Ethical Hackers Inoburitsa Mabatiro Ekuita Chero Chero Chishandiso Chefoni (Pamutemo!)

Funga nezve mobile app , yakabata zvese kubva pamapassword evashandisi kusvika kune yekubhadhara mari. Semuyedzo wekupinda, basa rako ndere kuona kuti vault yakavharwa zvakasimba-nguva refu murwi chaiye asati aedza kupaza. Mugwaro iri, tinokufambisa kuburikidza , kubva pakuunganidza maturusi akakodzera kusvika. kuongorora kodhi uye traffic. Ngatisvetukira mukati! sedhijitari vault nehurongwa hwese hwekupinda panhare Nhanganyaya Isu tinorarama munyika umo nharembozha dzinenge dziri kuwedzera isu pachedu. Nekuti vanhu vanoita kwavo, , uye pamafoni, kuve nechokwadi kwakakosha. Ndosaka nhare yepentesting ichinetsa: isu tinotevedzera kurwiswa neapps kuratidza kusasimba uye kubatsira vanogadzira kuzvigadzirisa. kubhengi kutenga kushamwaridzana chekuchengetedza app Hezvino izvo zvirimo kwauri: : Hauzorasikirwe nehope pamusoro pekudonhedza data kana zvitupa zvakabiwa. Runyararo rwePfungwa : Vatongi (uye vashandisi vako) vanoda mitemo yakasimba yekudzivirira. Kuteerera : Mapurogiramu akachengeteka anoreva vatengi vanofara uye njodzi shoma yemisoro isina kunaka. Reputation Boost Chii chinonzi Mobile Pentesting? Pakati payo, ndeyekutsvaga nzira dzekugadzira dzekupinda muapp-sezvinoita munhu anorwisa chaiye-kuti utange wagadzirisa kusasimba. Izvo zvakasiyana neyakajairwa pawebhu pentesting nekuti nharembozha: nhare yepentesting : Android uye iOS imwe neimwe ine yayo mitemo, mhando dzekuchengetedza, uye quirks. Mhanya paMapuratifomu Akasarudzika : Ruzivo rwesensitive runogona kuchengetwa munharaunda, zvichiita kuti zvive zvakakosha kuti uongorore mudziyo-chaiwo kuchengetedza. Chengetedza Dhata paZvishandiso : Zvishandiso zvefoni zvinowanzo taura nemasevha ekudzokera kumashure kuburikidza neAPIs, izvo zvinogona kunge zvisina kurongeka kana kutambura kana zvisina kuedzwa nemazvo. Vimba Zvakanyanya pamaAPI Matambudziko akajairwa anosanganisira kubata nemudzi , kupfuura , uye kuongorora ese ari maviri uye logic. / jeri rekuona SSL pinning mutengi-parutivi server-parutivi Zvakajairwa Kutyisidzira kune Mobile Applications Fungidzira nhare yeMiddle Ages—idzi ndidzo “nzvimbo dzisina simba” dzinonangwa nevanorwisa: Kusachengeteka Data Kuchengeta Masensitive tokens kana zvitupa zvemushandisi zvinosiiwa zvisina kunyorwa pachigadzirwa. Yakaneta Server-Side Controls Isipo yekusimbisa yekupinda kana kukanganisa API logic iyo matsotsi anogona kushandisa. Insufficient Transport Layer Protection Kushandisa HTTP kana HTTPS isina kukanganisa, inobvumira vanorwisa kubata kana kugadzirisa network traffic. Kusachengeteka Kutendesa & Mvumo Zvisina kuisirwa zvisizvo zvekupinda masisitimu, masesheni manejimendi, kana mvumo yekutarisa. Client-Side Vulnerabilities Kodhi inogona kudzoserwa kumashure kuti iburitse zvakavanzika, kana pfungwa dzinogona kushandiswa panguva yekumhanya. Tarisa uone iyo uye iyo kune zvimwe pane idzi njodzi. Dzakafanana dzinoratidza zvese zvingangoitika. OWASP Nhare yepamusoro gumi Mobile Chikumbiro Chekuchengetedza Yekuongorora Guide (MASTG) nemepu Gadzirira Kuongororwa Kwenhare Usati waparadza nhare, unoda . Mukutaura kwepentesting, zvinoreva kumisikidza nharaunda yaunogona kuedza