Getting started with Android pentesting

Getting started with Android pentesting

• 1.
  MINALI ARORA
• 2.
   A cybersecurity professional with almost 6 years of experience  Demostrated areas of work- Application & Network Pentesting, Bash Scripting and Red Teaming  Part time bug bounty hunter and blogger https://medium.com/@minaliarora  Follow me on twitter: @AroraMinali
• 3.
   Android Overview Android Architecture  Android Security Model  Android App Testing  OWASP Top 10  Security tips for Developers
• 6.
   Android’s SecurityModel consists of two parts: ◦ UID Separation ◦ Sandboxing Linux Kernel offers unique UID and GID for each application at run time. Thus, an application runs in its own sandbox environment and does not affect any other apps running.
• 8.
  AndroidManifest.XML Classes.dex Resources.arsc Assets Folder Lib Folder META-INFFolder Res Folder Other Files
• 10.
   Root yourdevice (If you choose an emulator, then make sure that it is already rooted)  Allow unknown sources (Settings->Security)  Install the application  Connect the device/emulator to a proxy setup (for e.g. Burp)
• 12.
  Methodology of testingan Android application can be broadly divided into two categories:  Static Testing  Dynamic Testing While static testing includes reversing an android application and reading the code, Dynamic testing includes analyzing the network traffic
• 15.
   Android SDK:A software development kit containing API libraries and developer tools to build, test and debug Android apps In our context , more important ones are adb, apktool, and the emulator
• 16.
   Android DebugBridge: Command line tool to communicate with emulator instance or connected physical/virtual device  Useful Commands:  adb devices  adb connect  adb shell  adb install  adb push/pull
• 17.
   apktool: isused to decode and reverse engineer android application Command: apktool d <apk file>
• 18.
   dex2jar –convertsdex file to jar containing reconstructed source code which can be viewed in jdgui
• 19.
   AndroidManifest.xml- Thisfile contains all application components and application permissions
• 20.
   Drozer  BurpSuite  Droidbox  MobSF  Inspeckage
• 21.
   Drozer: Oneof the most chosen tools for Android security testing. A security testing framework, great to determine app attack surface and interact with it.
• 23.
  Most common vulnerabilitiesfound during Android application testing:  OTP bypass  Authentication bypass  IDOR  Information Leakage  Privilege Escalation
• 26.
   Store datasafely  Enforce secure communication  Use web view objects carefully  Provide the right permissions to application  Update security provider to protect against exploits  Share only sensitive data to cache files  Use shared preferences in private mode https://developer.android.com/topic/security/best- practices