I-Ethical Hackers ityhila indlela yokuqhekeza kuso nasiphi na isixhobo esiselfowuni (Ngokusemthethweni!)

Cinga nge-app yeselula efana ne- , ephethe yonke into ukusuka kwiiphasiwedi zomsebenzisi kwiinkcukacha zentlawulo. Njengomvavanyi wokungena, umsebenzi wakho kukuqinisekisa ukuba ivault ivalwe ngokuqinileyo-kudala ngaphambi kokuba nawuphi na umhlaseli wokwenyani azame ukuqhekeza. Kwesi sikhokelo, siza kukuhamba ngayo , ukusuka ekuqokeleleni izixhobo ezifanelekileyo ukuya kuthi ga ngoku. ukuhlalutya ikhowudi kunye netrafikhi. Masitsibe ngaphakathi! digital vault yonke inkqubo yovavanyo oluphathwayo Intshayelelo Siphila kwihlabathi apho izixhobo eziphathwayo ziphantse zandiswa ngokwethu. Kuba abantu benza zabo, , kwaye ngeefowuni, ukuqinisekisa ukuba lubalulekile. Yiyo loo nto i-mobile pentesting ibalulekile: silinganisa uhlaselo oluchasene ne-apps ukubonisa ubuthathaka kwaye sincede abaphuhlisi bazilungise. iibhanki bethenga bencokola ukhuseleko losetyenziso Nantsi into ekuyo: : Awuyi kulahlekelwa bubuthongo ngenxa yokuvuza kwedatha okanye iziqinisekiso ezibiweyo. Uxolo lwengqondo : Abalawuli (kunye nabasebenzisi bakho) bafuna imigangatho yokhuseleko oluluqilima. Ukuthobela : Iiapps ezikhuselekileyo zithetha abathengi abonwabileyo kunye nomngcipheko omncinci wezihloko ezingalunganga. Ukunyusa iReputation Boost Yintoni iMobile Pentesting? Embindini wayo, kukufumana iindlela zokuyila zokungena kwi-app-kanye njengokuba umhlaseli wokwenyani ebenokwenza-ukuze ukwazi ukulungisa ubuthathaka kuqala. Yahlukile kwi-web pentesting esemgangathweni kuba ii-apps eziphathwayo: ukungena kwemfonomfono : I-Android kunye ne-iOS nganye inemithetho yayo, imifuziselo yokhuseleko, kunye ne-quirks. Qhuba kwii-Platforms eziZodwa : Ulwazi olunovakalelo lunokugcinwa ekuhlaleni, nto leyo eyenza ukuba kubaluleke kakhulu ukujonga ugcino lwesixhobo esithile. Gcina iDatha kwiZixhobo : Ii-apps eziphathwayo zihlala zithetha neeseva ezibuyela ngasemva ngee-APIs, ezinokuthi ziqwalaselwe kakubi okanye zibe sesichengeni ukuba azivavanywanga kakuhle. Thembela kakhulu kwii-APIs Imingeni eqhelekileyo iquka ukujongana , ukudlula , kunye nokuhlalutya zombini kunye ne logic. neengcambu / ukubhaqwa kwe-jailbreak i-SSL pinning icala lomxhasi -server-side Izoyikiso eziqhelekileyo kwizicelo zeMobile Yiba nomfanekiso-ngqondweni wenqaba yamaxesha aphakathi—ezi “zezona ndawo zibuthathaka” abahlaseli bajolise kuzo: Ugcino lwedatha olungakhuselekanga Iimpawu ezinovakalelo okanye iinkcukacha zomsebenzisi zishiywe zingaguqulelwanga kwisixhobo. Izilawuli ze-Server-Side ezibuthathaka Ukuqinisekisa igalelo elilahlekileyo okanye iingqiqo ze-API ezineziphene ezinokuxhatshazwa ngabagezeli. Ukungonelanga koMaleko wezoThutho Ukusebenzisa i-HTTP okanye i-HTTPS ephosakeleyo, ivumela abahlaseli ukuba bathintele okanye baguqule itrafikhi yenethiwekhi. Uqinisekiso olungakhuselekanga & noGunyaziso Iinkqubo zokungena eziphunyeziweyo, ulawulo lweseshoni, okanye iitshekhi zemvume. Ubuthathaka becala lomthengi Ikhowudi enokubuyiselwa umva ukutyhila iimfihlo, okanye ingqiqo enokuguqulwa ngexesha lokusebenza. Jonga i kunye ngakumbi kule mingcipheko. Zifana ezibonisa yonke imigibe enokwenzeka. -OWASP Mobile Top 10 neSikhokelo soVavanyo loKhuseleko lweSicelo seMobile (MASTG) neemephu Lungiselela uvavanyo lweMobile Ngaphambi kokuba uhlasele inqaba, udinga . Ngokwemigaqo yokuvavanya, oko kuthetha ukuseta indawo apho unokuzama ngokukhuselekileyo ngaphandle