zvakachengeteka pasina kukuvadza data renyika chaiyo. Ngatifungei nezve izvo zvekutanga zveese Android uye iOS. nhumbi dzokurwa uye zvombo Android Paunenge uchiyedza maapuro eAroid, unogona kupenengura zvishandiso uchishandisa maturusi akaita se kana . Aya emulators anokuita kuti uise uye uedze maapplication nekukurumidza usingade chimbo chemuviri. Matanho akadzama ekugadzira imwe anogona kuwanikwa mune . Android Emulator Genymotion ino gwara Android Emulator Zvakadaro, kushandisa kazhinji unoburitsa mhedzisiro chaiyo-kunyanya kana iwe uchida kuyedza mamiriro etiweki epasi rese, masensa, kana biometric authentication. Kana iwe uri kuronga mimwe miedzo yepamberi senge kana zvakadzama data forensics, kuve nehardware chaiyo chinhu chikuru chekuwedzera. mudziyo wepanyama midzi cheki Kana ukafunga kutenga kana kukwereta mudziyo wakatsaurirwa, ramba uchifunga kuti mamwe mafoni eAroid ari . Rooting inokupa iwe kupinda kwakadzama kune iyo inoshanda sisitimu, ichikubvumidza kuti uongorore mafaera akavanzika, bypass zvirambidzo zveapp, uye mhanyisa maturusi ane simba anoda mvumo yakakwira. nyore kudzura Rooting yakafanana nekutsvaga skeleton kiyi kune yako foni yekushandisa system. Kazhinji, iwe ucha: Android Rooting Vhura iyo bootloader. Ratidza tsika yekudzoreredza (semuenzaniso, TWRP). Isa mudziyo wekushandisa midzi kana . seMagisk SuperSU Imwe neimwe nhare uye OS vhezheni ine quirks dzayo, saka gadzirira kuyedza mishoma. Nhau dzakanaka ndedzekuti kana mudziyo uchinge wadzika midzi, unogara wakadaro kunze kwekunge iwe wagadzirisa fekitori kana kusimudzira firmware. Ramba uchifunga kuti iOS jailbreaks inogona kurasika mushure mekutangazve-saka Android dzimwe nguva inopa inoenderera mberi chikuva chekuyedza. Gara uchitevera madhairekitori akavimbika efoni yako chaiyo - kudzika midzi kwakashata kunogona kukanganisa software kana kuunza maburi ekuchengetedza. Uye, chokwadi, usati wanyura mukati! chengetedza data rako Muenzaniso wekudzura Pixel 3a Proxy Funga nezve seBurp Suite se "spyglass" yako. Iyo inoita kuti iwe uone uye uchinje traffic yese inopinda nekubuda muapp. Iwe uchabata kusachengeteka kutaurirana, chokwadi chisina kunaka, kana zvikumbiro zvine mumvuri. Kumisikidza proxy yenharembozha kwakafanana paIOS uye Android. Iwe unogona kuwana mirairo yepamutemo yepuratifomu yega yega . proxy pano Zvinhu zvinonetsa nemamwe masisitimu: dzimwe nguva inofuratira system-yakafara proxy marongero nekuda kwetsika networking maraibhurari. Xamarin inogona kuremekedza proxies asi inogona kumanikidza , ichikuvharira kubva pakuona traffic. Flutter chitupa pinning Kuti ukunde zvipingaidzo izvi, unogona kugadzirisa kodhi, shandisa maturusi akaita kana kudzima pinning kana kuseta reverse proxies (semuenzaniso, ) kutora traffic. Kugadzirisa maitiro ako chikamu chekunakidzwa! saFrida Objection mitmproxy Kuiswa kweApp Kana iyo app isiri paGoogle Play Store parizvino-yakajairika kumapentest-iwe ungangove uine yekuisa parutivi. Iwe unogona kugovera iyo APK kuburikidza neGoogle Drive kana yakananga yekurodha link. Imwe sarudzo iri nyore kushandisa , iyo inoronga kuyedzwa nekutumira kukoka kune vanobatana. APK faira Firebase App Distribution iOS PaIOS, chinopawo ruzivo rwechokwadi rwekuyedza. Iwe