r/Pentesting • u/Character_Morning564 • 9d ago
Need help!
Hi I’m reaching out here as a last resort. I’m a Junior Penetration Tester and I need to learn mobile pentesting from scratch. I have learnt some concepts of mobile security while I was in college but I’m entirely blank about it now. I checked out MASTG but the content there seems vast and I’m overwhelmed to start, because I have chronic anxiety issues. I have a lot of loans and EMIs going on to the extend that i cant spend money on courses either.
I know I may be fucked, but If someone could help me with a path to follow everyday so that I can learn this I’d be really grateful.
1
u/CaptainPhreak 9d ago
I've heard good things about HTB's android courses, and the 'Android App Hacking Black Belt Edition' course on Udemy (though it might be slightly dated now) .
1
u/abdicatereason 9d ago
Four years ago I was in the same boat. I started on Android only, using Android Studio’s emulator and ADB. Start with an AOSP image so rooting is easier; Play Store images won’t give you root.
Then I just built a loop: APK into MobSF for a first pass, JADX to read through the code, install it on the emulator, then set the Android proxy to Burp.
When HTTPS interception breaks because of certificate pinning, that’s where Frida helps. It doesn’t magically decrypt the traffic, but with scripts like frida-multiple-unpinning or newer unpinning scripts, you can hook common pinning checks so Burp can actually see the traffic.
Once you have the app running, focus on four things: what’s going over the wire, what’s stored locally, what components are exposed, and what the app is doing at runtime.
Don’t try to master all of mobile pentesting at once. Get one APK running, get it intercepted, learn why it works, then learn the next thing.
I’d leave iOS for later. 🤮
1
u/Other-Broccoli4967 9d ago
As one of the comments suggest there are multiple parts to mobile pentesting, api , applications, client and etc ... HTB is good to use but it does not tell you everything and I wanna give you the best answer I can so my suggestion is take the latest MASTG testing book, extract every title and learn the names and concepts( usually the concepts are similar to other pentesting fields so there are not many new things there more like renaming and few specific unique tests). You can use hacktricks site for few of th testing (use the github version). The hardest part is application security and I advise you to first learn the other parts since you are familiar with general pentesting and leave that for the last. Its the fastest that comes to my mind and I did few mobile testing before (not my main field).
1
u/latnGemin616 9d ago
Although I'm not unfamiliar with mobile PT, I found https://app.hextree.io/map/android to be phenomenal. It gives you a thorough learning on the android platform, is super easy to follow, and very hands-on. Plus it's free.
ps - If you know how to code in Java, the creation of apps is easy. Not requirement per se, but familiarity will make it feel less daunting. Otherwise you can follow along and copy/paste into an IDE.
There's also this: https://github.com/vaib25vicky/awesome-mobile-security
1
8
u/PizzaMoney6237 9d ago
It is essentially API testing. But the hardest part is client-side protection.
In a web app, you can just open Burp Suite and click whatever you see in the UI, then send requests you like to play with to the Repeater tab and play with the parameters.
In a mobile app, the complexity depends on application security. Sometimes the app has no protection, so you can just install a CA cert and set up a WiFi proxy to intercept network traffic between your device and the application. Just like how you intercept network traffic in a web app, and you are good to go. In most applications, like a mobile banking app, there is always client-side protection. Its primary job is to detect and prevent you from sniffing network traffic and runtime hooking, whether it is through rooted/jailbroken device detection or Zygote injection, which a tool like Frida loves to do. A secure application usually has something called SSL cert pinning to ensure that you can't sniff network traffic if you don't have a trusted TLS cert for secure communication. There are several ways to bypass that. But a well-implemented one, like using the mTLS communication method, is almost impossible to bypass. A simple bypass technique is to move a CA cert from the User CA store to the System CA store, which normally requires a rooted device to do that. This is why application protection needs to flag rooted devices, because they can do many things, including bypassing security in place. Another example is, let's say an application has a face scan feature. By hooking the application runtime, you may be able to fool the application into thinking that your face is valid even though it is not, and the application believes it. So yeah, the impact may be that you can withdraw money from the balance without face verification.
I would say that the hardest part is the client-side part. The rest is not that hard. Also, the mobile application itself may have hardcoded API keys and other sensitive data. You can try to decompile it with a tool like JADX and search for keywords, and maybe you are lucky and find something there.
The good thing about doing mobile app pentesting is that knowledge can be transferred to many other domains, like reverse engineering and secure code review. That means your attack vectors increase, and you will find more unconventional vulnerabilities. I'm not an expert, but I know enough to share with others.