mobile
Introduction
During my recent penetration testing project for a company_ In the educational courses application.
Tools and Methodology
Outline the tools used for dynamic analysis and the methodology followed during the testing process.
Mobile Security Framework (MobSF) FRIDA Burp Suite Objection
nuclei sqlmap apktool jd-gui
Summary of Findings
I have found 2 High, 2 Medium, vulnerabilities were identified.
1- SSL Pinning Bypass
2- Account takeover
3- SQL Injection (SQLi)
4- Disclosure of sensitive data in URL parameters
5- External service interaction ( DNS & STMP )
Start using apktool and nuclei
The challenge here is to bypass all Detections to allow access API
DeveloperMode, Rootbeer & JailMonkey Root Detections.
If you try to bypass dev mode, you will see root detection, etc so I have asked chat GPT to make all of them in one script except ssl pinning by objection.
so now we have to bypass SSL pinning, if we run the Frida script with objection it will be terminated so
we open the first Terminal to run the Frida script and then run the objection both of them . By this line
``` objection --gadget $(frida-ps -Uai | grep com.company | awk '{print $1}') explore