unogona kunyura mukati me Hardware-chaiwo maficha akadai seFace , , uye masensor uku uchitorawo realistic network yekudyidzana. Kana iwe uchitenga kana kushandisa mudziyo wega, funga mamodheru anozivikanwa kuve akareruka kune (sezvo asiri ese maPhones ane hushamwari kune iyi maitiro). Kana iwe uchida chaiwo iOS zvishandiso, inopa yakasimba-yakavakirwa gore-yakavakirwa bvunzo, kunyangwe isiri yemahara. Vazhinji vaedzi vachiri kuvimba nechishandiso chemuviri kuti vanyatsoongorora. chishandiso chemuviri ID Bata ID jailbreak Corellium Jailbreaking inonzwa zvakanyanya sekubvisa machira anoiswa neApple pamidziyo yayo. Iwe unowana midzi ropafadzo, kukurega iwe kuisa tweaks, kuongorora yakavanzika mafaira madhairekitori, kana kumhanya yepamusoro pentesting zvinyorwa. Zvishandiso zvakakurumbira zvinosanganisira uye . Sarudzo yakanakisa inotsamira pane yako iOS vhezheni uye mudziyo modhi. iOS Jailbreaking unc0ver Checkra1n Rangarira: Zvishandiso zvitsva zvinogona kuomarara kune jailbreak. Mamwe mabreak ejeri haapone pakatangazve ("semi-untethered"). Gara yako iPhone usati wakanganisa nemafaira ehurongwa. uchitsigira Ziva zvakare kuti mamwe maseru edziviriro anodzoserwa otomatiki kana mudziyo wako uchitangazve, saka ungangoda re-jailbreak pese paunosimuka. Kuiswa kweApp Maapplication eIOS anouya ari mafaera-akafanana nemaAPK paAroid. Pafoni yakavharwa nejeri, unogona kuisa IPAs uchishandisa vatariri vefaira kana mapurogiramu akaita . Kuti uwane imwe nzira yepamutemo, vanogadzira vanowanzovimba , iyo inoita kuti vakoke vaedzi kuburikidza neemail-ingobaya chinongedzo, uye iOS inobata zvimwe. IPA seFilza seSideloadly neTestFlight Kumisikidza nharaunda yako nemazvo - kusarudza michina yakakodzera (chaiyo kana yemuviri), kugadzirisa maproxies, uye kunzwisisa nzira yekuisa parutivi maapplication-inovimbisa kuti uchave wakagadzirira mukati mekushanda kwemukati kweapp. Zvinogona kutora kutekenyedza, asi kana iwe uine iyo yakakwana setup, iyo chaiyo pentesting inogona kutanga! kunyura kwakadzika Static Analysis (SAST) Zvino ngatienderere mberi nekuongorora iyo app pachayo-pasina kuimhanyisa zvizere. Izvi zvakafanana nekuverenga purani yenhare usati wapinda mukati. Isu tinotarisa , , uye zvimwe zvinhu mukodhi kana config mafaira. zvakavanzika zvakaomeswa zvigadziriso zvisina kuchengeteka Nzvimbo Dzakakosha Kutarisisa Hardcoded Secrets API makiyi, tokens, zvitupa, uye encryption makiyi dzimwe nguva anoguma akananga mune kodhi kodhi. Kana vanorwisa vakadzora-injiniya app, vanogona kuburitsa zvakavanzika izvi nekuedza kushoma uye kutevedzera vashandisi kana masevhisi. Kusachengeteka Magadzirirwo Mvumo dzemvumo dzakawandisa, mireza yekugadzirisa yakasiiwa yakagoneswa, kana kusaina zvisina kufanira zvese zvinogona kubaya maburi munhumbi dzekuzvidzivirira dzeapp. Chimiro chimwe chete-seNSAllowsArbitraryLoads muIOS Info.plist kana android:debuggable="true" -inogona kuvhura musuwo wekuti man-in-the-middle (MITM) kurwisa kana kugadzirisa zvisina kudzivirirwa. Sensitive Data Exposure Kuchengeta ma tokeni echikamu kana ruzivo rwemunhu mune zviri pachena zvinyorwa pachishandiso (matanda, zvakagovaniswa zvaunofarira, mafaera emunharaunda) inzira yenjodzi. Chero ani ane ruzivo rwemuviri