The Mobile Hacking CheatSheet is an attempt to summarise a few interesting basics info regarding tools and commands needed to assess the security of Android and iOS mobile applications.

PDF versions:

• Mobile Hacking Android CheatSheet
• Mobile Hacking iOS CheatSheet

1. Review the codebase
2. Run the app
3. Dynamic instrumentation
4. Analyze network communications

https://github.com/OWASP/owasp-mstg

https://github.com/OWASP/owasp-masvs

https://github.com/OWASP/owasp-mstg/tree/master/Checklists

• META-INF: Files related to the signature scheme (v1 scheme only)
• lib: Folder containing native libraries (ARM, MIPS, x86, x64)
• assets: Folder containing application specific files
• res: Folder containing all the resources files (layouts, strings, etc.) of the application
• classes.dex [classes2.dex] ...: Dalvik bytecode of the application
• AndroidManifest.xml: Manifest file describing essential information about the app (permissions, components, etc.)

The package name represents the app's unique identifier (e.g. for YouTube):

User applications

Shared Preferences Files

SQLite Databases

Internal Storage

Connect throug USB

Connect through TCP/IP

Get a shell or execute the specified command

List processes

List Android devices connected to your machine

Dump the log messages from Android system

Copy local file to Android device

Copy file from the Android device

Install APK file on the Android device

Install an App Bundle

Set-up port forwarding using TCP protocol from host to Android device

List all packages on the device

Find the path where the APK is stored for the selected package name

List only installed apps (not system apps) and the associated path

List packages names matching the specified pattern

For signing your APK file, you have 2 options

• jarsigner: Only supports v1 signature scheme (JAR signature)

  jarsigner -verbose -keystore -storepass


• apksigner: Official tool from Android SDK (since version 24.0.3), which supports all the signature schemes (from v1 to v4)

  apksigner sign --ks --ks-pass pass:


To create your own keystore, the following one-liner can be used:

To tamper an APK file, the foolowing steps should be performed:

1. Disassemble the app with apktool and save the smali code into output directory

   apktool d <APK_file> -o <directory_output>

2. Modify the smali code of your app (or the resource files if needed)

3. Build the modified APK with apktool

   apktool b <directory_output> -o <new_APK_file>

4. Sign the APK (see Application Signing)

5. (Optional) Use zipalign to provide optimization to the APK file

   zipalign -fv 4 <input_APK> <output_APK>

Install Frida and Python bindings on your system using pip

Download the Frida server binary matching the targeted architecture and your Frida version

Upload and execute the Frida server binary on your Android device (root privileges are needed)

List running processes (emulators or devices connected through USB)

List only installed applications

Attach Frida client to the specified application (emulator or device connected through USB)

Spawn the specified application (emulator or device connected through USB)

Spawn the specified application without any pause at the beginning (emulator or device connected through USB)

Load a Frida script when attaching to the specified application

Inject Frida Gadget library inside an APK file by specifying the targeted architecture (if emulator not running or device not connected)

Inject Frida Gadget library inside an APK file using lastest Frida version available on Github (if emulator running or device connected to the device)

1. Launch BurpSuite and modify Proxy settings in order to listen on "All interfaces" (or a specific interface)
2. Edit the Wireless network settings in your device or the emulator proxy settings (Android Studio)
3. Export the CA certificate from Burp and save it with ".cer" extension
4. Push the exported certificate on the device with adb (into the SD card)
5. Go to "Settings->Security" and select "Install from device storage"
6. Select for "Credentials use" select "VPN and apps"

References:

• Configuring an Android device to work with Burp
• Installing BurpSuite's CA certificate in an Android device

From Android 7, the Android system no longer trusts the user supplied CA certificates. To be able to intercept SSL/TLS communication, you have 3 options:

1. Use an older version of Android
2. Use a rooted device and install the BurpSuite CA certificate inside the sytem store certificate
3. Tamper the targeted application in order to re-enable the user store certificate

In order to tamper the targeted Android application, we are going to add or modify the network security configuration file. This file on recent Android versions allows to force the application to trust the user supplied CA certificates. The following steps should be performed:

1. Install the Burpsuite's CA certificate on your Android device (see Before Android 7)

2. Disassemble the targeted app (APK file) with apktool

3. Add or modify the network_security_config.xml file (usually on res/xml/ folder). The content of the file should be:

   xml version="1.0" encoding="utf-8"?>
   <network-security-config>
   <base-config>
   <trust-anchors>
   <certificates src="system" />
   <certificates src="user" />
   trust-anchors>
   base-config>
   network-security-config>
   

4. If the network_security_config.xml file is not present on your app, the AndroidManifest.xmlalso need to be modified by adding the networkSecurityConfig tag as follow:

   <application android:name="AppName" android:networkSecurityConfig="@xml/network_security_config">

5. Build the modified app with apktool and then sign the newly created APK file (see Application Signing)

Query a Content Provider

Insert an element on a Content Provider

Delete a row on a Content Provider

Start an Activity with the specified Intent

Start an Activity with the specified Intent and extra parameters

App list database

Binary directory: include all the static resources of the app

Path of the binary (executable)

App metadata: configuration of the app (icon to display, supported document types, etc.)

