for both our personal and professional life, making them prime targets for malicious actors seeking sensitive data. Modern Android applications are widely used in commerce, healthcare, banking, education, and more. Beyond storing sensitive information, these applications often contain security vulnerabilities that could be exploited. Penetration testers and developers play a crucial role in identifying and mitigating these vulnerabilities, reducing risks such as fraud, malware infections, and data breaches. For companies launching new applications, ensuring security and compliance is essential to avoiding legal issues and protecting user data.
Mobile application penetration testing is the process of assessing an app's security by simulating real-world attack scenarios. This methodology helps identify vulnerabilities and ensures that applications remain resilient against threats. The following steps outline a structured, high-level approach that Android penetration testers should follow for a comprehensive security evaluation.
1. Planning and Environment Setup
| Objectives |
| Define the scope and objectives of the penetration test. |
| Obtain necessary permissions from the app owner or organization. |
| Set up the testing environment, including the necessary tools, operating systems, and emulators. |
| Objectives |
| Gather information about the app and its architecture. |
| Understand the functionality of the application. |
| Enumerate any data structure the app uses that is stored in the local storage. |
3. Static Analysis
| Objectives |
| Understand the manifest file of the application. Review the app's components, permissions, and configurations. |
| Decompile and analyze the application's source code to understand the flow and find potential vulnerabilities. |
| Examine native or third-party libraries, frameworks, and dependencies the app uses. |
4. Dynamic Analysis
| Objectives |
| Monitor the application's behavior during runtime. Enumerate the local storage for files and data structures created after performing various functionalities. |
| Perform dynamic instrumentation to read the memory of the application during runtime. |
| Intercept network traffic and test the app for vulnerabilities such as authentication bypass and insecure data transmission. |
| Check for Server-Side attacks by analyzing API calls and looking for vulnerabilities such as injection and Cross Side Scripting |
5. Documenting and Reporting
| Objectives |
| Document the identified vulnerabilities, exploitation methods, impact, and potential risks. |
| Communicate the findings to the app owner or organization. |
| Provide recommendations for fixing vulnerabilities and mitigating security risks. |
The following list presents some of the most widely used tools for mobile app penetration testing , focusing on reverse engineering, dynamic analysis, code instrumentation, network traffic analysis, and digital forensics. Familiarity with these tools is essential for anyone practicing their Android application penetration testing skills.
ADB
A versatile command-line tool that allows communication with Android devices. This tool will let us enumerate the local storage of the device and the installation directory of the application, see the app logs while it is running, and install and run other apps and tools necessary for the steps of the dynamic analysis and instrumentation.
This tool allows us to reverse engineer an application and view its source code through a graphical interface. It provides the user with a Java-like pseudocode that is close enough to the actual code. It also decodes the encoded resources that are packed in the APK file, making the file configurations and the other assets readable to humans. This tool is an essential part of the process since the testers can understand how the app works and what technologies are used.
jadxgui
Overview
This tool also allows reverse engineering Android applications. It will decompile the source code and decode the resources of the APK file.
Core Functionality
APKTool also enables us to edit the source code and configuration files, recompile the code, and build the APK file again. This is called application patching.
Technical Implementation
The decompiled code provided to the user is a symbolic language called Smali. This language is not easy to read, but if combined with a tool that offers Java-like pseudocode like JADX, pentesters can efficiently understand and change the flow of the application to their benefit.
Use Cases
- Application Analysis: Reverse engineer Android applications to understand their structure and functionality
- Security Assessment: Identify vulnerabilities and potential attack vectors in mobile applications
- Code Modification: Edit application behavior for testing or research purposes
- Resource Extraction: Decode and analyze application resources and assets
Ghidra
An open-source software reverse engineering (SRE) framework developed by the National Security Agency (NSA). It is used for disassembling, decompiling, and analyzing binaries. In Android application penetration testing, Ghidra is often used to analyze the native C++ libraries loaded to the application.
Burp Suite
A tool used for web application penetration testing. While we often see it used for testing websites, it can also be used for testing any web-based application communicating with a server, including Android. In the Android application, penetration testing will be mainly used to intercept and analyze HTTP/HTTPS requests.
Frida • A world-class dynamic instrumentation toolkit
A dynamic instrumentation toolkit used by developers, reverse engineers, and security researchers. It enables us to inject snippets of JavaScript or native code into the running processes of Android applications, allowing us to analyze and manipulate them during runtime.
2. Listing Installed Apps
Attackers must first identify the correct bundle identifier for the application they want to analyze. They can then use tools such as Frida and run the following commands to list all apps currently installed on the device:
frida-ps -Uai
Once the list is generated, note the identifier and PID for further use.
An open-source digital forensics platform that can be used for various tasks, including Android forensics. Autopsy will help us investigate disk images of Android devices and let us search for files, databases, calls, messages, and logs, using the provided GUI.
