Downloaded 46 times
![Reading Stored Data
Android Applications store the data in
/data/data/[PACKAGE_NAME]
sharedpreferences
Context.MODE_PRIVATE
Context.MODE_WORLD_READABLE
Context.MODE_WORLD_WRITEABLE
Files may be stored using the filesystem at
/data/data/[PACKAGE_NAME]/files/filename
Storage in the SQLite databases](https://image.slidesharecdn.com/pentestingandroidapps-160419181953/85/Pentesting-Android-Apps-18-320.jpg)
More Related Content
![[2014/10/06] HITCON Freetalk - App Security on Android](https://cdn.slidesharecdn.com/ss_thumbnails/20141006devcorehitconfreetalkandroid-141007004147-conversion-gate01-thumbnail.jpg?width=640&height=640&fit=bounds)
Similar to Pentesting Android Apps
Pentesting Android Apps
- 1. Pentesting Android Apps AbdelhamidLimami IT Security Consultant @ ITDefence
- 2. Overview What isAndroid ? Android Architecture Android Applications Security Environment Setup Exploiting Apps Vulnerabilities OWASP Top 10 Mobile Demo(s) Tips for Developers Q&A
- 3. Past years… MobilePhones : Phone calls Sending text message or MMS Alarm clock Calculator & Calendar Listen on Radio Playing the snake game
- 4. And Now… SmartPhones ! Sending email Watching Tv & Movies Surf The internet Booking Flights & Hotels Online Banking transactions Social Network (Facebook, Twitter, Instagram, Etc …) 3G , 4G , 5G Mobile Network & WIFI & NFC support
- 5. What is Android? Android is a Linux based platform developed by Google and the open handset alliance. Application programming for it is done in java (include XML & support HTML). The android operating system software stack consist of java applications running on a Dalvik virtual machine (DVK). Applications similars to web apps.
- 6.
- 7.
- 8. Attack Surfaces ClientSoftware on Android Device Communications Channel Server Side Infrastructure
- 9. Client Software Packagesare Installed from Play Store , Company Website, Third party apps/websites Access All the files of the application in the local system (Need Root) Can be Tampered , Decomplied & Reverse Engineered
- 10. Client Software Whatexactly should I look for ? Files on the local file system Application authentication & authorization Error Handling & Session Management Logic Flaws Decompiling and Analyzing
- 11. Communications Channel Channelbetween the client and the server (HTTP(s), 3G…) Testing with HTTP Proxy (Burp, ZAP) to intercept and manipulate data If the application does not use the HTTP protocol, can use transparent TCP and UDP proxy like Mallory
- 12. Communications Channel What exactlyShould I look For ? Sniff sensitive information Replay attack vulnerabilities Secure transfer of sensitive information
- 13. Server-Side Infrastructure Vulnsin the the web servers behind a mobile application: OWASP TOP 10 Web (SQLI,RCE,CSRF…) Perform host and service scans on the target system to identify running services : Information gathering (whois,host,dns….) Running services and version (scanning ports) Infrastructure vulnerability scanning
- 14.
- 15. Environment Setup RootYour Device ! Install Xposed + JustTrustMe (SSL Killer) / Android-SSL-TrustKiller Configure your Proxy (Burp, Zap…) Requirements: A Computer Java Eclipse (include ADT plugin) – Android Studio Android SDK
- 16.
- 17. App Analysis InsecureStorage Capturing Requests Reversing the Application Package Logical Flaws / Malicious activities
- 18. Reading Stored Data Android Applications store the data in /data/data/[PACKAGE_NAME] sharedpreferences Context.MODE_PRIVATE Context.MODE_WORLD_READABLE Context.MODE_WORLD_WRITEABLE Files may be stored using the filesystem at /data/data/[PACKAGE_NAME]/files/filename Storage in the SQLite databases
- 19. Local Data Storageflaws
- 20. Capturing Requests CaptureHTTP requests & responses Parameter Manipulation and Data Tampering. Set up a proxy in between the server & the client to intercept.
- 21.
- 22. Reverse Engineering ReverseEngineer the application logic and source code Identify the flaws in the code base to exploit them Look for sensitive data like passwords, encryption algorithms and keys of DB(s) JD-GUI Dex2Jar .apk .dex .class .java
- 23.
- 24. Logical Flaws InsecureLogin:
- 25. Malicious Activities IdentityDecloaking:
- 26. OWASP Top 10Mobile
- 27.
- 28.
- 29. Secure Your App! Do Not store sensitive data locally (login creds, pwd, DB …) Do Not use weak encryption in your code (base64, md5 …) Do Not send sensitive data in Plain text requests (Token , Sessions , logins) Encrypt the stored data If using a webserver protect it against application layer attacks Sanitize inputs, use prepared statements (protection against client side injection) Encode your code before producing or at least use an obfuscator
- 30.