kokonakalisa idatha yelizwe lokwenyani. Makhe sigubungele iziseko zombini Android kunye iOS. isikrweqe esifanelekileyo kunye nezixhobo Android Xa uvavanya ii-apps ze-Android, unokujikeleza izixhobo ezibonakalayo usebenzisa izixhobo ezifana ne okanye . Ezi zilinganisi zikuvumela ukuba ufake kwaye uvavanye ii-apps ngokukhawuleza ngaphandle kokufuna isixhobo somzimba. Amanyathelo aneenkcukacha zokuseta enye anokufumaneka . -Android Emulator iGenymotion kwesi sikhokelo I-Emulator ye-Android Nangona kunjalo, ukusebenzisa kudla ngokuvelisa iziphumo ezichaneke ngakumbi-ingakumbi xa ufuna ukuvavanya iimeko zenethiwekhi yehlabathi yokwenyani, izinzwa, okanye uqinisekiso lwebhayometriki. Ukuba ucwangcisa iimvavanyo eziphucukileyo ezinje okanye ubunzulu bedatha yedatha, ukuba nehardware yokwenyani yinto enkulu. isixhobo esibonakalayo ngengcambu yokukhangela Ukuba uthatha isigqibo sokuthenga okanye ukuboleka isixhobo esizinikeleyo, khumbula ukuba ezinye iifowuni ze-Android . I-rooting ikunika ukufikelela okunzulu kwinkqubo yokusebenza, ikuvumela ukuba uhlalutye iifayile ezifihliweyo, uthintelo lwe-app ngaphandle, kwaye usebenzise izixhobo ezinamandla ezifuna iimvume eziphakamileyo. kulula ukuzicothula Iingcambu kufana ukufumana isitshixo skeleton kwinkqubo yokusebenza yefowuni yakho. Ngokuqhelekileyo, uya: Android Rooting Vula i-bootloader. Flash a custom recovery (umzekelo, TWRP). Faka isixhobo solawulo lweengcambu okanye . njengeMagisk iSuperSU Ifowuni nganye kunye nenguqulo ye-OS ine-quirks yayo, ngoko lungele ukuzama okumbalwa. Iindaba ezimnandi zezokuba xa isixhobo siqanduselwe, sihlala sihlala sinjalo ngaphandle kokuba useta ngokutsha okanye uphucule i-firmware. Gcina ukhumbula ukuba i-iOS ye-jailbreaks inokulahleka emva kokuqalisa kwakhona-ke i-Android ngamanye amaxesha inikezela ngeqonga elizingisayo lokuvavanya. Ngalo lonke ixesha ulandela izikhokelo ezithembekileyo zefowuni yakho ethile-i-rooting engafanelekanga inokonakalisa isoftware okanye ingenise imingxunya yokhuseleko. Kwaye, ewe, ngaphambi kokuba ungene! gcina idatha yakho Umzekelo wokucothula iPixel 3a Ummeli Cinga onje ngeBurp Suite njenge "spyglass" yakho. Ikuvumela ukuba ubone kwaye uguqule yonke i-traffic engena kwaye iphuma kwi-app. Uya kubamba unxibelelwano olungakhuselekanga, ukuqinisekiswa okungalunganga, okanye izicelo ezinomthunzi. Ukuseta ummeli weselula kuyafana kwi-iOS kunye ne-Android. Unokufumana imiyalelo esemthethweni yeqonga ngalinye . ngommeli apha Izinto ziba nzima ngesikhokelo esithile: Ngamanye amaxesha iyayihoya imimiselo ye-proxy yenkqubo ngokubanzi ngenxa yamathala eencwadi othungelwano. i-Xamarin inokuhlonipha i-proxies kodwa inokunyanzelisa , ikuthintele ekujongeni itrafikhi. I-Flutter ukuqholwa kwesatifikethi Ukoyisa le miqobo, unokwenza ikhowudi, sebenzisa izixhobo ezinje okanye ukucima ukuphina okanye ukuseta umva iiproxies (umzekelo, ) ukubamba itrafikhi. Ukulungelelanisa indlela yakho yinxalenye yolonwabo! ngoFrida i-Objection mitmproxy Ukufakela usetyenziso Ukuba usetyenziso alukho kuGoogle Play Store okwangoku-iqhelekile kwiipentest-unokuba yokuyilayisha ecaleni. Ungabelana nge-APK nge-Google Drive okanye ikhonkco lokukhuphela ngokuthe ngqo. Enye inketho efanelekileyo kukusebenzisa , eququzelela uvavanyo ngokuthumela izimemo kwabachaphazelekayo. nefayile ye-APK i-Firebase App Distribution iOS Kwi-iOS, sikwabonelela ngamava ovavanyo lokwenyani. Unokuntywila kwiimpawu ezithile zehardware