Tutorials, Exercises and Environemnts for Penetration Testing Mobile Environments

Question

I'm looking for a list of exercises or distributions to practice penetration testing on mobile environments. There are plenty of existing things like the environments found at pentesterlab.com and things like Mutillidae, hackthissite.org etc. However all these are for desktop/server environments.

There seems to be quite a lack of mobile-space environments to test with (something that supports both android and iOS would be ideal).

If there are walkthrough guides/solutions for such tutorials that would also be great.

Hope someone can help!

Answer 1

Smart phones are not that different from laptops, so building your own mobile lab and attacking the targets there is a good approach.

Hosting your target:

• Use an Android emulator to host your Android target. You can interact with it from the command-line via ADB
• iOS has the same thing but they call it the iOS Simulator
• Or you can use physical phones but root or jailbreak them for better low level control.

Network setup should contain the minimum:

• A router with flexible controls. dd-wrt works on your wireless router or a Linux (virtual) machine. A wireless router is preferred.
• A computer with a packet injection card to perform wireless attacks on your physical phones. The best choice seems to be the Alfa AWUS036H card from Alfa Networks as BackTrack supports this out-of-thebox.
• A Backtrack (or similar) installation because it contains most of the wireless attack tools.

Intercept and modify SSL/TLS phone communication steps:

• Generate a Certification Authority (CA) SSL certificate
• Install that certificate in your phone certificate store for Android and iPhone
• Setup your phone to use a proxy on a computer where you
• Install an interception proxy (ZAP, Burp) to intercept the phone traffic. Install the CA certificate on that proxy. Note that ZAP will generate a CA certificate for you.
• Access an SSL website or use an app that uses SSL and see the traffic in the interception proxy. You can trap the HTTP requests in any direction and modify them. This way you can test the security of the app or the server application.

You now have a working mobile pentesting lab.

Download and install vulnerable versions of Android then test public exploits from exploit-db.com http://www.exploit-db.com/search/?action=search&filter_page=1&filter_description=Android

This is a list of presentations and whitepapers I have collected and used for pentesting Android. You can use this list to extract attacks and try them in your lab environment:

• A Brief Guide to Android Security
• A framework for on-device privilege escalation exploit execution on Android
• A Framework for Static Detection of Privacy Leaks in Android Applications
• A Local Cross-Site Scripting Attack against Android Phones
• A Methodology for Empirical Analysis of Permission-Based Security Models and its Application to Android
• A Study of Android Application Security Slideshow
• A Study of Android Application Security Whitepaper
• A Study of Android Permissions and How Applications Use Them
• All Your Droid Are Belong To Us: A Survey of Current Android Attacks
• An Android Security Case Study with Bauhaus
• Analyzing and Dissecting Android Applications for Security defects and Vulnerabilities
• Analyzing Inter-Application Communication in Android
• Android application security, the fun details
• Android Browser Cross-Application Scripting
• Attacks on WebView in the Android System
• Enhancing Security of Linux-based Android Devices
• Exploratory Android Surgery Paper
• Exploratory Android Surgery Slides
• Fuzzing the Phone in your Phone Paper
• Fuzzing the Phone in your Phone Slides
• How smart is your android smartphone?
• Paranoid Android: Zero-Day Protection for Smartphones Using the Cloud
• Penetration Testing Android Applications
• Penetration Testing of Android-based Smartphones
• Policy Oriented Secure Content Handling in Android
• Privilege Escalation Attacks on Android
• Securely deploying Android devices
• Security Issues in Android Custom ROMs
• Systematic Detection of Capability Leaks in Stock Android Smartphones
• Taming the Robot: Sandboxing Android
• TEAM JOCH vs. Android
• The Quest for Security against Privilege Escalation Attacks on Android
• These aren't the permissions you're looking for
• Towards Taming Privilege-Escalation Attacks on Android
• VMM Based Rootkit Detection on Android
• Yet Another Android Rootkit