Mobile App Security: Android & iOS Pentesting Guide

[Blacksec]

Mobile App Security: Android & iOS Pentesting Guide ​

---

> Posted by: app_hacker | Rank: Senior Member | Joined: 2023 [/I]

---

Spoiler: For Authorized Testing Only

Mobile app security testing requires explicit authorization.

Mobile apps are everywhere. And most of them are insecure.

Let me walk you through the complete mobile pentesting methodology - from APK analysis to exploit development.

---

━━━ ANDROID REVERSE ENGINEERING ━━━[/B]

APK Extraction & Analysis:

# === Tools Needed ===
# apktool, jadx, frida, obfusc-deobf, androguard

# Decompile APK
apktool d app.apk -o app_decompiled

# Convert to Java (readable)
jadx -d app_java app.apk

# Analyze manifests
cat app_decompiled/AndroidManifest.xml | grep -i "debuggable\|allowBackup\|contentProvider"

# Check for security misconfigurations
grep -r "debuggable=\"true\"" app_decompiled/AndroidManifest.xml
grep -r "allowBackup=\"true\"" app_decompiled/AndroidManifest.xml
grep -r "exported=\"true\"" app_decompiled/AndroidManifest.xml

Common Android Vulnerabilities:

┌──────────────────┬─────────────────────────────────────────┐
│   Vulnerability  │         Impact                          │
├──────────────────┼─────────────────────────────────────────┤
│ Hardcoded Keys   │ API keys, secrets in source code        │
│ Insecure Storage │ SharedPreferences, SQLite without encryption │
│ SSL Pinning Bypass│ Traffic interception possible          │
│ Component Export  │ Activities/Services exposed to other apps │
│ Intent Injection  │ Manipulated app behavior via intents  │
│ Content Provider  │ Data exfiltration via URIs             │
│ Debug Mode       │ Easier reverse engineering              │
│ Root Detection   │ Weak or bypassable checks               │
│ Log Injection    │ Sensitive data in logs                  │
└──────────────────┴─────────────────────────────────────────┘

---

━━━ SSL PINTING BYPASS ━━━

Most modern apps use SSL pinning. Here's how to bypass it:

# Method 1: Frida Scripts (Easiest)
# Download Frida server for ARM/ARM64
# Push to device/emulator
adb push frida-server /data/local/tmp/
adb shell "chmod +x /data/local/tmp/frida-server"
adb shell "/data/local/tmp/frida-server &"

# Run bypass script
frida -U -f com.target.app -l ssl-pinning-bypass.js --no-pause

# ssl-pinning-bypass.js content:
Java.perform(function() {
    var SSLContext = Java.use("javax.net.ssl.SSLContext");
    var TrustManager = Java.use("javax.net.ssl.X509TrustManager");
    var HostnameVerifier = Java.use("javax.net.ssl.HostnameVerifier");
    
    SSLContext.init.overload("[Ljavax.net.ssl.KeyManager;", "[Ljavax.net.ssl.TrustManager;", "java.security.SecureRandom").implementation = function(km, tm, sr) {
        var emptyTrustManager = Java.extend(TrustManager)({
            checkServerTrusted: function(chain, authType) {},
            checkClientTrusted: function(chain, authType) {},
            getAcceptedIssuers: function() { return []; }
        });
        this.init(km, [emptyTrustManager], sr);
    };
    
    var honestHostnameVerifier = Java.extend(HostnameVerifier)({
        verify: function(hostname, session) { return true; }
    });
    HttpsURLConnection.setDefaultHostnameVerifier(honestHostnameVerifier);
});

# Method 2: Objection (Runtime exploration)
objection -g com.target.app explore
objection> ios ssl pinning disable  # iOS
objection> android ssl pinning disable  # Android

---

━━━ ANDROID INTENT INJECTION ━━━

# Find exported components
aapt dump badging app.apk | grep "activity-alias"
aapt dump badging app.apk | grep "uses-permission"