ezinje nge , , kunye nezinzwa ngelixa ubamba unxibelelwano oluyinyani lwenethiwekhi. Ukuba uthenga okanye usebenzisa isixhobo somntu, qwalasela iimodeli ezaziwa zilula kwi (kuba ingezizo zonke ii-iPhones ezinobuhlobo ngokulinganayo kule nkqubo). Ukuba ufuna izixhobo ze-iOS ezibonakalayo, ibonelela ngovavanyo olunamandla olusekwe kwilifu, nangona ingasimahla. Uninzi lwabavavanyi basaxhomekeke kwisixhobo somzimba ukuze kujongwe ngokucokisekileyo. isixhobo somzimba -ID yoBuso i-ID yokuchukumisa -jailbreak iCorellium Jailbreaking ivakalelwa kakhulu njengokususa ii-padlocks ezibekwe ngu-Apple kwizixhobo zayo. Ufumana amalungelo eengcambu, ikuvumela ukuba ufake i-tweaks, ujonge abalawuli beefayile ezifihliweyo, okanye uqhube izikripthi zokuhlola eziphambili. Izixhobo ezidumileyo ziquka kunye . Olona khetho lufanelekileyo luxhomekeke kuguqulelo lwakho lwe-iOS kunye nemodeli yesixhobo. I-iOS Jailbreaking unc0ver neChecker1n Khumbula: Izixhobo ezitsha zinokuba nzima kwi-jailbreak. Ezinye iindawo zokuqhawuka entolongweni azisindi xa kuphinda kuqaliswe (“semi-untethered”). Soloko i-iPhone yakho ngaphambi kokungcolisa iifayile zenkqubo. ugcina Kwakhona qaphela ukuba iileya ezithile zokhuseleko ziphinde zisebenze ngokuzenzekelayo xa isixhobo sakho siqala kwakhona, ngoko unokufuna ukuphinda ube ne-jailbreak ngalo lonke ixesha uvula amandla. Ukufakela usetyenziso Ii-iOS zokusebenza ziza kwiifayile -ezifana nee-APK kwi-Android. Kwifowuni ye-jailbroken, unokufaka ii-IPA usebenzisa abaphathi njengeFilza okanye ii-apps ezifana . Ngomzila osemthethweni, abaphuhlisi bahlala bexhomekeke kwi , evumela ukuba bameme abahloli nge-imeyile-cofa nje ikhonkco, kwaye i-iOS iphatha abanye. ze-IPA befayile ne-Sideloadly -TestFlight Ukuseta indawo okuyo ngokufanelekileyo-ukhetha izixhobo ezifanelekileyo (ezokwenene okanye ezomzimba), ukuqwalasela iiproxies, kunye nokuqonda indlela yokukhuphela ecaleni ii-apps-ukuqinisekisa ukuba uya kulungela ekusebenzeni kwangaphakathi kwe-app. Kusenokuthatha ukukhenkceza, kodwa wakuba ulufumene olo cwangciso lugqibeleleyo, ukungena kokwenyani kunokuqalisa! ukuntywila nzulu Uhlalutyo olungatshintshiyo (SAST) Ngoku masiqhubele phambili ekuvavanyeni i-app ngokwayo-ngaphandle kokuyiqhuba ngokupheleleyo. Oku kufana nokufunda iplani yenqaba ngaphambi kokuba ungene ngaphakathi. Sijonge , , kunye neminye imiba kwikhowudi okanye iifayile zoqwalaselo. iimfihlo ezinekhowudi ulungelelwaniso olungakhuselekanga IiNdawo eziphambili ekuJoliswe kuzo Iimfihlo ezinekhowudi Izitshixo ze-API, iimpawu, iziqinisekiso, kunye nezitshixo zokubethela ngamanye amaxesha ziphela ngokuthe ngqo kwikhowudi yomthombo. Ukuba abahlaseli bayayibuyisela umva i-app, banokukhupha ezi mfihlo ngomzamo omncinci kwaye bazenze abasebenzisi okanye iinkonzo. Ulungelelwaniso olungakhuselekanga Iimvume ezigqithisiweyo zemvume, iiflegi zolungiso lweempazamo ezishiywe zinikwe amandla, okanye ukusayina okungafanelekanga kungagqobhoza imingxunya kwisikrweqe sosetyenziso lwakho. Isetingi enye-efana ne-NSAllowsArbitraryLoads kwi-iOS Info.plist okanye i-android:debuggable="true" -inokuvula umnyango wokuhlaselwa kwe-man-in-the-middle (MITM) okanye ulungiso olungakhuselekanga. Ukutyhileka kweDatha obuthathaka Ukugcina amathokheni eseshoni okanye ulwazi lomntu siqu kwisicatshulwa esicacileyo kwisixhobo (iilogi, izinto ozikhethayo ekwabelwana ngazo, iifayile zendawo) iresiphi yentlekele. Nabani na onofikelelo ngokwasemzimbeni okanye