kana foni yakadzika midzi / jeri yakavhunika anogona kutenderera achiba data rakakosha-hapana hutsinye hunodiwa. App Logic uye Zvikanganiso Kazhinji, nyaya dzemidzi dzinobva pamashandisirwo anoitwa zvinhu. Kana macheki akakosha — senge chokwadi — akashaikwa kana kuti akasanyanyiswa, vanokurwisa vanogona kupfuura kudzivirira kwako nyore. Saizvozvo, zvisina kusimba cryptographic mabasa kana zvisina kuchengetedzwa maapps zvinogona kuita kuti hupenyu huve nyore kune chero munhu ari kuongorora app yako. MSTG Checklist Iyo inopa yakakwana yekutarisa kuti ikubatsire kugadzirisa static ongororo nenzira: Mobile Security Testing Guide (MSTG) [ ] : Sensitive data haina kuchengetwa isina encrypted pamudziyo. MSTG-STORAGE-1 [ ] : Hapana data inonzwisisika inochengetwa munzvimbo yekugoverana. MSTG-STORAGE-2 [ ] : Kushandiswa kwakakodzera kwecryptographic algorithms nemaraibhurari. MSTG-CRYPTO-1 [ ] : Chengetedza nzira dzekukurukurirana (semuenzaniso, HTTPS/TLS). MSTG-NETWORK-1 [ ] : Kusavapo kwezvakavanzika zvakaomeswa mukodhi yekwakabva. MSTG-CODE-1 [ ] : Code obfuscation inoshandiswa nemazvo. MSTG-CODE-3 [ ] : Dziviriro kubva kune reverse engineering. MSTG-RESILIENCE-1 [ ] : Kugadzirisa zvikwanisiro kwakaremara mukugadzira. MSTG-RESILIENCE-2 [ ] : Kubata kwakakodzera kwemvumo dzevashandisi uye data yakavanzika. MSTG-PRIVACY-1 SAST Zvishandiso Zvishandiso zvakasiyana-siyana zvinogona kukubatsira kupatsanura kodhi yako, magadzirirwo, uye mabhinari pasina kumhanyisa app: MobSF (Mobile Security Framework) : Bakira APK/IPA uye MobSF ichagadzira rondedzero yakadzama: inonyora zvisizvo zvingangoitika, mvumo yekufungidzira, kana zvakavanzika zvakaomeswa. Shandisa : Iyo ine zvakare mamwe maficha ane simba, ichiiita yakatsvinda yese-mu-imwe mhinduro. Bhonasi (Android) APKTool : Gadzirisa uye wozodzosera APK kuti uone zviri mukati. Izvi zvakanakira kuverenga AndroidManifest.xml, kuongorora zviwanikwa, kana kugadzirisa app. Shandisa apktool d app.apk -o output_director (Android) JADX : Shandura Dalvik bytecode (.dex) kuita Java inoverengwa. Yakanakira kuona mitsara yekodhi ine njodzi inogona kuitika, senge API kiyi. Shandisa jadx app.apk -d output_directory (iOS) Kirasi-Dump, Hopper, Ghidra : Bvisa Chinangwa-C kirasi misoro (Kirasi-Dump) kana disassemble iOS mabhinari (Hopper/Ghidra). Kana iyo app yave Swiftified, iwe uchaonawo Swift metadata. Shandisa Mienzaniso Android Kuburitswa kwemashoko Zvishandiso zveAroid zvinogona kupatsanurwa kubva kumafaira avo uchishandisa maturusi akaita , , kana . eAPK seAPKTool JADX MobSF Maitiro aya anoratidza kwaanobva kodhi, chimiro cheapp, uye zvinhu zvinonzwisa tsitsi zvakaita seAndroidManifest.xml kana .smali mafaera, anogona kuratidza zvine chekuita neapp uye mvumo. Kubvumira Cleartext Traffic Varwi vanogona kushandisa zvisina kuvharwa (HTTP) kutaurirana kuti vateerere kana kukanganisa. Debuggable Application Chero ani ane mudziyo (kana emulator) anogona kubatanidza debugger uye rummage kuburikidza neakavanzika data kana pfungwa. Hardcoded API Keys public class ApiClient { private static final String API_KEY = "12345-abcdef-67890"; private static final String API_SECRET = "superSecretPassword123!"; } Kukurumidza kudhirowa neAPKTool kana JADX