[Music]
so can everybody hear me okay all right
so hi um my name is Whitney Phillips I'm
going to be doing a talk on beginner's
guide to mobile application penetr ation
testing so I know that's a
mouthful um is this anybody's first
Cipher con it's my first Cipher con
that's a big group so I normally go to
geran that's kind of like my home away
from home uh in Michigan
so let's go ahead and get started so who
am I uh again I'm Whitney Phillips I've
been in it and infos SEC for 12 years I
started off as a Health Des specialist
then I moved to a system administrator
TR that's kind of where I got my start
in infos SEC um after that I kind of did
some blue teaming so uh I let a huge
endpoint encryption
project um anything anything they threw
at me
antivirus uh DLP I picked it up after
that I did purple teaming I did secure
code review I don't know anything about
coding so don't ask me how I got on the
team but I did
it after that that guy came to me and
asked me if I wanted to learn how to
mobile pen test and I said sure why not
um so I worked with a company for about
four years where I would do mobile apps
with um messaging and some drone work
and then that led me to my current
company right now I work for trusted SEC
or I do mobile app testing primarily and
some graybox testing
so yay that brings me to why are we here
well I want to talk to you about mobile
application penetration testing and
basically what tools you need to uh use
to get started in that field so any of
these tools could probably be a whole 30
minute talk just
because they are so extensive and it's
taken me probably five years now just
learning that and when I started at
trusted SE uh my manager right now knows
like a whole another level that I don't
even want to know about so um
continuously learning in this field so
we'll go ahead and start with um devices
when you're doing mobile penetration
testing you're going to want devices
you're going to want a rooted Android
device I personally use the
pixel
huh do it say
it's still and who am
I
huh is it
moving no it's moving on my
thing what the
hell where are we at
now yeah cuz this is what
I oh hold on and
this okay where are we at the beginning
again
huh yeah
it's is it the dongle maybe
possibly
and I know what we can do we can mirror
all
right one moment
please display settings is anybody a
desktop support person that can
mirror display
settings huh just unplug
[Music]
it good thing I talk
fast all right what do we see
now
huh dark
abyss all right let's start from the
beginning is my face all hot and red
looking all right so if I click
this yay all right let's start again why
are we here mobile apps all right next
rooted
devices thanks for pointing that out I
appreciate it so um rooted devices I
personally use a pixel 6 uh I used a
pixel 4 previously that's my uh Android
of choice um I'm sure there's other ones
that's just the one I'm more comfortable
with you can find uh any other ones that
you prefer to use so when we're rooting
did it go to the next okay cool when
rooting that device I use magisk so
magisk is a really userfriendly
um
application a um there's a lot of steps
that go to it and but they have a lot of
good documentation out to it um you end
up having to like sideload the APK on
there and then changing your whole
um boot structure but it's fine
so lot of information out there it's an
easy um
install if you don't have physical
access to a phone um Jenny motion is a
good emulator that I like to use uh
depending on unless you have an M1
laptop then sometimes that doesn't work
so you it needs specific virtual
machines and I won't go on about that
but
you can spool up as many virtual um
phones as you want and play around with
them you can sideload apks on there uh I
like that it's a good one to go off of
so this is Jenny motion again you can
pull logs from your Android device you
can see um where it would be a virtual
machine or virtual Android phone up on
your your
laptop uh next
a my next device would be a jailbroken
iOS
device IU
uncover uh currently running on a
14 I like this one because it's just
they again have a lot of good
documentation on how
to um jailbreak your iPhone and it's
easy it's quick it
doesn't uh take a long time and it
doesn't I've had ones
where I feel like my device randomly
reboots and then I lose that jailbreak
and I have to go back and re jailbreak
the device and it always seems to happen
during the middle of an audit so um
uncover there is not anything out that I
know of for like
16 yet that's working well so if you can
find an iPhone 14 OS stick with that
check ran I have not used before but
that's another option they do support 12
and up so those are my
two
um I guess two jailbreaking and rooting
softwares that my I primarily use in my
day-to-day so we have our jailbroken
iPhone we have our rooted Android where
do we get the application from well we
can get it from the honest way we can go
to the Play Store or the app
store or we can go