ifowuni enengcambu/eyaphukileyo ejele unokukroba kwaye ebe idatha ebalulekileyo-akukho mandla akhohlakeleyo afunekayo. App Logic kunye neziphene Ngokuqhelekileyo, imiba eyingcambu ivela kwindlela iimpawu eziphunyezwa ngayo. Xa iitshekhi eziyimfuneko-njengobungqina-zingekho okanye zinganyanzeliswanga ngokungqongqo, abahlaseli banokuludlula ngokulula ukhuseleko lwakho. Ngokufanayo, imisebenzi ye-cryptographic ebuthathaka okanye izixhobo ezingakhuselekanga zinokwenza ubomi bube lula kuye nabani na ovavanya usetyenziso lwakho. Uluhlu lokukhangela lwe-MSTG sibonelela ngoluhlu lokukhangela olucokisekileyo ukukunceda ujongane nohlalutyo olungaguqukiyo ngokwendlela: ISikhokelo soVavanyo loKhuseleko lweMobile (MSTG) [ ] : Idatha enovakalelo ayigcinwa ingaguqulelwanga kwisixhobo. MSTG-STORAGE-1 [ ] : Akukho datha enovakalelo egcinwe kwindawo ekwabelwana ngayo. MSTG-STORAGE-2 [ ] : Ukusetyenziswa ngokufanelekileyo kwe-cryptographic algorithms kunye namathala eencwadi. MSTG-CRYPTO-1 [ ] : Khusela amajelo onxibelelwano (umzekelo, HTTPS/TLS). MSTG-NETWORK-1 [ ] : Ukungabikho kweemfihlo ezinekhowudi kwikhowudi yomthombo. MSTG-CODE-1 [ ] : Ukubethelwa kwekhowudi kusetyenziswa ngokufanelekileyo. MSTG-KHOWUDI-3 [ ] : Ukhuseleko kubunjineli obubuyela umva. I-MSTG-RESILIENCE-1 [ ] : Ubunakho bokulungisa bukhubazekile kwimveliso. MSTG-RESILIENCE-2 [ ] : Ukuphathwa ngokufanelekileyo kweemvume zomsebenzisi kunye neenkcukacha zabucala. MSTG-PRIVACY-1 SAST Tools Izixhobo ezahlukeneyo zinokukunceda ukwahlula ikhowudi yakho, uqwalaselo, kunye nokubini ngaphandle kokusebenzisa usetyenziso: MobSF (Isakhelo soKhuseleko lweMobile) : Iplagi kwi-APK/IPA kwaye i-MobSF iya kuvelisa ingxelo eneenkcukacha: iya kudwelisa ulungelelwaniso olugwenxa, iimvume ezikrokrisayo, okanye iimfihlo ezinekhowudi. Sebenzisa : Ikwanayo neempawu eziguqukayo, iyenza ibe sisisombululo esicocekileyo yonke into. Ibhonasi (Android) APKTool : Yahlula kwaye uqokelele kwakhona i-APK ukuze ubone okungaphakathi. Oku kulungele ukufunda i-AndroidManifest.xml, ukuhlola izixhobo, okanye ukulungisa i-app. Sebenzisa apktool d app.apk -o output_director (Android) IJADX : Guqula i-Dalvik bytecode (.dex) ibe yiJava efundekayo. Ilungele ukubona imigca yekhowudi enobuthathaka obunokwenzeka, njengamaqhosha e-API. Sebenzisa jadx app.apk -d output_directory (iOS) I-Class-Dump, iHopper, iGhidra : Khipha iiheader zeklasi zeNjongo-C (I-Class-Dump) okanye uqhaqhe iibhinari ze-iOS (Hopper/Ghidra). Ukuba i-app i-Swiftified, uya kubona kwakhona imethadatha ye-Swift. Sebenzisa Imizekelo Android Ukubhengezwa kolwazi Ii-apps ze-Android zinokuchithwa kwiifayile zazo usebenzisa izixhobo ezifana , , okanye . ze-APK APKTool JADX MobSF Le nkqubo ityhila ikhowudi yemvelaphi, ulwakhiwo lwesicelo, kunye nezinto ezinovakalelo ezifana ne-AndroidManifest.xml okanye iifayile ze-.smali, ezinokuveza ubuqili bosetyenziso kunye neemvumelwano. Ukuvumela iTrafikhi ecacileyo Abahlaseli banokusebenzisa unxibelelwano olungafihlwanga (HTTP) ukuze balalele okanye babhubhise. Usetyenziso olunokususwa Nabani na onesixhobo (okanye i-emulator) angaqhoboshela idebugger kwaye arhole ngedatha enovakalelo okanye ingqiqo. Hardcoded API Keys public class ApiClient { private static final String API_KEY = "12345-abcdef-67890"; private static final String API_SECRET = "superSecretPassword123!"; } Ukudityaniswa okukhawulezayo nge-APKTool okanye i-JADX ityhila ezi zitshixo, zivumela abahlaseli ukuba bazenze