inoburitsa makiyi aya, ichibvumira vanorwisa kuti vatevedzere app kana kuwana backend masevhisi vasina kutenderwa. Sensitive Data muPlaintext abc123XYZ987 user@example.com Kana tokeni kana ruzivo rwemushandisi zvakachengetwa mumavara akajeka, mudziyo wakadzika midzi unogona kuabvisa zviri nyore. iOS Misconfigured Info.plist NSAppTransportSecurity NSAllowsArbitraryLoads Apple inomanikidza kubatana kwakachengeteka nekukasira, saka kudarika izvi kunovhura iyo app kune MITM njodzi kana isina kunyorwa traffic. Zvishandiso zvekudzikisira zvakaita seKirasi , , uye inoburitsa yefaira reapp, kusanganisira makirasi eObjective-C, mazita enzira, uye mafaera ebhinari. -Dump Hopper Disassembler Ghidra IPA Dynamic Analysis (DAST) Kana static ongororo iri kudzidza purani yecastle, iri kufamba famba mukati menhare uchitarisa musuwo wega wega nehwindo. Isu tinomhanyisa app, tarisa maitiro ayo, uye toona kana isu tichigona kushandisa chero kusasimba munguva chaiyo. ongororo ine simba Nzvimbo Dzakakosha Kutarisisa Network Communication Ita shuwa kuti data yeapp yako haisi panguva yekufambisa. Kana app yako ichivimba neHTTP kana kuti HTTPS isina kurongeka, munhu anokurwisa anogona kupinda, kubata, kana kugadzirisa data. Zvakangofanana nekushaikwa kana kusasimba , kuratidza app yako kune man-in-the-pakati (MITM) kurwiswa. kubuda kweSSL/TLS chitupa kupinza Authentication & Authorization Kunyangwe kana zviratidziro zvako zvekupinda uye mabasa emushandisi achitaridzika pabepa, bvunzo chaiyo ndeyekuti mumwe munhu anogona kuvapfuura panguva yekumhanya. Semuyenzaniso, munhu anorwisa anogona here kushandisa zvekare ma tokeni echikamu kana kufungidzira? Iyo app inopera zvakanaka here kana kuti inochengeta zvikamu zvakavhurika zvachose? Runtime Kutendeseka & Chengetedzo Macheki Mapurogiramu mazhinji anoedza kuona kana mudziyo (Android) kana (iOS) wobva waramba kumhanya kana kuvharisa zvimwe zvinhu. Munguva yekuongorora zvine simba, iwe unoda kuona kana uchikwanisa kutsvedza kupfuura aya macheki nekukochekera mukodhi yeapp, kuti urambe uchiyedza zvakadaro. Kana iwe uchikwanisa kunzvenga matanho aya nyore, vanorwisa vanogona, zvakare. wakadzika midzi jailbroken Data Leakage Panguva Kuurayiwa Iyo app inonyora ruzivo rwakadzama (senge mapassword kana tokeni) mune zviri pachena? Paunochinja maapplication kana kumashure kwechishandiso, skrini inotorwa ine zvakavanzika data ichiri kuratidza? Iyi nzira yekusaziva "breadcrumb" nzira inogona kutungamirira vanorwisa kupfuma. API uye Server-Side Verification Iyo app inogona kutaridzika yakachengeteka kubva kune mutengi maonero, asi kana iyo backend API ikasasimbisa mvumo yevashandisi kana kuisa, anorwisa anogona kugadzirisa zvikumbiro panhunzi kuti awane mukana usina mvumo kana kutyora sisitimu. Izvo zvakakosha kuti uedze ese mutengi uye server maitiro mune tandem. MSTG Checklist Iyo inovharawo ongororo ine simba. Heano mamwe macheki ekuchengeta mupfungwa: Mobile Security Testing Guide (MSTG) [ ] : App inoona uye inodzivirira kukanganisa kana kudzosera kumashure mainjiniya kuedza. MSTG-RESILIENCE-1 [ ] : App inoona midzi kana jailbroken zvishandiso. MSTG-RESILIENCE-2 [ ] : App inosimbisa kuvimbika kwekodhi yayo uye zviwanikwa panguva