a day in the life of a pentester
TRANSCRIPT
1. A day in the life of a pentester @clviper [email protected] Cludio Andr 2. whoami Who is a Pentester? Mobile App Architecture Android Mobile App Components OWASP Top 10 Mobile Risks Practical Examples Security Recommendations /// Agenda 3. 10+ years working in Information Systems. Pentester at BSc in Management Information Technology at ULHT. Offensive Security Certified Professional (OSCP) Security Blog: http://security.claudio.pt /// whoami 4. Ethical Hacker. 5. Ethical Hacker. Identify, Explore and Report vulnerabilities. 6. Ethical Hacker. Identify, Explore and Report vulnerabilities. Web applications, Infrastruture and Mobile apps. 7. /// Mobile App Architecture 8. Client /// Mobile App Architecture 9. Network /// Mobile App Architecture 10. Server /// Mobile App Architecture 11. Activities /// Android Mobile App Components 12. Activities Services /// Android Mobile App Components 13. Activities Services Broadcast Receivers /// Android Mobile App Components 14. Activities Services Broadcast Receivers Content Providers /// Android Mobile App Components 15. Zip Archive. Contains Dalvik class files, assets, resources and AndroidManifest.xml. Stored at /data/app. Android Application Package File (.apk) /// Android Mobile App Components - APK 16. Presents information about the app to the system. Describes app components. Define permissions. AndroidManifest.xml /// Android Mobile App Components AndroidManifest.xml 17. XML format file with key-value pairs. App settings. /// Android Mobile App Components Shared Preferences 18. Single file relational database used to store application data and settings. /// Android Mobile App Components - SQLite 19. /// OWASP Mobile Top 10 Risks 20. /// OWASP Mobile Top 10 Risks 21. /// OWASP Mobile Top 10 Risks 22. /// OWASP Mobile Top 10 Risks 23. /// OWASP Mobile Top 10 Risks 24. /// OWASP Mobile Top 10 Risks 25. /// OWASP Mobile Top 10 Risks 26. /// OWASP Mobile Top 10 Risks 27. /// OWASP Mobile Top 10 Risks 28. /// OWASP Mobile Top 10 Risks 29. /// OWASP Mobile Top 10 Risks 30. /// FourGoats Manifest 31. /// M2 Insecure Data Storage M3 Insufficient Transport Layer Protection M4 Unintended Data Leakage 32. /// M2 Insecure Data Storage 33. /// MSRC Answer 34. /// M7 Client Side Injection 35. /// M7 Client Side Injection Python POC 36. M2 - Insecure Data Storage - Shared Preferences without MODE_WORLD_READABLE. - Sensitive information should not be stored. If needed, should be encrypted from derivation of user Password/PIN and not with hardcoded encryption keys. Still vulnerable to offline brute-force. Enforce strong password policy. M3 - Insufficient Transport Layer Protection - Apply TLS transport in channels that the app transmits sensitive information to the backend. - Implement Certificate Pinning if very sensitive information is transmitted. /// Security Recommendations 37. M7 - Client Side Injection - Only export components(Activities,Services,Broadcast Receivers, Content Providers) that make sense and that cannot bypass access controls and leak Internal information. - Always validate User Input. M10 - Lack of Binary Protection - Obfuscate your code, at minimum with ProGuard. Dont make your attacker life easier. /// Security Recommendations 38. www.bsideslisbon.org 39. Thank you Questions? Doubts?