Book Image

Mobile Application Penetration Testing

By : Vijay Kumar Velu
Book Image

Mobile Application Penetration Testing

By: Vijay Kumar Velu

Overview of this book

Mobile security has come a long way over the last few years. It has transitioned from "should it be done?" to "it must be done!"Alongside the growing number of devises and applications, there is also a growth in the volume of Personally identifiable information (PII), Financial Data, and much more. This data needs to be secured. This is why Pen-testing is so important to modern application developers. You need to know how to secure user data, and find vulnerabilities and loopholes in your application that might lead to security breaches. This book gives you the necessary skills to security test your mobile applications as a beginner, developer, or security practitioner. You'll start by discovering the internal components of an Android and an iOS application. Moving ahead, you'll understand the inter-process working of these applications. Then you'll set up a test environment for this application using various tools to identify the loopholes and vulnerabilities in the structure of the applications. Finally, after collecting all information about these security loop holes, we'll start securing our applications from these threats.
Table of Contents (15 chapters)
Mobile Application Penetration Testing
Credits
About the Author
About the Reviewers
www.PacktPub.com
Preface
Index

Reverse engineering


The process of collecting the source code from a binary is called reverse engineering. It is a combination of system analysis and static code analysis. It is the art of deducing the app implementation and design details of a given target app. In this section, we will walk through a step-by-step process for reverse engineering a given iOS app by extracting the class information and understand any leakage through comments, hardcoded message as well as memory protection.

Extracting the class information

In order to gain better understanding of the target app regarding any kind of information that can be potentially exploited and also understand if there are any vulnerable classes, we will use class-dump (32 bit) or class-dump-z (64 bit). This will work only on unsigned apps and we will be able to extract complete class information in a human-readable form. The following screenshot showcases the running of the class-dump-z on iGoat app, which can be done even for a DVIA app...