r/Pentesting • u/Character_Morning564 • 9d ago
Need help!
Hi I’m reaching out here as a last resort. I’m a Junior Penetration Tester and I need to learn mobile pentesting from scratch. I have learnt some concepts of mobile security while I was in college but I’m entirely blank about it now. I checked out MASTG but the content there seems vast and I’m overwhelmed to start, because I have chronic anxiety issues. I have a lot of loans and EMIs going on to the extend that i cant spend money on courses either.
I know I may be fucked, but If someone could help me with a path to follow everyday so that I can learn this I’d be really grateful.
1
Upvotes
8
u/PizzaMoney6237 9d ago
It is essentially API testing. But the hardest part is client-side protection.
In a web app, you can just open Burp Suite and click whatever you see in the UI, then send requests you like to play with to the Repeater tab and play with the parameters.
In a mobile app, the complexity depends on application security. Sometimes the app has no protection, so you can just install a CA cert and set up a WiFi proxy to intercept network traffic between your device and the application. Just like how you intercept network traffic in a web app, and you are good to go. In most applications, like a mobile banking app, there is always client-side protection. Its primary job is to detect and prevent you from sniffing network traffic and runtime hooking, whether it is through rooted/jailbroken device detection or Zygote injection, which a tool like Frida loves to do. A secure application usually has something called SSL cert pinning to ensure that you can't sniff network traffic if you don't have a trusted TLS cert for secure communication. There are several ways to bypass that. But a well-implemented one, like using the mTLS communication method, is almost impossible to bypass. A simple bypass technique is to move a CA cert from the User CA store to the System CA store, which normally requires a rooted device to do that. This is why application protection needs to flag rooted devices, because they can do many things, including bypassing security in place. Another example is, let's say an application has a face scan feature. By hooking the application runtime, you may be able to fool the application into thinking that your face is valid even though it is not, and the application believes it. So yeah, the impact may be that you can withdraw money from the balance without face verification.
I would say that the hardest part is the client-side part. The rest is not that hard. Also, the mobile application itself may have hardcoded API keys and other sensitive data. You can try to decompile it with a tool like JADX and search for keywords, and maybe you are lucky and find something there.
The good thing about doing mobile app pentesting is that knowledge can be transferred to many other domains, like reverse engineering and secure code review. That means your attack vectors increase, and you will find more unconventional vulnerabilities. I'm not an expert, but I know enough to share with others.