liuxinye23/qingfenglanyue/mobile-app-security-testing

# 反编译APK
apktool d app.apk
 
# 查看AndroidManifest.xml
cat app/AndroidManifest.xml
 
# 查看Smali代码
find app/smali -name "*.smali"

# 反编译APK
jadx -d output app.apk
 
# 查看Java源码
find output -name "*.java"

# 启动MobSF
docker run -it -p 8000:8000 opensecurity/mobsf
 
# 上传APK进行分析
# 访问 http://localhost:8000

// Hook函数
Java.perform(function() {
    var MainActivity = Java.use("com.example.MainActivity");
    MainActivity.onCreate.implementation = function(savedInstanceState) {
        console.log("[*] onCreate called");
        this.onCreate(savedInstanceState);
    };
});

# 启动Objection
objection -g com.example.app explore
 
# Hook函数
android hooking watch class_method com.example.MainActivity.onCreate

# 配置代理
# Android设置代理指向Burp Suite
# 安装Burp证书

// 不安全的代码
String apiKey = "1234567890abcdef";
String password = "admin123";

// SharedPreferences存储敏感数据
SharedPreferences prefs = getSharedPreferences("data", MODE_WORLD_READABLE);
prefs.edit().putString("password", password).apply();

// 不验证证书
TrustManager[] trustAllCerts = new TrustManager[] {
    new X509TrustManager() {
        public X509Certificate[] getAcceptedIssuers() { return null; }
        public void checkClientTrusted(X509Certificate[] certs, String authType) { }
        public void checkServerTrusted(X509Certificate[] certs, String authType) { }
    }
};

# 导出头文件
class-dump app.ipa
 
# 查看头文件
find app -name "*.h"

# 使用Hopper反汇编
# 打开app二进制文件
# 分析汇编代码

# 查看Mach-O信息
otool -L app
 
# 查看字符串
strings app | grep -i "password\|key\|secret"

// Hook Objective-C方法
var className = ObjC.classes.ViewController;
var method = className['- login:password:'];
Interceptor.attach(method.implementation, {
    onEnter: function(args) {
        console.log("[*] Login called");
        console.log("Username: " + ObjC.Object(args[2]).toString());
        console.log("Password: " + ObjC.Object(args[3]).toString());
    }
});

# 附加到进程
cycript -p app
 
# 执行命令
[UIApplication sharedApplication]

// 不安全的代码
NSString *apiKey = @"1234567890abcdef";
NSString *password = @"admin123";

// Keychain存储不当
NSUserDefaults *defaults = [NSUserDefaults standardUserDefaults];
[defaults setObject:password forKey:@"password"];

// 不验证证书
- (void)connection:(NSURLConnection *)connection 
didReceiveAuthenticationChallenge:(NSURLAuthenticationChallenge *)challenge {
    [challenge.sender useCredential:[NSURLCredential credentialForTrust:challenge.protectionSpace.serverTrust] 
          forAuthenticationChallenge:challenge];
}

# 启动MobSF
docker run -it -p 8000:8000 opensecurity/mobsf
 
# 上传应用进行分析
# 支持Android和iOS

# 安装Frida
pip install frida-tools
 
# 运行脚本
frida -U -f com.example.app -l script.js

# 安装Objection
pip install objection
 
# 启动Objection
objection -g com.example.app explore