Successfully reported this slideshow.
We use your LinkedIn profile and activity data to personalize ads and to show you more relevant ads. You can change your ad preferences anytime.

Getting started with Android pentesting

88 views

Published on

This presentation talks about basics in Android Penetration Testing

Published in: Technology
  • Be the first to comment

Getting started with Android pentesting

  1. 1. MINALI ARORA
  2. 2.  A cyber security professional with almost 6 years of experience  Demostrated areas of work- Application & Network Pentesting, Bash Scripting and Red Teaming  Part time bug bounty hunter and blogger https://medium.com/@minaliarora  Follow me on twitter: @AroraMinali
  3. 3.  Android Overview  Android Architecture  Android Security Model  Android App Testing  OWASP Top 10  Security tips for Developers
  4. 4.  Android’s Security Model consists of two parts: ◦ UID Separation ◦ Sandboxing Linux Kernel offers unique UID and GID for each application at run time. Thus, an application runs in its own sandbox environment and does not affect any other apps running.
  5. 5. AndroidManifest.XML Classes.dex Resources.arsc Assets Folder Lib Folder META-INF Folder Res Folder Other Files
  6. 6.  Root your device (If you choose an emulator, then make sure that it is already rooted)  Allow unknown sources (Settings->Security)  Install the application  Connect the device/emulator to a proxy setup (for e.g. Burp)
  7. 7. Methodology of testing an Android application can be broadly divided into two categories:  Static Testing  Dynamic Testing While static testing includes reversing an android application and reading the code, Dynamic testing includes analyzing the network traffic
  8. 8.  Android SDK: A software development kit containing API libraries and developer tools to build, test and debug Android apps In our context , more important ones are adb, apktool, and the emulator
  9. 9.  Android Debug Bridge: Command line tool to communicate with emulator instance or connected physical/virtual device  Useful Commands:  adb devices  adb connect  adb shell  adb install  adb push/pull
  10. 10.  apktool: is used to decode and reverse engineer android application Command: apktool d <apk file>
  11. 11.  dex2jar –converts dex file to jar containing reconstructed source code which can be viewed in jdgui
  12. 12.  AndroidManifest.xml- This file contains all application components and application permissions
  13. 13.  Drozer  Burp Suite  Droidbox  MobSF  Inspeckage
  14. 14.  Drozer: One of the most chosen tools for Android security testing. A security testing framework, great to determine app attack surface and interact with it.
  15. 15. Most common vulnerabilities found during Android application testing:  OTP bypass  Authentication bypass  IDOR  Information Leakage  Privilege Escalation
  16. 16.  Store data safely  Enforce secure communication  Use web view objects carefully  Provide the right permissions to application  Update security provider to protect against exploits  Share only sensitive data to cache files  Use shared preferences in private mode https://developer.android.com/topic/security/best- practices

×