Automated Android penetration testing tools are suitable for scanning common vulnerabilities. They offer a faster and cheaper solution than manual tools and processes, which provide more depth and vulnerability insights by combining human intelligence with automated tools.
An automated security testing framework for Android, ios, and Windows platforms that performs static, dynamic, and malware analysis on mobile applications.
A comprehensive security and attack framework that allows us to assess the security of Android applications. It simulates various attack vectors and provides multiple tools to analyze, exploit, and debug Android applications.
Hacking Android Devices: A Comprehensive Overview
The rapidly growing number of Android device users have made these devices primary targets for hackers. Attackers use various tools such as drozer, zANTI, Network Spoofer, Low Orbit Ion Cannon (LOIC), DroidSheep, and Orbot Proxy to launch sophisticated attacks on Android devices and their applications.
Identifying Attack Surfaces Using Drozer
Drozer is a powerful tool that attackers use to discover vulnerabilities and attack surfaces on Android devices and apps. One of its key advantages is that it don't require USB debugging techniques—attackers can assess devices in their production state. The tool provides:
- Drozer Agent: An emulator used for testing purposes
- Drozer Console: A command-line interface for performing assessment operations
After installing the drozer agent, attackers follow a systematic approach to identify and exploit vulnerabilities.
To gather intelligence about installed packages, attackers use these commands:
This command displays all packages inside the device.
dz> run app.package.list
This retrieves the specific package name from the list.
dz> run app.package.list -f <string_name>
dz> run app.package.info -a <package_name>
This retrieves basic details about a specific package, giving attackers comprehensive information about their targets.
Identifying Attack Surface
Once package information is obtained, attackers uses utilities to identify exposed components. The following commands lists information on exported activities, services, broadcast receivers, and content providers:
dz> run app.package.attacksurface <package_name>
Lists various exported activities that could be exploited.
dz> run app.activity.info -a <package_name>
Displays detailed information of the exported activities, revealing potential entry points for attacks.
Launching Activities
Finally, attackers can launch specific activities using this command:
dz> run app.activity.start --component <package_name> <activity_name>
This activity often displays critical information that can be exploited to evade authentication processes. By bypassing the authentication mechanism, attackers discovers various attack surfaces and further exploits them to launch devastating attacks on target Android devices. The information exposed through this process can be leveraged for unauthorized access, data theft, or complete system compromise.
A static code analysis tool that automates the discovery of security vulnerabilities in Android applications. It can also create Proof-of-Concept deployable APKs and ADB commands to exploit the vulnerabilities it finds.
A runtime mobile exploration toolkit that uses Frida to provide an easy environment for assessing Android and iOS application security.
It automates several common tasks, such as: bypassing SSL pinning, and users won't be needed to create custom scripts whenever they need to exploit common vulnerabilities.
Analyzing an iOS Application Using objection
Attackers use the objection tool to perform method hooking on an iOS application at runtime. It is also incorporated with other features such as iOS application patching, SSL Pinning bypass, iOS keychain dumping, and pasteboard monitoring.
Setup Process
Attackers connect an iOS device to their workstation and install the objection tool, which includes the Frida feature.
Method Hooking
After installing the objection tool, follow the steps given below to perform method hooking:
-
Tool Execution: Execute the following command to run the objection tool by attaching it to the target application:
objection --gadget <AppName> explore
-
Class Monitoring: Run the following command to monitor the method calls of a class:
ios hooking watch class <Class_Name>
-
Method Hooking: Run the following command to hook a specific method to a class:
ios hooking watch method "-[Class_Name Method_Name]"
-
Return Value Modification: Run the following command to change the return value of the function that returns only Boolean values of the hooked method:
ios hooking set return_value "-[Class_Name iFunction_Name:]" true/false
Security Bypass Features
SSL Pinning Bypass
ios sslpinning disable
The above command disables the SSL pinning functionality in the hooked application.
Jailbreak Detection Bypass
ios jailbreak disable
The above command disables the jailbreak detection functionality in the hooked application.
Medusa
An extensible and modularized framework that automates processes and techniques practiced during the dynamic analysis of Android Applications. Medusa is based on Frida and can analyze and enumerate an app, attack common entry points, and automate processes like application patching, MITM attack, and more. Medusa can add and remove hooks for Java or Native methods and has more than 90 modules that can be combined.
Androbugs is an Android vulnerability analysis framework that automatically scans Android applications and checks for security issues and vulnerabilities.
It is crucial to remember that combining both manual and automated techniques usually results in a better evaluation. Recapping this module, we went through the most critical fundamental concepts necessary for understanding the methodologies that will follow in subsequent modules. We analyzed the structure of the Android OS and the architecture of applications, discussed the different types of apps, and examined examples of applications built with various frameworks. We studied their components and IPCs, and learned how to set up a testing environment and interact with emulators.
Following the Penetration Testing methodology discussed in this section, we are now ready to prepare for the next module, which regards Android Application Static Analysis. In this upcoming module, we will reverse engineer apps and study the source code to identify security issues and exploit vulnerabilities.