mobile-app-security-testing

Mobile Application Security Testing

Overview

Mobile application security testing is an important part of ensuring the security of mobile applications. This skill provides methods, tools, and best practices for mobile application security testing, covering both the Android and iOS platforms.

Testing Scope

1. Application Security

Check items:

• Code obfuscation
• Anti-decompilation protection
• Anti-debugging protection
• Certificate pinning

2. Data Security

Check items:

• Data encryption
• Key management
• Sensitive data storage
• Data transmission

3. Authentication and Authorization

Check items:

• Authentication mechanisms
• Token management
• Biometrics
• Session management

4. Communication Security

Check items:

• TLS/SSL configuration
• Certificate verification
• API security
• Man-in-the-middle attack protection

Android Security Testing

Static Analysis

Using APKTool:

# 反编译APK
apktool d app.apk

# 查看AndroidManifest.xml
cat app/AndroidManifest.xml

# 查看Smali代码
find app/smali -name "*.smali"

Using Jadx:

# 反编译APK
jadx -d output app.apk

# 查看Java源码
find output -name "*.java"

Using MobSF:

# 启动MobSF
docker run -it -p 8000:8000 opensecurity/mobsf

# 上传APK进行分析
# 访问 http://localhost:8000

Dynamic Analysis

Using Frida:

// Hook函数
Java.perform(function() {
    var MainActivity = Java.use("com.example.MainActivity");
    MainActivity.onCreate.implementation = function(savedInstanceState) {
        console.log("[*] onCreate called");
        this.onCreate(savedInstanceState);
    };
});

Using Objection:

# 启动Objection
objection -g com.example.app explore

# Hook函数
android hooking watch class_method com.example.MainActivity.onCreate

Using Burp Suite:

# 配置代理
# Android设置代理指向Burp Suite
# 安装Burp证书

Common Vulnerabilities

Hardcoded keys:

// 不安全的代码
String apiKey = "1234567890abcdef";
String password = "admin123";

Insecure storage:

// SharedPreferences存储敏感数据
SharedPreferences prefs = getSharedPreferences("data", MODE_WORLD_READABLE);
prefs.edit().putString("password", password).apply();

Certificate verification bypass:

// 不验证证书
TrustManager[] trustAllCerts = new TrustManager[] {
    new X509TrustManager() {
        public X509Certificate[] getAcceptedIssuers() { return null; }
        public void checkClientTrusted(X509Certificate[] certs, String authType) { }
        public void checkServerTrusted(X509Certificate[] certs, String authType) { }
    }
};

iOS Security Testing

Static Analysis

Using class-dump:

# 导出头文件
class-dump app.ipa

# 查看头文件
find app -name "*.h"

Using Hopper:

# 使用Hopper反汇编
# 打开app二进制文件
# 分析汇编代码

Using otool:

# 查看Mach-O信息
otool -L app

# 查看字符串
strings app | grep -i "password\|key\|secret"

Dynamic Analysis

Using Frida:

// Hook Objective-C方法
var className = ObjC.classes.ViewController;
var method = className['- login:password:'];
Interceptor.attach(method.implementation, {
    onEnter: function(args) {
        console.log("[*] Login called");
        console.log("Username: " + ObjC.Object(args[2]).toString());
        console.log("Password: " + ObjC.Object(args[3]).toString());
    }
});

Using Cycript:

# 附加到进程
cycript -p app

# 执行命令
[UIApplication sharedApplication]

Common Vulnerabilities

Hardcoded keys:

// 不安全的代码
NSString *apiKey = @"1234567890abcdef";
NSString *password = @"admin123";

Insecure storage:

// Keychain存储不当
NSUserDefaults *defaults = [NSUserDefaults standardUserDefaults];
[defaults setObject:password forKey:@"password"];

Certificate verification bypass:

// 不验证证书
- (void)connection:(NSURLConnection *)connection 
didReceiveAuthenticationChallenge:(NSURLAuthenticationChallenge *)challenge {
    [challenge.sender useCredential:[NSURLCredential credentialForTrust:challenge.protectionSpace.serverTrust] 
          forAuthenticationChallenge:challenge];
}

Tool Usage

MobSF

# 启动MobSF
docker run -it -p 8000:8000 opensecurity/mobsf

# 上传应用进行分析
# 支持Android和iOS

Frida

# 安装Frida
pip install frida-tools

# 运行脚本
frida -U -f com.example.app -l script.js

Objection

# 安装Objection
pip install objection

# 启动Objection
objection -g com.example.app explore

Burp Suite

Configuring the proxy:

1. Configure the Burp Suite listener
2. Set up the proxy on the mobile device
3. Install the Burp certificate
4. Intercept and analyze traffic

Testing Checklist

Application Security

• Code obfuscation check
• Anti-decompilation protection
• Anti-debugging protection
• Certificate pinning

Data Security

• Data encryption check
• Key management
• Sensitive data storage
• Data transmission security

Authentication and Authorization

• Authentication mechanism testing
• Token management
• Session management
• Biometrics

Communication Security

• TLS/SSL configuration
• Certificate verification
• API security testing
• Man-in-the-middle attack protection

Common Security Issues

1. Hardcoded Keys

Problem:

• Hardcoded API keys
• Hardcoded passwords
• Hardcoded encryption keys

Fix:

• Use a key management service
• Use environment variables
• Use secure storage

2. Insecure Storage

Problem:

• Storing sensitive data in plaintext
• Using insecure storage methods
• Data not encrypted

Fix:

• Use encrypted storage
• Use Keychain/Keystore
• Implement data encryption

3. Certificate validation bypass

Issue:

• Not validating SSL certificates
• Accepting self-signed certificates
• Certificate pinning not implemented

Fix:

• Implement certificate pinning
• Validate certificate chain
• Use system certificate store

4. Debug information leakage

Issue:

• Logs contain sensitive information
• Error messages leak information
• Debug mode not disabled

Fix:

• Remove debug code
• Limit log output
• Disable debugging in production

Best practices

1. Code security

• Implement code obfuscation
• Disable debugging features
• Implement anti-debugging protection
• Use certificate binding

2. Data security

• Encrypt sensitive data
• Use secure storage
• Implement key management
• Restrict data access

3. Communication security

• Use TLS/SSL
• Implement certificate pinning
• Validate server certificates
• Use secure APIs

4. Authentication security

• Implement strong authentication
• Secure token management
• Implement session management
• Use biometrics

Notes

• Test only in authorized environments
• Comply with laws and regulations
• Note differences between platforms
• Protect user privacy