Droid-Sec Exploitation
Instructor(s):
Blessen Thomas
Description:
The Droid-Sec Exploitation training will enable attendees to master various android application penetration testing techniques and exploitation methods. With the rise of IoT devices, we have also included IoT smart watch wearable application penetration testing methodology and case studies.
This training focuses on practical hands-on exercises on several dedicated vulnerable apps, with the basic theory explained prior to the Do-It-Yourself mind-bending exercises - enabling the attendee to test his acquired skills during the training course.
This two-day fast-paced, brain-melting, revamped, custom-tailored, flag-ship training program will include subjects such as setting up Android pentest environments, identifying and exploiting application vulnerabilities in a variety of mobile application architectures, relevant mobile forensics, malware analysis concepts, and complementary subjects.
Key Learning Objectives:
- Understand the Android ecosystem and application architecture
- Identify specific threats and risks associated with the Android platform
- Perform a hands-on penetration test and reverse engineer an Android application
- Ability to find vulnerabilities in various real world applications for the Android platform
- Ability to audit an android application for client engagements
What not to expect:
- To become Android Ninja overnight.
- Although this training will help considerably to get to the next level in Android Security, continued learning and further research in Android Security would be expected.
PREREQUISITE WARNING Each class has prerequisites for software loads and a laptop is mandatory. These individual class guides will list material the students are expected have knowledge about coming in and software tools that need to be pre-installed before attending so you get the maximum benefit from the focused intermediate or advanced level course. Please pay particular attention to the prerequisites, as the material listed there will not be reviewed in the courses, and will be necessary to get the maximum benefit out of these educational programs.
Course Modules:
Day 1:
Module 1: Lab setup and in-depth analysis
- Introduction to Android security
- Lab environment setup for Android pentest
- Setting up Android emulator
- Android permission model and security architecture
- Android Debug Bridge (ADB) basics
- "OWASP Top 10 Mobile Risks" classification of vulnerabilities
- Android Lollipop security features
- Threat modelling mobile application
Module 2: Reverse engineering of Android application binaries (static analysis)
- Unpacking APKs
- The APK file package
- Application components activity intents services
- Decoding XML/resource files
- APK extraction - investigating layout, Android manifest, permissions
- Extracting the content of the classes.dex file
- De-compilation
- Using Smali for in-depth analysis
- Finding hard-coded secrets, like geolocation, passwords in code
- Detecting red flags in Android Manifest file
- Modifying Android applications to reveal sensitive info
Module 3: Insecure data storage
- Exploring installed application files at the /data/data directory
- The file system security model
- Insecure file system permissions
- Insecure storage of sensitive data in files
- Searching inside the SD card
- SQLite database storage & data dumping
- Sensitive data in application shared preferences
- Storage of sensitive data at the server side
- Hard-coded secrets in source code
- Sensitive data leakage via insecure log exposure
- Poor cryptography
- Lesser-known vulnerabilities
Module 4: Data interception and manipulation (dynamic analysis)
- Importing SSL certificates & trusted CA's
- Insecure session management
- Authorization
- Data interception for SSL applications
- Transmission of sensitive information
- Exposing insecure traffic
- SSL Pinning bypass techniques
- Labs
Day 2:
Module 5: Analyzing runtime analysis
- Attacking Android apps from Inside
- Memory dumping and analysis
- Analysing logs by parsing logcat and ddms
- Android Hacking 101: Banking Edition
- Real time case study analysis
Module 6: Exploiting logic and code flaws in applications
- Security flaws in debug mode-enabled apps
- Android Lint usage
- Local file inclusion/path traversal flaws
- SQL Injection in Android applications
- Labs
Module 7: Automated assessment with Introspy / & Drozer /Mobile Security Framework, Xposed Framework
- Introduction to Introspy and configuration
- Blackbox approach assessment using Introspy & Hooking
- Introduction to Drozer and configuration
- Introduction to Mobile Security Framework (MobSF) and configuration
- Automated security assessment using MobSF
- Introduction to Xposed Framework & modules
Module 8: Android forensics
- Extracting hidden strings, messages, logs, and sensitive information
Module 9: Android Malware Analysis
- Introduction to Android Malware Analysis
Module 10: Analysing HTML5 applications
- Introduction to HTML5 mobile apps
- Common vulnerabilities in HTML5 Android apps
Module 11: IoT smart watch wearable application penetration testing
- Introduction to Android smart watch wearable application pentests
- Common issues in applications
- Testing methodologies & tools of the trade
Pre-requisites:
Students could be familiar with below topics but not mandatory:
- Common security concepts or common web security issues
- Basic knowledge of the Linux OS and network security basics
Who Should Attend:
- Android Developers
- Information Security Professionals
- Mobile Application Vulnerability Analyst /Auditors
- Mobility, Mobile Security & Operations Team
- Pen testers and Security professionals interested to get into Android Security
What you will need to bring:
Participants are required to bring their own laptop (no Netbooks, no tablets, no corporate laptop due to the restrictions enabled) with Windows 7 64 bit in Host machine installed. Min 500 GB free Hard disk space and 8 GB RAM preferred, with antivirus and firewall disabled. Genymotion free version installed (https://www.genymotion.com/#!/ ), Virtual box installed (https://www.virtualbox.org/), with no VPN installed. Attendees must have administrator privilege, orking USB port and wi-fi enabled. Updated to the latest display drivers.
No need for devices, as training will be done using emulator.