ahead and we can go somewhere
like um iPhone cakes and get your IPA
file and I don't have um I lost my
Android slide for this but uh APK or
pure is one that on the UN gosh damn it
huh unplug and plug it back
in what
a try a different
one
so window a window
screen I'm about to fight I'm just going
to like
stand and like
huh what do you see
now you know what maybe I don't
maybe I don't because the presentation
obviously messes it up so APK pure is
one that I did not um put on there but
what if we just click through it and we
just this is what's going to happen so
cuz I don't I don't have a lot of
time
um anyways iPhone cakes these are ways
to get your APK and your IPA without
having to go through the the store and
without having to create an account the
problem is is you have to side Lo load
those applications um and you have to
know how to do that so which brings me
to my next topic side loading
applications with Android you use ADB
install with iOS I use either Fila side
Lo side side loly or xcode those are all
really nice um xcode you have to do a
bunch of of things where you've signed
the application um I don't like that I'm
lazy I like to just drop my IPA file
onto my phone and it does magic for me
and then I have a working um install
so onward to some tools so I mentioned a
um ad earlier so ADB comes in the
Android STK toolkit uh also comes in a
fast boot in system Trace
those are tools that are essential that
is what you need to start up with
Android and um your rooted device in
penetration
testing ADB
shell is what you're going to use to
connect to your Android device ADB push
you go from PC to device so if you're
pushing an install file or pushing file
or pushing files to a device device into
a folder that's
what um you'd use if you're pulling
local storage off of a phone you're
going to use ADB pole the trick here is
once you're rooted all the local storage
lives in that data data folder and you
have to move that from data data to like
an SD card then you can pull it because
as a regular user you're going to have
to be root at some point to get that
information off of there and then ADB
ADB install is where you side load that
IP or um
APK and when I mean side load it's just
a way to install the application without
having to use the app store and we're
bypassing
that um this is the the data data folder
that I referenced this is where all your
applications live and all their juicy
info ADB log cast
that's another good tool I like to use
at run like at runtime when the
application starts um it gives me good
error messages um sometimes developers
leave verbos logging on um debug so it's
a use it command line you output it to a
text file then you just kind of Cipher
through the text
file so we have our apks we have our
ipas
um what do we do with them next well I
like to throw them in a tool called
mobsf so
mobsf will take your IPA and your
AP and they'll basically give you this
rundown of the
application
um what kind
of URLs are in there the strings of the
application uh permissions so I go to it
a lot for permissions
certificates I reference this tool a lot
it gives me a starting point to where
I'm going to go to next when I do um the
static analysis of the
files gosh Dam
it is it how where is it
at I know
I just don't want to deal with this
anymore H we'll go back to
M some weight music mobf hi again so
this is my mob SF screen it's pretty
cool
right um there we go anyways uh as you
can see there's a permission screen you
get a lot of good information from that
so I just you get a report download too
I just use it as a point of reference it
also will pull down your Java your Java
files too so you don't have to decompile
them it's great I love the tool um it's
not as good with the IPA file but uh I
feel like I side more sometimes with
Android testing it's a bit more easy
like bit easier to go
through so did it go to the next next
slide all right um next on my list I
know I'm kind of bouncing around but I
had to get like everything in that I
wanted to certificate pinning so after I
get those apks in um I want to kind of
dynamically test that application but
first I want to make sure on my this is
specifically for iOS is I want to make
sure my spe um my certificate pinning is
handled so SSL kill switch to that's
going to to help you with your C
pinning um that is something you're
going to find in
Cydia
and the repo package is up on the screen
if you can still see it uh basically
city is going to install it you just
slide that thing over the little toggle
and then you'll be able to um bypass
that certificate pinning so it's pretty
cool I I use it quite often
um and then burp site I use burp site a
lot kind of live in burp
sweet
God what a
tragedy I should just turn the screen
around and be like just
visualize is there a different
one all right next on the list this is
where things start to get a little crazy
Freda uh so freda's Dynamic
instrumentation basically we're now
hooking into the processes of the
