Introduction to IOS Application Penetration Testing - Materi Seminar pada 1 Dekade Echo 1dekade.echo.or.id

1. Introduction to
iOS Mobile Application
Penetration Testing
1 Dekade ECHO.OR.ID
@y3dips

3. MobileSmartphone
www.astanos.ch/img/apple-android-windows-mobile-blackberry-logo.png

4. http://www.wired.com/gadgetlab/2012/02/meet-the-asus-padfone-the-phone-thats-a-tablet-thats-a-notebook/

5. Mobile Infrastructure

6. http://mobile.infostretch.com/images/application-architecture.jpg

7. http://conwet.fi.upm.es/morfeo-project/mymobileweb_blog/wp-content/uploads/2009/04/mymw_architecture_overview.png

8. http://www.ipfaces.org/sites/default/files/images/schema.gif

9. Mobile Infrastructure
Mobile Client/
Application
Communication
Channel
Server Side
Infrastructure

10. Mobile Infrastructure
Mobile Client/
Application
Communication
Channel
Server Side
Infrastructure

11. Facteur d'attaque

12. Attack Vector
Information
Disclosure
Insecure File
Permission
Authentication &
Authorization
Session
Management
Client Side
Injection
Logic (Business)
Testing
Data Protection
Decompiling
Etc.

13. ວiທ$ການ

14. Methodology
Information
Gathering
Analysis
Exploitation
Report &
QA

15. http://www.ibroadcastnetwork.org/images/uploads/ios-logo.png

16. http://cdn3.sbnation.com/entry_photo_images/8958675/iosguide_1020_new_large_verge_super_wide.jpg

17. Inventory
Jailbroken
Device
Decompiler
Analysis
Tools
Hacker’s
Mind
Security
Tools
Proxy

18. Cheat Sheet
Applica'on_home
/var/mobile/Applica.ons/[folder]/app_name
Config
files
Applica.on_Home/Library/Preferences/app_name.plist
Database
.db,
.sqlite,
.sqlite3,
*
Cache
Applica.on_Home/Library/Caches
Cookies
cookies.binarycookies
|
copy
read
with
binarycookies.py
Logs
see
logs
via
iphone
configura.on
u.lity
List
Running
Apps
ps
-­‐axf
Decompiler/Disassembler
otool,
class-­‐dump-­‐o,
class-­‐dump-­‐z,
gdb
Analysis
Tools/Framework
snoop-­‐it
,
cycript

19. Cycript
Objective-Javascript
www.cycript.org
Hook into a running process of the application

20. Cycript

21. Snoop-it
Dynamic Analysis Tools
Runtime Tracing Capabilities
Invoke Arbitrary methods at runtime
Bypass basic Jailbreak detection

22. Snoop-it

23. Proof-Of-concept

26. Proof of concept

27. Proof of concept

28. Proof of concept

29. Proof of concept

30. Proof of concept

31. Snoop-it

32. Reference
IOS Application Security Testing Cheat Sheet - http://
owasp.org
Series of article "Penetration testing of iPhone
applications" - http://securitylearn.net
Snoop-it official page https://code.google.com/p/
snoop-it
Cycript Tricks http://iphonedevwiki.net/index.php/
Cycript_Tricks

33. http://sciencetoybox.com/images/Procedures/Raising_hands.jpg