Book Image

Mobile Device Exploitation Cookbook

By : Akshay Dixit
Book Image

Mobile Device Exploitation Cookbook

By: Akshay Dixit

Overview of this book

Mobile attacks are on the rise. We are adapting ourselves to new and improved smartphones, gadgets, and their accessories, and with this network of smart things, come bigger risks. Threat exposure increases and the possibility of data losses increase. Exploitations of mobile devices are significant sources of such attacks. Mobile devices come with different platforms, such as Android and iOS. Each platform has its own feature-set, programming language, and a different set of tools. This means that each platform has different exploitation tricks, different malware, and requires a unique approach in regards to forensics or penetration testing. Device exploitation is a broad subject which is widely discussed, equally explored by both Whitehats and Blackhats. This cookbook recipes take you through a wide variety of exploitation techniques across popular mobile platforms. The journey starts with an introduction to basic exploits on mobile platforms and reverse engineering for Android and iOS platforms. Setup and use Android and iOS SDKs and the Pentesting environment. Understand more about basic malware attacks and learn how the malware are coded. Further, perform security testing of Android and iOS applications and audit mobile applications via static and dynamic analysis. Moving further, you'll get introduced to mobile device forensics. Attack mobile application traffic and overcome SSL, before moving on to penetration testing and exploitation. The book concludes with the basics of platforms and exploit tricks on BlackBerry and Windows Phone. By the end of the book, you will be able to use variety of exploitation techniques across popular mobile platforms with stress on Android and iOS.
Table of Contents (11 chapters)
Mobile Device Exploitation Cookbook
Credits
About the Authors
About the Reviewer
www.PacktPub.com
Preface

Installing and configuring Android SDK and ADB


The very first step in Android development and security testing is to learn to install and configure the Android SDK and ADB. The software development kit (SDK) for Android comes in two installable versions; Android Studio and the standalone SDK tools. This recipe primarily uses Android Studio and later provides additional information about standalone SDK tools.

Android Debug Bridge (ADB) is a very useful tool, which can connect to Android devices and emulators and is used to perform debugging and security testing for mobile applications.

Note

Whenever we use the words "Android devices" in this book, this means Android smartphones and tablets.

Getting ready

Navigate to https://developer.android.com and download either Android Studio or standalone SDK tools. You will also require JDK v7 or newer.

How to do it...

Let's set up using the first method, Android Studio:

  1. Go to http://developer.android.com/sdk/index.html and download the latest Android Studio.

  2. Once you have downloaded the Android Studio installer file, the installer guides you through the next steps and you just have to follow the instructions.

Note

As of writing this, the installer file used is android-studio-bundle-135.1740770-windows.exe.

Android SDK and ABD are installed as part of the default installation. Unless you deselect these, they will be installed.

Note

AVD stands for Android Virtual Device, which in turn refers to the Android emulator. Emulators provide a virtualized setup to test, run, and debug Android applications. These are especially useful in cases where hardware devices are not available. Most development testing works using emulators. We will use an emulator in the next recipe.

Note the Android Studio and SDK installation paths. You will need them repeatedly in setup:

Once Android Studio is installed, run it. It will guide you through the next set of instructions. It downloads the Android SDK tools, which may take up to 4 hours depending upon the Internet speed.

How it works...

The development environment is ready. Take a moment to make yourself familiar with the SDK installation directory (the path shown in the preceding screenshot). There are a few quick things you must know:

  • SDK Manager: This is used to manage Android packages and can be used to install or uninstall newer/older versions as required.

  • AVD Manager: This is used to manage AVD. Use it to create a few emulators that we will use at the appropriate time.

    Now run one of the emulators to test whether the installed setup is working well. An emulator takes 2-3 minutes to start up, so be patient and if the installation has gone well, the emulator should be up and running. (Please refer to the next recipe if you want to look at the emulator screenshot now.)

  • platform-tools: This folder contains useful tools such as ADB, SQLite3, and so on. We will use these tools in various recipes throughout this book.

  • tools: This folder contains batch files and other executables. We will mostly use emulator.exe, as well as other .exe files in this folder.

There's more...

There is an alternative way to develop in Android, as many people prefer other IDEs. In such cases, the standalone SDK tools can be downloaded. This provides the SDK tools required for application development and these tools can be invoked from the command line.

These standalone tools are also useful for pentesters and black hats, for quick analysis of underlying, application-related stuff. A lot of the time, application development is not needed and there is a need to debug; in such cases, the standalone SDK tools can be used.

See also

  • Analyzing the Android permission model using ADB