application um my first tool that I use
is freed dump freed dump uh open source
it runs off of freed to framework I use
it for memory
dumping um basically you run get the
process ID of the application you run
that dump from there it outputs a
file um what I'm looking for
did it
change is it still free is it free
dump
my this is this is so
good you think is there a different one
or is it just my
[Music]
computer
okay
[Music]
we Freedom you just have to take my word
for
it
okay still up there all right what am I
looking for
credentials um usernames passwords IP
addresses uh I get a lot of good stuff
from
that we still on we still good okay um
objection objection lives off of the
Freeda framework this has become my most
favorite tool to use because um supports
both Android and iOS I use it a lot to
byass SSL pinning for Android I dump
keychains um
basically you start memory related tasks
and manipulate the application
so all right
so objection so when we run objection
you have to have INF frea
installed um you'll run
objection you'll run the process name so
whatever the application name is explore
from there it will give you menu options
that you can go ahead and go
through still on the we still going um
my favorite ones to go through Android
SSL pinning
disabled so that's the CT pinning that
we're disabling root disable that's fun
when you get to root disable so a lot of
applications banking applications will
have root detection if you can bypass
that root detection with this with
objection I use that a lot um key store
we'll see if they're using the key store
list right and then hooking classes to
see
um so maybe we can't bypass that route
disable let's hook into the classes and
see if we can change uh the application
and disable that
route still good all right on to iOS NS
user defaults hooking
classes um I wrote that twice credential
storage dumps keychains cookies the
these are all things I use in a typical
audit just to gather information I want
to make sure that they're using the
keychain right
um and just to gather information
sometimes people will put the weirdest
things in cookies like passwords and
long uh tokens and stuff that don't need
to be there so
yeah so if objection doesn't work I have
some other root
bypasses uh Magic
hide is an option in
magisk that um you can set up that
will basically add an app onto your
phone that makes it look like makes you
look like you're coming from different
like a calculator traffic and so it will
hide your root detection so when apps
are built and they have root detection
they're looking for magest they're
looking for
um all that rooted software so same
thing with iOS ihde Shameless plug plug
for my boss he created this um this is
bypassing jailbreak
detection and then he is also looking
for um like just like the apps they're
looking for Cydia they're looking for
jailbreaks uh uh uncover they're looking
for that software on the device at run
time and they're not allowing the
application to run so this um jailbreak
bypass stops that from happening Liberty
light is another one as well the it was
it frozen God damn
it supp this is supposed to be
easy don't go back and tell them that my
first talk was a train wreck it's not my
fault cool Liberty
light um same thing uh this is for iOS
uh iide was for
iOS this is installed via Cydia so like
I said Cydia everything that I'm talking
about could probably be a whole another
talk so if you have questions afterwards
please come uh talk to me I'll talk
about mobile all day so these are two
tools that I found that help me bypass
jailbreak
detection uh back to Android decompiling
so looking at the app internally um
doing static analysis seeing what is in
the code I use this it's a nice gooey uh
um it's better than taking a Sublime
Text Editor and going and clicking
through each tab to try to
read the code
so what am I looking for when I get into
these apps I'm looking for well former
job I'm looking for Mau but Secrets Keys
credentials URLs Uris a IP IP addresses
and email
addresses
um yeah that's I'm basically looking for
any information that I can use to maybe
jump to my
next um Target in a in an audit or
something that can gain better access in
that
application some training materials that
I
used so
I Shameless plug for trusted sick blog
so we're trying to build the mobile team
up so but OAS mobile security testing
guide um that's one that I live off of
for quite some time when I first got
started um that's just my go-to and then
now I guess when I started Mobile in
2018 versus now like there's so much
more documentation and people are
blogging more about um mobile
so it's easier to Google a question or
like a couple years ago it was um just
figured out and hope for the best so
sorry that my uh my slide deck was a
little wonky but does anybody want me to
go back to anything or re-explain
something oh wait I only have four
minutes left so
it did freeze again well fre that's how
I
it but I'm
Whitney