Data directory

UUID (Universally Unique Identifier): random 36 alphanumeric characters string unique to the app Data-UUID: random 36 alphanumeric characters string unique to the app

By default the root password on your jailbroken iOS device is alpine

If you've changed it and want to reset it:

1. Open /etc/passwd or /private/etc/master.passwd with a file manager app (e.g. iFile/Fileza)
2. Change the hash to: /smx7MYTQIi2M
3. root password will be alpine

The bundle ID (aka package name) represents the app's unique identifier (e.g. for YouTube)

Grep is the not-so-quick 'n dirty way to find where are the data and binary directories of your app

By launching Frida with the ios-app-info script

And then

Or manually by opening the app list database

And displaying the key_tab table to get the binary directories

Or displaying the application_identifier_tab table to get the bundle IDs

1. Add https://level3tjg.xyz/repo/ src to Cydia and install bfdecrypt tool
2. Go to bfdecrypt pref pane in Settings and set the app to decrypt
3. Launch the app to decrypt: decrypted IPA is stored in the Documents folder of the app

List running processes

Analyse the calls to a method by launching Frida with the objc-method-observer script

And then using the command observeSomething

Hook the calls to the method

Then open the JavaScript handler file to edit the onEnter or onLeave functions to manipulate the behavior of the app

Inject objection

List the classes (output will contain thousands of lines)

List the methods of a class

Search for classes|methods names containing

Analyse the calls to the method

Hook the and return true to each call

Impactor (http://www.cydiaimpactor.com) let you display the NSLog (syslog) on command line

1. Launch Burp and modify proxy settings in order to listen on "All interfaces"
2. Browse to the IP/port of your Burp proxy using Safari
3. Tap on the "CA Certificate" at the top right of the screen
4. Tap on "Allow" on the pop-up asking to download a configuration profile
5. Go to "Settings->Profile Downloaded" and select the "PortSwigger CA" profile
6. Tap on "Install" then "Install" again and then "Install" one last time
7. Edit the wireless network settings on your device to set a proxy ("Settings->Wi-Fi" then tap on the blue "i", slide to the bottom of the screen and tap on "Configure Proxy")
8. Tap on "Manual", set the IP/port of your Burp proxy, tap on "Save"
9. Go to "Settings->General->About->Certificate Trust Settings" & toggle on the PortSwiggerCA

Download and install SSL Kill Switch 2 tweak

Go to "Settings->SSL Kill Switch 2" to "Disable Certificate Validation"

UDID is a string that is used to identify a device. Needed for some operations like signature, app installation, network monitoring.

• Get the UDID with MacOS

or

or by launching Impactor without parameters

• Get the UDID with Linux

or

or by launching Impactor without parameters

• With MacOS (install Xcode and additional tools and connect the device with USB)

• With Linux or Windows (get https://github.com/gh2o/rvi_capture and connect the device with USB)

Sideloading an app including an instrumentation library like Frida let you interact with the app even if it's installed on a non jailbroken device.

Here's the process to do it with IPAPatch: Clone the IPAPatch project

Move the IPA of the app you want to sideload to the Assets directory

Download the FridaGadget library (in Assets/Dylibs/FridaGadget.dylib)

Select the identity to sign the app

Sign FridaGadget library

Then open IPAPatch Xcode project, Build and Run.

Here's the process to do it with Objection (detailed steps on https://github.com/sensepost/objection/wiki/Patching-iOS-Applications)

Four levels are provided by iOS to encrypt automatically files on the device:

• NSProtectionComplete: file is only accessible when device is unlocked (files are encrypted with a key derived from the user PIN code & an AES key generated by the device)
• NSProtectionCompleteUntilFirstUserAuthentication: (defaut class) same except as before, but the decryption key is not deleted when the device is locked
• ProtectedUnlessOpen: file is accessible until open
• NoProtection: file is accessible even if device is locked

By launching Frida with the ios-dataprotection script

The Mobile Hacking CheatSheet is an open source project released under the CC-BY-SA 4.0 licence.