更新时间：2021-07-16 12:47:05
封面
版权信息
Credits
About the Author
About the Reviewers
www.PacktPub.com
Preface
Chapter 1. The Mobile Application Security Landscape
The smartphone market share
Different types of mobile applications
Public Android and iOS vulnerabilities
The key challenges in mobile application security
The mobile application penetration testing methodology
The OWASP mobile security project
OWASP mobile top 10 risks
Summary
Chapter 2. Snooping Around the Architecture
The importance of architecture
The Android architecture
iOS architecture
iOS SDK and Xcode
iOS application programming languages
Understanding application states
Apple's iOS security model
Changes in iOS 8 and 9
iOS isolation
Hardware-level security
iOS permissions
The iOS application structure
Jailbreaking
The Mach-O binary file format
Property lists
Exploring the iOS filesystem
Chapter 3. Building a Test Environment
Mobile app penetration testing environment setup
Android Studio and SDK
The Android Debug Bridge
Genymotion
Configuring the emulator for HTTP proxy
Google Nexus 5 – configuring the physical device
The iOS SDK (Xcode)
Setting up iPhone/iPad with necessary tools
SSH clients – PuTTy and WinSCP
Emulator simulators and real devices
Chapter 4. Loading up – Mobile Pentesting Tools
Android security tools
iOS security tools
Chapter 5. Building Attack Paths – Threat Modeling an Application
Assets
Threats
Vulnerabilities
Risk
Approach to threat models
Threat modeling a mobile application
Chapter 6. Full Steam Ahead – Attacking Android Applications
Setting up the target app
Analyzing the app using drozer
Android components
Attacking WebViews
SQL injection
Man-in-the-Middle (MitM) attacks
Hardcoded credentials
Encryption and decryption on the client side
Runtime manipulation using JDWP
Storage/archive analysis
Log analysis
Assessing implementation vulnerabilities
Binary patching
Chapter 7. Full Steam Ahead – Attacking iOS Applications
Setting up the target
Reverse engineering
Static code analysis
App patching using Hopper
Hardcoded username and password
Runtime manipulation using Cycript
Dumpdecrypted
Client-side injections
Man-in-the-Middle attacks
Implementation vulnerabilities
Building a remote tracer using LLDB
Snoop-IT for assessment
Chapter 8. Securing Your Android and iOS Applications
Secure by design
Security mind map for developers (iOS and Android)
Device level
Network level
Server level
OWASP mobile app security checklist
Secure coding best practices
Post-production protection
Index
