Pentest Mobile

pentest-mobile

Mobile app pentest advisory. Not: mobile skill react-native/flutter development tarafi icin; pentest-mobile engagement-level mobile sec testi icindir.

Triggers

• "Android APK pentest"
• "iOS app guvenlik testi"
• "Frida hook"
• "cert pinning bypass"
• "MobSF rapor analizi"
• "MASTG/MASVS kontrol"

OWASP MASVS (Mobile Application Security Verification Standard)

Android Methodology

1. APK extraction: apktool d <app>.apk
2. Static: jadx-gui <app>.apk, MobSF upload
3. Manifest: permission listesi, exported components
4. Dynamic: emulator + Frida + Burp proxy
5. Storage: /data/data/<pkg>/ dump (root cihaz)
6. Network: cert pinning bypass + intercept
7. IPC: exported activity, service, broadcast receiver test
8. WebView: file:// scheme, JavaScriptInterface

Onerilen Komutlar

# QUIET — static analiz
apktool d -o ./app-decompiled <app>.apk
jadx -d ./jadx-out <app>.apk

# MobSF (lokal, offline)
docker run -it --rm -p 8000:8000 opensecurity/mobile-security-framework-mobsf

# Dynamic: Frida (jailbroken/rooted cihaz)
frida-ps -U                                  # USB cihaz process list
frida -U -l hooks.js -f com.example.app     # spawn + hook

# Cert pinning bypass (yaygin script)
# frida-codeshare: 'fdciabdul/Universal-Android-SSL-Pinning-Bypass'
frida --codeshare fdciabdul/universal-android-ssl-pinning-bypass-2 -U -f com.example.app

# Objection (Frida wrapper)
objection -g com.example.app explore
# > android sslpinning disable
# > android root disable

iOS Methodology

1. IPA extract: unzip -d ./ipa-out <app>.ipa
2. Static: class-dump + Hopper / Ghidra
3. Plist: Info.plist permissions, URL schemes
4. Dynamic: jailbroken iPhone + Frida + Burp
5. Storage: /var/mobile/Containers/Data/Application/<uuid>/
6. Network: cert pinning bypass (Frida script)
7. URL scheme: deep link injection test
8. Keychain: keychain dumper

Onerilen Komutlar

# QUIET — static
unzip <app>.ipa -d ./ipa-out
otool -L ./ipa-out/Payload/<app>.app/<binary>

# Frida (jailbroken cihaz)
frida-ps -U
frida --codeshare federicodotta/ios-ssl-cert-bypass -U -f com.example.app

# Objection
objection -g com.example.app explore
# > ios sslpinning disable
# > ios jailbreak disable
# > ios keychain dump

Sertifika Pinning Bypass Yaklasimlar

1. Frida script (universal) — runtime hook
2. Objection — android sslpinning disable
3. APK patching — network_security_config.xml degistir + re-sign
4. iOS — Frida + class-dump ile pin method bul
5. WebView pinning — TrustManager override

IPC / Deep Link Test

<!-- Manifest'te exported activity -->
<activity android:name=".LoginActivity" android:exported="true">
  <intent-filter>
    <action android:name="android.intent.action.VIEW" />
    <data android:scheme="myapp" android:host="auth" />
  </intent-filter>
</activity>

# Deep link probe (ADB shell)
adb shell am start -W -a android.intent.action.VIEW -d "myapp://auth?token=test"
adb shell am start -n com.example.app/.LoginActivity --es token "bypass"

Yaygin Bulgu Kategorisi

Out-of-Scope

• App Store / Play Store policy ihlali sebep olacak teknik (cihaz rooting hizmeti)
• Cihaz fiziksel sokme (chip-off, JTAG)
• 3. taraf SDK trafik analizi (ToS ihlali)