# Craft malicious intents
adb shell am start -a android.intent.action.VIEW -d "app://deep/link" com.target.app
adb shell am broadcast -a com.target.app.ACTION -e key "value"

# Content Provider enumeration
adb shell content query --uri content://com.target.app.provider/
adb shell content insert --uri content://com.target.app.provider/ --bind name:s:test

---

━━━ iOS REVERSE ENGINEERING ━━━

IPA Analysis:

# === Tools Needed ===
# class-dump, filza, frida, cycript

# Extract IPA
unzip app.ipa -d app_extracted

# Analyze binary
class-dump app_extracted/Payload/app.app/app > headers.h

# Check for sensitive data
strings app_extracted/Payload/app.app/app | grep -i "password\|api_key\|secret\|token"

# Check Info.plist for configurations
plutil -p app_extracted/Payload/app.app/Info.plist

Common iOS Vulnerabilities:

• NSURLConnection without certificate validation
• Keychain data exposure
• Insecure data storage (NSUserDefaults)
• Weak SSL/TLS configurations
• JIT enabled in WebViews
• URL scheme vulnerabilities
• Touch ID/Passcode bypass

---

━━━ NETWORK TRAFFIC ANALYSIS ━━━

# === Proxy Setup ===
# Charles Proxy / Burp Suite / mitmproxy

# Android (no SSL pinning):
adb shell settings put global http_proxy IP:PORT
adb shell settings put global http_proxy_enabled 1

# Android (with SSL pinning bypass):
frida -U -f com.target.app -l pinning-bypass.js

# iOS (jailbroken):
# Set proxy in app settings or use Frida

# Capture traffic
burp > Configure > Proxy > Options > Add 127.0.0.1:8080
# Install Burp cert on device
adb install burp-cert.apk

---

━━━ STORAGE ANALYSIS ━━━

Android Storage Locations:

# Internal Storage (requires root)
adb shell run-as com.target.app ls -la
adb shell run-as com.target.app cat shared_prefs/preferences.xml
adb shell run-as com.target.app cat databases/app.db

# External Storage
adb pull /sdcard/Android/data/com.target.app/ ./app_data/

# Check for:
# - Hardcoded credentials
# - API keys
# - Session tokens
# - SQLite databases with sensitive data
# - SharedPreferences with plaintext secrets

Keychain/Keystore Analysis:

# iOS Keychain
# Requires jailbreak or Xcode debugging
security dump-keychain

# Android Keystore
# Harder to extract - requires hardware-backed keystore exploitation
# Check for weak implementations:
# - SoftwareOnly keystore
# - Missing biometric binding
# - Weak key generation parameters

---

━━� AUTOMATED SCANNING ━━━

# === MobSF (Mobile Security Framework) ===
# All-in-one mobile app analysis
git clone https://github.com/MobSF/Mobile-Security-Framework-MobSF
cd MobSF
./setup.sh
./run.sh

# Access via browser: http://localhost:60000
# Upload APK/IPA for automated analysis

# === Drozer ===
# Android security assessment framework
git clone https://github.com/FSecureLABS/drozer
cd drozer
python2 drozer/console/connect
run app.package.list
run app.package.info -f com.target
run app.intent.info -a com.target.ACTION
run scanner.provider.finduris -f com.target

---

━━━ TL;DR ━━━

✅ Decompile APK with apktool + jadx
✅ Check AndroidManifest.xml for misconfigs
✅ Bypass SSL pinning with Frida/Objection
✅ Test exported components with intents
✅ Analyze stored data (SharedPreferences, SQLite)
✅ Use MobSF for automated scanning
✅ Test on jailbroken/rooted devices
✅ Document all findings with POCs

---

What's your favorite mobile pentesting tool? Drop below.
Next: IoT security testing.

Last edited by app_hacker; 25 minutes ago.

---

[SIG]━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
app_hacker | Senior Member | Mobile Security
"Every app is a black box waiting to be opened"
━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━[/SIG][/b][/b][/b][/b][/b][/b][/b]