Spring Training 2016 - Mobile Application Exploitation (iOS and Android)
From BruCON 2016
Mobile Application Exploitation (iOS and Android)
This will be a completely hands on training on exploiting mobile applications for the iOS and Android platform. The training will be based on exploiting Damn Vulnerable iOS app and other vulnerable apps which are written by the trainer in order to make people understand the different kinds of vulnerabilities in mobile applications.
This course will also discuss how a developer can secure their applications using secure coding and obfuscation techniques. After the workshop, the students will be able to successfully penetration test and secure mobile applications. All the students will get a PDF presentation with all the slides, vulnerable apps used for training, sample source code and all the necessary tools used to pentest mobile applications.
The training will also include a CTF challenge in the end where the attendees will use their skills learnt in the training to solve the CTF challenges.
Module 1 : Getting Started with iOS Pentesting
A.iOS security model App Signing, Sandboxing and Provisioning Setting up XCode Changes in iOS 8 Exploring the iOS filesystem Intro to Objective-C and Swift B. Setting up the pentesting environment Jailbreaking your device Cydia, Mobile Substrate Getting started with Damn Vulnerable iOS app Binary analysis Finding shared libraries Checking for PIE, ARC Decrypting ipa files Self signing IPA files [Coffee Break] Part 2 - Android Exploitation -Android Security Architecture -Permission Model Flaws -API level vulnerabilities -Rooting for Pentesters Lab -Android ART and DVM Insecurities Module 2 :
- Android App for Security professionals
-Reverse Engineering for Android Apps -Smali Labs for Android -Dex Analysis and Obfuscation -Android App Hooking Module 3 :
- Application Specific vulnerabilities
-Attack Surfaces for Android applications -Exploiting Side Channel Data Leakage -Exploiting and identifying vulnerable IPCs -Exploiting Backup and Debuggable apps -Exploiting Exported Components -Dynamic Analysis for Android Apps -Analysing Proguard, DexGuard and other Obfuscation Techniques Module 4 :
- Fuzzing for Android
-Platform setup for Android fuzzing -Identifying vulnerable endpoints -Fuzzing Android components -Crash to Exploit Module 5 :
- ARM for Android Exploitation
-Getting familiar with Android ARM -Exploit Mitigation and Protections -Heap Manipulation -ROP Labs for Android -Writing your own reliable exploit -Race Condition vulns -Hardware Exploitation Techniques
This course is for penetration testers, mobile developers or anyone keen to learn mobile application security
- Bring your own laptop. A Macbook Air or Pro is preferable for running Xcode. Genymotion should be installed on the laptop
- 20+ GB free hard disk space
- 3+ GB RAM
- Xcode installed on the laptop to save time during training
- A jailbroken iPhone/iPad/iPod for iOS testing if possible.
@corelanc0d3r Links :
Mon. 20 - 22 April 2016 (09:00 - 22:00) (3-day)