yekumhanya. MSTG-RESILIENCE-3 [ ] : App inovharidzira traffic yese network ichishandisa yakasimba cryptography. MSTG-NETWORK-1 [ ] : App inosimbisa kupinza zvitupa pazvinofanirwa. MSTG-NETWORK-3 [ ] : App haivimbi nepuratifomu kuchengetedza nzira chete uye inosimbisa matanho ekuchengetedza yakazvimirira. MSTG-PLATFORM-1 [ ] : App inonyatso shandisa nguva yekubuda kweseshini uye zvinodiwa nemushandisi-kusimbisazve. MSTG-AUTH-2 [ ] : App haitore data yakavanzika kune system logs. MSTG-STORAGE-4 [ ] : App haichengete data inodzika munzvimbo isina kuchengeteka. MSTG-STORAGE-5 [ ] : App inoshandisa up-to-date cryptographic algorithms for runtime operations. MSTG-CRYPTO-1 Funga nezveizvi semugwagwa dzako dzepasirese. Ivo vanokubatsira zvakarongeka kubaya pamusuwo wega wega nepahwindo kuratidza kuti rakakiyiwa. webvunzo DAST Zvishandiso Kusiyana neSAST, iyo inotarisa pakuongorora kodhi, DAST inotenderera app uye kutarisa. Pazasi pane maturusi ane mukurumbira kuita kuti maitiro acho ave nyore: nekumhanyisa / Burp Suite OWASP ZAP : Ese ari maviri ari kubvunzurudza ma proxies anokurega iwe kutora uye kugadzirisa traffic pakati peapp uye backend maseva. Yakanakira kuona magumo asina kuchengetedzeka, zvikanganiso zvesesheni, kana kuburitswa kwedata. Shandisa Frida : Chishandiso chekushandisa chekushandisa chinokochekera mukuita maitiro, chichikubatsira kupfuura SSL pinning, kuona mudzi/jailbreak, kana zvimwe zvinorambidzwa nevatengi. Shandisa Common Frida Commands Chiito Command Batanidza kune Running process frida -U -n Nyora Zvese Running Maitiro frida-ps -U Bayai Custom Script frida -U -n -c script.js Tsanangura Zvakananga Mabasa frida-trace -U -n Hook a Specific Function frida -U -n --eval 'Interceptor.attach(Module.findExportByName(null, "function_name"), { onEnter: function (args) { console.log(args[0].toInt32()); } })' (Android) Drozer : Inotarisa pakuongorora zvinhu zveAndroid zvakaita seZviitwa, Masevhisi, Broadcast Receivers, uye Vanopa Zvemukati kune kusasimba kwekuchengetedza. Shandisa Common Drozer Commands Chiito Command Batanidza kune Chishandiso drozer console connect Nyora Zviito run app.activity.info -a Bata neZviitwa Zvinotengeswa kunze kwenyika run app.activity.start --component Muedzo weSQL Injection run scanner.provider.injection -a kuramba : Yakavakwa paFrida, asi nemirairo iri nyore yemabasa sekudzima SSL pinning kana kuongorora iyo app's file system. Yakakwana kana usiri scripting guru. Shandisa Common Objection Commands Chiito Command Batanidza kune Running App objection -g explore Dzima SSL Pinning android sslpinning disable / ios sslpinning disable Dhinda Ruzivo rweMashandisirwo android application info or ios application info Mienzaniso Android Network Interception & Kugadziriswa Nekufambisa Android traffic kuburikidza nechishandiso chakaita seBurp , vaedzi vanogona kubata nekugadzirisa zvikumbiro. Semuyenzaniso, kana app ikatumira magwaro pamusoro peHTTP kana kuti ikatadza kuburitsa zvitupa zveTLS nemazvo, anorwisa anogona kuita kurwisa. Suite man-in-the-pakati (MITM) POST /login HTTP/1.1 Host: api.example.com Content-Type: application/json { "username": "test_user", "password": "secret_password" } Session tokens, data rako pachako, kana ruzivo rwekubhadhara