usetyenziso okanye bafikelele kwiinkonzo zokubuyela umva ngaphandle kwemvume. Idatha enovakalelo kwi-Plaintext abc123XYZ987 user@example.com Ukuba amathokheni okanye iinkcukacha zomsebenzisi zigcinwe kwisicatshulwa esicacileyo, isixhobo esinengcambu sinokukhupha ngokulula. iOS Ulwazi olungaqwalaselwanga kakuhle.plist NSAppTransportSecurity NSAllowsArbitraryLoads I-Apple inyanzelisa uqhagamshelo olukhuselekileyo ngokungagqibekanga, ngoko ke ukubeka ngaphezulu oku kuvula i-app kwimingcipheko ye-MITM okanye i-traffic engafihlwanga. Izixhobo zokuqhawula ezifana , , kunye zikhupha umxholo wefayile ye-app, kuquka iiklasi zeNjongo-C, amagama endlela, kunye neefayile zokubini. neClass-Dump iHopper Disassembler neGhidra ye-IPA Uhlalutyo olunamandla (DAST) Ukuba uhlalutyo olungatshintshiyo lufunda iplani yenqaba, luhamba lujikeleza ngaphakathi kwinqaba ngelixa ujonga yonke iminyango kunye neefestile. Siqhuba i-app, sijonge indlela eziphatha ngayo, kwaye sibone ukuba singasebenzisa nabuphi na ubuthathaka ngexesha lokwenyani. uhlalutyo oluguquguqukayo IiNdawo eziphambili ekuJoliswe kuzo Unxibelelwano lwenethiwekhi Qinisekisa ukuba idatha ye-app yakho ngexesha lokuhamba. Ukuba i-app yakho ixhomekeke kwi-HTTP okanye i-HTTPS engafanelekanga, umhlaseli angangena, athintele, okanye alungise idatha. Okufanayo kuya kulahleko okanye ubuthathaka , ukuveza usetyenziso lwakho kuhlaselo lomntu ophakathi (MITM). ayivuzi besatifikethi se-SSL/TLS ukuphina Uqinisekiso & noGunyaziso Nokuba izikrini zakho zokungena kunye neendima zomsebenzisi zijongeka zivakala ephepheni, uvavanyo lokwenyani kukuba umntu angalugqitha na ngexesha lokubaleka. Umzekelo, ngaba umhlaseli angaphinda asebenzise iithokheni zeseshoni okanye aziqashele? Ngaba i-app iphelelwa lixesha ngokuchanekileyo okanye igcina iiseshini zivuliwe ngonaphakade? Ixesha leMfezeko kunye nokuHlolwa koKhuseleko Ii-apps ezininzi zizama ukufumanisa ukuba isixhobo (i-Android) okanye (i-iOS) kwaye emva koko yala ukuqhuba okanye ukuvala iimpawu ezithile. Ngexesha lokuhlalutya okuguquguqukayo, uyafuna ukubona ukuba ungatyibilika na udlule kwezi zitshekisho ngokungena kwikhowudi ye-app, ukuze uhlale uvavanya. Ukuba unokugqitha ngokulula kula manyathelo, abahlaseli banako, nabo. sinengcambu i-jailbroken Ukuvuza kweDatha ngexesha lokuPhunyezwa Ngaba i-app iloga ulwazi olubuthathaka (elifana namagama agqithisiweyo okanye iimpawu) kumbhalo ongenanto? Xa utshintshela usetyenziso okanye ngasemva isixhobo, ngaba isikrini sithathwe ngedatha eyimfihlo sisabonisa? Olu hlobo lomzila "we-breadcrumb" olungenanjongo lunokukhokelela abahlaseli ngqo kubuncwane. I-API kunye noQinisekiso lwe-Server-Side Usetyenziso lunokujongeka lukhuselekile ngokwembono yomxhasi, kodwa ukuba i-API yangasemva ayiziqinisekisi iimvume zomsebenzisi okanye igalelo, umhlaseli unokutsala izicelo kubhabho ukuze afumane ufikelelo olungagunyaziswanga okanye aphule inkqubo. Kubalulekile ukuvavanya zombini umxhasi kunye nokuziphatha kweseva kwi-tandem. Uluhlu lokukhangela lwe-MSTG sikwabandakanya uhlalutyo oluguquguqukayo. Nazi ezinye iitsheki onokuzikhumbula: Isikhokelo soVavanyo loKhuseleko lweMobile (MSTG) [ ] : Usetyenziso lubhaqa kwaye luthintele ukuphazamisa okanye ukubuyisela umva iinzame zobunjineli. MSTG-RESILIENCE-1 [ ] : Usetyenziso lubhaqa izixhobo ezineengcambu okanye ezaphukileyo ejele. MSTG-RESILIENCE-2 [ ] : App iqinisekisa intembeko yekhowudi yayo kunye nezixhobo ngexesha lokusebenza. MSTG-RESILIENCE-3 [ ] : I-App ifihla zonke iitrafikhi zenethiwekhi isebenzisa i-cryptography eyomeleleyo. MSTG-NETWORK-1 [ ] : I-App inyanzelisa ukuqholwa kwesatifikethi apho kufanelekileyo. MSTG-NETWORK-3 [ ] : I-App ayixhomekekanga kwiindlela zokhuseleko zeqonga lodwa kwaye inyanzelisa amanyathelo okhuseleko ngokuzimeleyo. I-MSTG-PLATFORM-1 [ ] : I-App inyanzelisa ngokufanelekileyo amaxesha okuphela kweseshoni kunye neemfuno zokuqinisekisa kwakhona komsebenzisi. MSTG-AUTH-2 [ ] : I-App ayifaki idatha ebuthathaka kwiilog zesixokelelwano. MSTG-STORAGE-4 [ ] : I-App ayigcini idatha enovakalelo kwindawo engakhuselekanga. MSTG-STORAGE-5 [ ] : I-App isebenzisa i-cryptographic algorithms ehlaziyiweyo kwimisebenzi yexesha lokubaleka. MSTG-CRYPTO-1 Cinga ngezi njengemephu yovavanyo lwakho lwehlabathi lokwenyani. Bakunceda ugqobhoze ngokucwangcisiweyo kuwo wonke umnyango kunye neefestile ukuze uqinisekise ukuba itshixiwe. yendlela DAST Tools Ngokungafaniyo ne-SAST, egxile ekuhlolweni kwekhowudi, i-DAST ijikeleza i-app kunye nokujonga. Apha ngezantsi zizixhobo ezidumileyo zokwenza loo nkqubo ibe lula: ngokuqhuba / Burp Suite OWASP ZAP : Zombini zibamba iiproksi ezikuvumela ukuba ubambe kwaye uguqule itrafikhi phakathi kwe-app kunye neeseva ezibuyela ngasemva. Ilungele ukubona iziphelo ezingakhuselekanga, iziphene zeseshoni, okanye ukuvuza kwedatha. Sebenzisa Frida : Isixhobo sezixhobo esitshintshayo esingena kwiinkqubo ezisebenzayo, sikunceda ukuba ugqithe i-SSL pinning, ingcambu/ubhaqo lwe-jailbreak, okanye ezinye izithintelo zecala lomxhasi. Sebenzisa Imiyalelo yeFrida eqhelekileyo Isenzo Umyalelo Qhoboshela kwiNkqubo yokuSebenza frida -U -n Dwelisa Zonke Iinkqubo zokuSebenza frida-ps -U Faka iSibhalo seSiko frida -U -n -c script.js Landela imiSebenzi ethile frida-trace -U -n Hook a Function Specific frida -U -n --eval 'Interceptor.attach(Module.findExportByName(null, "function_name"), { onEnter: function (args) { console.log(args[0].toInt32()); } })' (Android) I-Drozer : Ijolise ekuhloleni amacandelo e-Android afana neMisebenzi, iiNkonzo, abaFundi boSasazo, kunye nabaBoneleli boMxholo ukwenzela ubuthathaka bokhuseleko. Sebenzisa Imiyalelo yeDrozer eqhelekileyo Isenzo Umyalelo Qhagamshela kwisixhobo drozer console connect Bala imisebenzi run app.activity.info -a Sebenzisana neMisebenzi eThunyelwa kwamanye amazwe run app.activity.start --component Uvavanyo lwe-SQL Injection run scanner.provider.injection -a inkcaso : Yakhelwe kuFrida, kodwa ngemiyalelo elula yemisebenzi efana nokukhubaza ukuphina kwe-SSL okanye ukujonga inkqubo yefayile ye-app. Igqibelele ukuba awungomntu obhalayo. Sebenzisa Imiyalelo yokuchasa eqhelekileyo Isenzo Umyalelo Qhoboshela kwi-App eSebenzayo objection -g explore Khubaza i-SSL Pinning android sslpinning disable / ios sslpinning disable Shicilela ulwazi lweSicelo android application info or ios application info Imizekelo Android UThintelo lweNethiwekhi kunye noLungiso Ngokuhambisa itrafikhi ye-Android ngesixhobo esinje , abavavanyi banokunqanda kwaye balungise izicelo. Umzekelo, ukuba i-app ithumela iinkcazi nge-HTTP okanye iyasilela ekuqinisekiseni izatifikethi ze-TLS ngokufanelekileyo, umhlaseli angenza uhlaselo lwe . ngeBurp Suite -man-in-the-middle (MITM) POST /login HTTP/1.1 Host: api.example.com Content-Type: application/json { "username": "test_user", "password": "secret_password" } Iithokheni zeseshoni, iinkcukacha zobuqu, okanye iinkcukacha zentlawulo