Facebook-f Twitter Youtube Linkedin
Cart

MASTERING MOBILE HACKING

This training offers techniques, tips and tricks to deliver to pentesters, bug bounty researchers, app makers or anyone curious a 100% hands-on 3 days mobile training. The goal is to introduce tools (Adb, Apktool, Jadx, Cycript, Frida, Objection, Hopper, etc.) and techniques to help trainees work faster and in a more efficient way in the mobile (Android and iOS) ecosystem.

$3,299.00

REGISTER

Duration

3 days

Delivery Method

virtual

Level

beginner

Seats Available

20

Duration

3 days

Delivery Method

virtual

Level

beginner

Class mode: VIRTUAL LIVE STREAM 

Ask us about upcoming dates!

 

In this training, veteran pentesters Guillaume Lopes and Davy Douhine will share many techniques, tips and tricks to deliver to pentesters, bug bounty researchers, app makers or anyone curious a 100% hands-on 3 days mobile training.

 

Goal is to introduce tools (Adb, Apktool, Jadx, Cycript, Frida, Objection, Hopper, etc.) and techniques to help trainees work faster and in a more efficient way in the mobile (Android and iOS) ecosystem. This is the exact training that you would have liked to have before wasting your precious time trying and failing while trying to assess the security of mobile applications.

  • A VM will be provided to the attendees with the pre-installed tools to cover most of the labs.
  • A Corellium access (iOS virtualisation) will be provided.

 

Agenda

  • Day 1: iOS Basics

    * Security features and iOS architecture * Techniques: Steps and requirements * Set-up a testing environment * Tools * Jailbreaks: History and types * Targeted apps * iOS virtualization with Corellium

  • Day 1: iOS Static Analysis

    * Code checks * Needle and MobSF

  • Day 1: Android Basics

    * Android Ecosystem * Sandboxing * Android Components * APK Architecture * Android Manifest

  • Day 1: Android Static Analysis

    * Decompilation / Disassembling * Hardcoding secrets * Code Tampering * Tools

  • Day 2: iOS Dynamic Analysis

    * Caching * Logs * Backups * Plist * SQLite * Hooking with Cycript * Hooking with Frida * Objection

  • Day 2: Android Dynamic Analysis

    * Emulator or physical device * Access Control * LogCat * Root-Emulator Detection * Debugging

  • Day 2: Android Data Storage

    * Databases * Shared Preferences * Internal Storage * External Storage

  • Day 3: iOS Dynamic Analysis

    * Analyze without a jailbreak

  • Day 3: iOS Network Security

    * MiTM all the traffic * Rvictl, Wireshark and Burpsuite

  • Day 3: iOS Bonus (Totally not spyware / CVE-2018-4233)

    * Metasploit

  • Day 3: Android Network Security

    * How to intercept traffic using BurpSuite * Certificate Pinning: How it is implemented? How to defeat it?

  • Day 3: Android Hooking

    * Introduction of Frida * Frida Scripting * Hooking Native Code

Why You Should Take This Course

TBA

Who Should Attend

* Anyone who want to learn how to assess mobile applications with some prior knowledge on web security * Intermediate to experienced Pentesters, Bug Hunters, Security Researchers, Security Experts and Security Managers/Architect  

Key Learning Objectives

  • Introduce the OWASP MSTG (Mobile Security Testing Guide) and the MASVS (Mobile Application Security Verification Standard)

  • Learn Android and iOS security basics

  • Know how to build an Android and iOS pentest toolset

  • Learn how to review the codebase of a mobile application (aka static analysis)

  • Run the mobile application on a rooted device (to check data security issues)

  • Inspect the app via instrumentation and manipulate the runtime (aka runtime analysis)

  • Man in The Middle all the network communications (aka inspect the traffic)

    • Prerequisite Knowledge

    * Network and Linux basics  

    Hardware / Software Requirements

    A laptop with: * 8GB of RAM at least, ideally 16GB * 50Gb of free space (to install a VM based on Kali that we’ll provide) * Administrative privileges on your laptop + a way to deactivate anti-virus, HIPS and firewall * VMWare Player (ideally VMWare Workstation) * A PDF reader * A jailbroken iDevice (iPhone/iPad/iPod) running at least iOS10 for the iOS labs (a Corellium virtual device will be provided to do the labs but a physical device will allow to do a few additional labs).  

    Your Instructor

    No data was found

    HACK IN THE BOX LIMITED

    Masdar City, United Arab Emirates