zvinogona kuburitswa pachena kana kushandiswa. Debug Logs Inoburitsa Sensitive Data 03-09 12:34:56.789 1234 5678 I MyAppLogger: User token = "abc123XYZ987" 03-09 12:34:56.789 1234 5678 I MyAppLogger: Payment info: "card_number=4111111111111111" Chero ani ane (kana app ine hutsinye) anogona kuverenga matanda aya nekuashandisa. ADB Zviitiko Zvisina Kuchengetedzeka / Vanopa Zvemukati Uchishandisa , vaedzi vanogona kuwana zviitiko zvinotengeswa kunze kwenyika kana vanopa zvemukati izvo zvisingade humbowo. Drozer drozer console connect run app.provider.query content://com.example.app.provider/users Kana data ikadzoserwa pasina mvumo yakakodzera, vanorwisa vanogona kuverenga kana kugadzirisa ruzivo rwemushandisi. Bypassing Root Detection Zvishandiso zvakaita kana zvinokutendera kuti upfuure kuona midzi kana SSL pinning cheki panguva yekumhanya: seFrida Objection frida -U -n com.example.app --eval "..." objection -g com.example.app explore android sslpinning disable android root disable ios sslpinning disable ios root disable Vanorwisa pamafoni akadzika midzi vanogona kuenderera mberi nekuyedza kana kupinda mumabasa akajeka, kuburitsa zvakavanzika kana kukanganisa app logic. iOS Jailbreak Detection Bypass Mazhinji maapplication eIOS haashande kana akaona foni . , unogona kukochekera uye kupfuudza nzira yekuona: yakaputsika NaFrida Interceptor.attach(Module.findExportByName(null, "jailbreakDetectionFunction"), { onEnter: function (args) { console.log("Bypassed jailbreak check!"); // Force return a 'clean' status } }); Vanorwisa vanogona kumhanyisa app pamidziyo yakakanganiswa uye kutsvaga kuburikidza nedata kana hoko. Sensitive Data muSystem Logs 2023-03-09 12:34:56.789 MyApp[1234:5678] Payment info: card_number=4111111111111111 2023-03-09 12:34:56.789 MyApp[1234:5678] session_token=abc123XYZ987 Pamidziyo yakapwanyika yejeri—kana kuti kuburikidza nekuunganidza matanda ekunze—vapambi vanokohwa data rakavanzika zvakananga. Matambudziko Akajairika muMobile Pentesting : Zvishandiso zveAroid zvinosiyana zvakanyanya mushanduro dzeOS, tsika maROM, uye magadzirirwo emugadziri, zvichiita kuti kuyedzwa kuve kwakaoma. Platform Fragmentation : Zvimiro zvakaita seSSL pinning, midzi / jailbreak yekuona, uye obfuscation inogona kutadzisa pentesting. Mashandisiro Ekuchengetedza Matanho : dema-bhokisi kuyedzwa kazhinji kunoda reverse engineering nemidziyo yakaita seAPKTool kana JADX, iyo inogona kutora nguva. Yakaganhurirwa Kuwana Kunobva Kodhi : Sandboxing, ndangariro dziviriro, uye kudiwa kwemidziyo yakadzika midzi/yakavhunika jeri kunoomesera bvunzo dzepasirese dzekufambiswa kwebasa. Dynamic Analysis Zvirambidzo Zvishandiso zvakaita , , uye zvinova zvakakosha pakunzvenga. Kuchengetedzwa Kwenetiweki uye Kuongorora Kwemigwagwa seFrida Burp Suite mitmproxy Mibvunzo Inowanzo bvunzwa (FAQ) Chii chinonzi mobile pentesting? Iri kuyedza kuti nharembozha yakachengeteka sei nekuteedzera kurwiswa kwepasirese - kutsvaga chero makatsemuka vasati varwisa. Sei mobile pentesting yakakosha? Nekuti mafoni ane huwandu hukuru hwe data remunhu neremari, ndiwo anotariswa zvakanyanya nematsotsi. Ndeapi matanho makuru? Gadzira nharaunda inodzorwa, ita static ongororo (SAST), ita dynamic analysis (DAST), zvinyorwa zvakawanikwa, uye ongororazve mushure mekugadzirisa. Ndeapi maturusi andinoda? Burp Suite kana ZAP yekuvharira traffic, MobSF yema scans, APKTool/JADX (Android), Kirasi-Dump/Hopper (iOS), pamwe nekukochekera maturusi seFrida kana Objection. Tinofanira kunyengetera kakawanda sei? Mushure mekuvandudzwa kukuru, maitiro matsva, kana shanduko yakakosha yezvivakwa. Zvakanaka, zvibatanidze muCI/CD kuti irambe ichitariswa. Ndezvipi zvinowanzoitika? Kusachengeteka kwekuchengetedza data, hapana HTTPS, zvakavanzika zvakaomeswa, hurombo hwesesheni manejimendi, uye zvisizvo maAPI. Zvese zvinogona kuve otomatiki? Kwete saizvozvo. Zvishandiso zvinogona kuita otomatiki mamwe ma scans, asi manyorero ekuongorora anoburitsa trickier logic kukanganisa kana yakaoma bhizinesi mitemo. Tinofanira kuedza zvose Android uye iOS? Ehe, imwe neimwe ine yakasarudzika mamodhi ekuchengetedza uye misungo. Zviri pamutemo here kupentest? Chokwadi, kana uine mvumo yakajeka kubva kumuridzi weapp. Zvikasadaro, hazvisi pamutemo. Ndotangira papi? Dzidza iyo , dzidza kudzosera kumashure, uye dzidzira uine yakavhurika-sosi maapplication kana sampuli zvinangwa. OWASP Mobile Security Testing Guide (MASTG) Mhedziso Kupinda kwenharembozha kwakafanana kukuru - unotanga nekuunganidza giya (maturusi nemidziyo), nzvimbo (SAST), wozopedzisira (DAST) kuti uwane pese pasina kusimba. Nekuita izvi nguva nenguva uye nekutaura zvaunowana, iwe unochengeta maapplication ako akasimba uye vashandisi vako vakachengeteka. nekutsvaga wozoongorora wotora mawoko ekusvika Rangarira: software inoshanduka mazuva ese, uye ndizvo zvinoitawo kutyisidzira. Ita kuti pentesting chikamu chekukura kwako kwehupenyu-nekuti nzira yakanakisa yekuchengetedza humambo kusamboregedza kungwarira kwako. ienderere mberi Nezve Munyori Ichi chinyorwa chakagadzirirwa naAnastasiia , Mutevedzeri Wekuongorora Chekuchengetedza , uye akaongororwa naAlex , CTO . ane anopfuura makore mashanu emaoko-pane ruzivo mukuyedza kupinda uye kuchengetedzwa kwekuongorora. Anonyanya kuyedza mawebhusaiti, zvivakwa (zvese zviri pa-nzvimbo uye gore), uye nharembozha (iOS uye Android). Hunyanzvi hwake hunotambanudzira Bhokisi reBlack, Bhokisi reGrey, uye White Bhokisi nzira, pamwe nehunyanzvi mukuongororwa kwekusagadzikana uye ongororo yekuchengetedza kodhi. Tolkachova paSekurno Rozhniatovskyi yeSekurno Anastasiia ane makore manomwe eruzivo mukusimudzira uye cybersecurity. Iye iAWS Open-source Contributor yakatsaurirwa kusimudzira maitiro akachengeteka ekukodha. Unyanzvi hwake hunovhara mukaha pakati pekuvandudzwa kwesoftware uye chengetedzo, zvichipa ruzivo rwakakosha mukuchengetedza mawebhusaiti emazuva ano. Alex Mobile Pentesting Guide: References Zvishandiso uye Zvishandiso Mobile-Security-Framework-MobSF Apktool jadx Burp Suite Frida Drozer kuramba Genymotion Corellium Virtual Hardware appledb.dev reFlutter platform-zvishandiso Magisk Root Checker checkra1n unc0ver Filza Vatungamiri uye Zvinyorwa OWASP Mobile Top 10 OWASP Mobile Application Security OWASP MASTG NIST SP 800-163 Dhawunirodha uye isa Android Studio Kugadzirisa mudziyo weAroid kuti ushande neBurp Suite Kugadzirisa mudziyo weIOS kuti ushande neBurp Suite Professional Kubira Xamarin apps