zinokuvezwa okanye zijikwe. Iilog zeDebug zityhila iDatha ebuthathaka 03-09 12:34:56.789 1234 5678 I MyAppLogger: User token = "abc123XYZ987" 03-09 12:34:56.789 1234 5678 I MyAppLogger: Payment info: "card_number=4111111111111111" Nabani na one (okanye usetyenziso olukhohlakeleyo) unokufunda ezi zigodo kwaye azixhaphaze. -ADB Imisebenzi engaKhusekanga / Ababoneleli boMxholo Ukusebenzisa , abavavanyi banokufumanisa imisebenzi ethunyelwa ngaphandle okanye ababoneleli bomxholo abafuni kuqinisekiswa. i-Drozer drozer console connect run app.provider.query content://com.example.app.provider/users Ukuba idatha ibuyiswa ngaphandle kweemvume ezifanelekileyo, abahlaseli banokufunda okanye balungise ulwazi lomsebenzisi. Ukugqitha ukufunyanwa kweNgcambu Izixhobo ezinje okanye ikuvumela ukuba udlule ekubhaqweni kweengcambu okanye ukukhangela i-SSL yokuqhobosha ngexesha lokusebenza: ngeFrida i-Objection frida -U -n com.example.app --eval "..." objection -g com.example.app explore android sslpinning disable android root disable ios sslpinning disable ios root disable Abahlaseli kwiifowuni ezineengcambu banokuqhubeka nokuvavanya okanye ukuxhamla kwimisebenzi ebuthathaka, ukutyhila iimfihlo okanye ukuphazamisa ingqiqo ye-app. iOS Jailbreak Ukufunyanwa Bypass Ii-apps ezininzi ze-iOS aziyi kuqhuba ukuba zibhaqa ifowuni . , ungahuka kwaye ubhale ngaphezulu indlela yobhaqo: eyaphukileyo NgoFrida Interceptor.attach(Module.findExportByName(null, "jailbreakDetectionFunction"), { onEnter: function (args) { console.log("Bypassed jailbreak check!"); // Force return a 'clean' status } }); Abahlaseli banokusebenzisa i-app kwizixhobo ezisengozini kunye nokuphanda ngedatha okanye iihuku. Idatha enovakalelo kwiiLogi zeNkqubo 2023-03-09 12:34:56.789 MyApp[1234:5678] Payment info: card_number=4111111111111111 2023-03-09 12:34:56.789 MyApp[1234:5678] session_token=abc123XYZ987 Kwizixhobo ze-jailbroken-okanye ngengqokelela yelog yangaphandle-abahlaseli bavuna idatha ebuthathaka ngokuthe ngqo. Imingeni eqhelekileyo kwiMobile Pentesting : Izixhobo ze-Android ziyahluka ngokubanzi kwiinguqulelo ze-OS, iiROM zesiko, kunye nokuguqulwa komenzi, ukwenza uvavanyo lube nzima. I-Platform Fragmentation : Iimpawu ezifana ne-SSL pinning, ingcambu / ukubhaqwa kwe-jailbreak, kunye ne-obfuscation inokuthintela ukungena. Imilinganiselo yoKhuseleko lweSicelo : Uvavanyo lwebhokisi emnyama luhlala lufuna ubunjineli obubuyela umva ngezixhobo ezifana ne-APKTool okanye i-JADX, enokutya ixesha. Ufikelelo oluNcinane kwiKhowudi yoMthombo : Ibhokisi yesanti, ukukhuselwa kwenkumbulo, kunye nesidingo sezixhobo ezineengcambu/ezaphukileyo zasejele zinzima iimvavanyo zokuhamba komsebenzi wokwenyani. IZithintelo zoHlalutyo oluNgqongileyo : Ukuphina kwe-SSL, ukuqinisekiswa kwesatifikethi, okanye ii-VPNs zinokuthintela iiproxi eziqhelekileyo ze-MITM. Izixhobo ezifana , , kunye ne iba yimfuneko kudlula. Ukhuseleko lweNethiwekhi kunye noHlolo lweTrafikhi noFrida Burp Suite mitmproxy Imibuzo Ebuzwa Rhoqo (FAQ) Yintoni i-mobile pentesting? Ivavanya ukuba ikhuselekile kangakanani iapp ephathwayo ngokulinganisa uhlaselo lwehlabathi lokwenyani-ukukhangela nakuphi na ukuqhekeka phambi kokuba abahlaseli benze. Kutheni i-pentesting ehambayo ibalulekile? Ngenxa yokuba ii-smartphones zibamba isixa esikhulu sedatha yobuqu kunye neyezemali, zezona kujoliswe kuzo kubagebenga be-cyber. Ngawaphi amanyathelo aphambili? Misela indawo elawulwayo, yenza uhlalutyo lwe-static (SAST), yenza uhlalutyo oluguquguqukayo (DAST), ukufunyaniswa kwamaxwebhu, kunye nokuvavanya kwakhona emva kokulungiswa. Zeziphi izixhobo endizidingayo? IBurp Suite okanye iZAP yokuthintela izithuthi, iMobSF yokuskena, APKTool/JADX (Android), iClass-Dump/Hopper (iOS), kunye nezixhobo zokuhuka ezifana neFrida okanye iObjection. Kufuneka singene kangaphi? Emva kohlaziyo olukhulu, amanqaku amatsha, okanye utshintsho olubalulekileyo lweziseko zophuhliso. Ngokufanelekileyo, yidibanise kwi-CI / CD ukuze uhlolwe rhoqo. Yintoni ubuthathaka obuqhelekileyo? Ukugcinwa kwedatha okungakhuselekanga, akukho HTTPS, iimfihlo ezikhuselweyo, ulawulo olubi lweseshoni, kunye nee-API ezingalungiswanga. Ngaba yonke into inokuzenzekela? Hayi ncma. Izixhobo zinokwenza ezinye izikena zizenzekele, kodwa uvavanyo olwenziwa ngesandla lutyhila iziphene ezibukhali okanye imithetho entsonkothileyo yeshishini. Ngaba kufuneka sivavanye zombini i-Android kunye ne-iOS? Ewe, nganye ineemodeli zokhuseleko ezizodwa kunye nemigibe. Ngaba kusemthethweni ukungena? Ngokuqinisekileyo, ukuba unemvume ecacileyo evela kumnini we-app. Kungenjalo, akukho mthethweni. Ndiyiqala ngaphi? Funda , funda ukubuyisela umva, kwaye uziqhelanise ne-apps evulekileyo okanye iithagethi zeesampuli. iSikhokelo soVavanyo loKhuseleko lwe-OWASP (MASTG) Ukuqukumbela Ukungena ngemfonomfono kufana omkhulu—uqala ngokuqokelela izixhobo (izixhobo kunye nezixhobo), emva koko umhlaba (SAST), uze ekugqibeleni (i-DAST) ukuze ufumane zonke iindawo ezibuthathaka. Ngokwenza oku rhoqo kwaye unike ingxelo ngeziphumo zakho, uya kugcina usetyenziso lwakho luqinile kwaye abasebenzisi bakho bekhuselekile. nomzamo uhlole uthathe indlela yokujongana Khumbula: isoftware iyavela yonke imihla, kwaye kunjalo nezisongelo. Yenza ulindelo lube yinxalenye yobomi bakho bokukhula-kuba eyona ndlela yokukhusela ubukumkani kukuba ungaze uyeke ukulinda kwakho. eqhubekayo Malunga noMbhali Eli nqaku lilungiswe ngu , iNjineli yoVavanyo loKhuseleko , kwaye ihlaziywe ngu- , i-CTO . uneminyaka engaphezu kwemihlanu yamava amava kuvavanyo lokungena kunye novavanyo lokhuseleko. Ugxininise ekuvavanyeni izicelo zewebhu, iziseko zophuhliso (zombini kwizakhiwo kunye nefu), kunye namaqonga eselula (iOS kunye ne-Android). Ubuchwephesha bakhe bubandakanya iBhokisi eMnyama, iBhokisi eNgwevu, kunye neendlela zeBhokisi eMhlophe, ecaleni kobuchule bokuhlola ukuba sesichengeni kunye nophononongo lokhuseleko lwekhowudi yomthombo. -Anastasiia Tolkachova eSekurno Alex Rozhniatovskyi yaseSekurno U-Anastasiia uneminyaka esixhenxe yamava kuphuhliso kunye ne-cybersecurity. UnguMxhasi we-AWS womthombo ovulekileyo ozinikele ekuqhubeleni phambili izenzo ezikhuselekileyo zokukhowuda. Ubuchwephesha bakhe buvala umsantsa phakathi kophuhliso lwesoftware kunye nokhuseleko, ukubonelela ngemibono ebalulekileyo ekukhuseleni usetyenziso lwewebhu lwangoku. UAlex Mobile Pentesting Guide: References Izixhobo kunye nezibonelelo Mobile-Security-Framework-MobSF Apktool jadx Burp Suite Frida Drozer inkcaso Genymotion I-Corellium Virtual Hardware appledb.dev reFlutter iqonga-izixhobo UMagisk Umhloli weengcambu i-checkra1n unc0ver Filza Izikhokelo kunye namaNqaku OWASP Mobile Top 10 OWASP Mobile Application Security OWASP MASTG I-NIST SP 800-163 Khuphela kwaye ufake i-Android Studio Ukuqwalasela isixhobo se-Android ukuze sisebenze neBurp Suite Ukuqwalasela isixhobo iOS ukusebenza Burp Suite Professional Uqhekezo lwe-Xamarin apps