MobileHackingCheatSheet - Basics on commands/tools/info on how to assess the

项目说明

The Mobile Hacking CheatSheet

The Mobile Hacking CheatSheet is an attempt to summarise a few interesting basics info regarding tools and commands needed to assess the security of Android and iOS mobile applications.

PDF :

* Mobile Hacking Android CheatSheet
* Mobile Hacking iOS CheatSheet

Main Steps

1. Review the codebase
2. Run the app
3. Dynamic instrumentation
4. Analyze network communications

OWASP Mobile Security Testing Project

OWASP Mobile Application Security Testing Guide

Mobile Application Security Standard

Android CheatSheet

APK Structure

* __META-INF__: Files related to the signature scheme (v1 scheme only)
* __lib__: Folder containing nati (ARM, MIPS, x86, x64)
* __assets__: Folder containing application specific files
* __res__: Folder containing all the resources files (layouts, strings, etc.) of the application
* __classes.dex [classes2.dex] ...__: Dal of the application
* __AndroidManifest.xml__: Manifest file describing essential information about the app (permissions, components, etc.)

Package Name

The package name represents the app’s unique identifier (e.g. for YouTube):

Data Storage

User applications

Shared Preferences Files

SQLite Databases

Internal Storage

adb

Connect throug USB

Connect through TCP/IP

Get a shell or execute the specified command

List processes

List Android devices connected to your machine

Dump the log messages from Android system

Copy local file to Android device

Copy file from the Android device

Install APK file on the Android device

Install an App Bundle

Set-up port forwarding using TCP 协议 from host to Android device

List all packages on the device

Find the path where the APK is stored for the selected package name

List only installed apps (not system apps) and the associated path

List packages names matching the specified pattern

Application Signing

For signing your APK file, you have 2 options

* jarsigner: Only supports v1 signature scheme (JAR signature)

* apksigner: Official 工具 from Android SDK (since 24.0.3), which supports all the signature schemes (from v1 to v4)

To create your own keystore, the following one-liner can be used:

Code Tampering

To tamper an APK file, the foolowing steps should be performed:

1. Disassemble the app with apktool and save the smali 代码 into output directory

1. Modify the smali 代码 of your app (or the resource files if needed)

1. Build the modified APK with apktool

1. Sign the APK (see Application Signing)

1. (Optional) Use zipalign to provide optimization to the APK file

Frida

#### Installation

Install Frida and Python bindings on your system using pip

Download the Frida ser matching the targeted architecture and your Frida

Upload and execute the Frida ser on your Android device (root pri are needed)

#### Tools

List running processes (emulators or devices connected through USB)

List only installed applications

Attach Frida 客户端 to the specified application (emulator or device connected through USB)

Spawn the specified application (emulator or device connected through USB)

Spawn the specified application without any pause at the beginning (emulator or device connected through USB)

Load a Frida script when attaching to the specified application

Objection

Inject Frida Gadget library inside an APK file by specifying the targeted architecture (if emulator not running or device not connected)

Inject Frida Gadget library inside an APK file using lastest Frida a on Github (if emulator running or device connected to the device)

SSL/TLS Interception with BurpSuite

#### Before Android 7

1. Launch BurpSuite and modify Proxy settings in order to listen on "All interfaces" (or a specific interface)
1. Edit the Wireless 网络 settings in your device or the emulator proxy settings (Android Studio)
1. Export the CA certificate from Burp and save it with ".cer" extension
1. Push the exported certificate on the device with adb (into the SD card)
1. Go to "Settings->Security" and select "Install from device storage"
1. Select for "Credentials use" select "VPN and apps"

References:

* Configuring an Android device to work with Burp
* Installing BurpSuite's CA certificate in an Android device

#### After Android 7

From Android 7, the Android system no longer trusts the user supplied CA certificates. To be able to intercept SSL/TLS communication, you have 3 options:

1. Use an older of Android
1. Use a rooted device and install the BurpSuite CA certificate inside the sytem store certificate
1. Tamper the targeted application in order to re-enable the user store certificate

In order to tamper the targeted Android application, we are going to add or modify the 网络 security configuration file. This file on recent Android allows to force the application to trust the user supplied CA certificates. The following steps should be performed:

1. Install the Burpsuite's CA certificate on your Android device (see Before Android 7)
1. Disassemble the targeted app (APK file) with apktool
1. Add or modify the network_security_config.xml file (usually on res/xml/ folder). The content of the file should be:

xml
<application android:name="AppName" android:networkSecurityConfig="@xml/网络_security_config">
bash
adb shell content query --uri content://<pro>/<table_name>
bash
adb shell content insert --uri content://<pro>/<table_name>
--bind <param_name>:<param_type>:<param_value>
bash
adb shell content delete --uri content://<pro>/<table_name>
--where "<param_name>='<param_value>'"
bash
adb shell am start -n <package_name/acti> -a <intent_action>
bash
adb shell am start -n <package_name/acti> -a <intent_action> --es <param_name> <string_value> --ez <param_name> <boolean_value> --ei <param_name> <int_value> …
bash
/User/Library/FrontBoard/applicationState.db
bash
/private//Bundle/Application/UUID/App.app
bash
/private//Bundle/Application/UUID/App.app/App
bash
/private//Bundle/Application/UUID/App.app/Info.plist
bash
/private//Containers/Data/Application/Data-UUID
alpine/etc/passwd/private/etc/master.passwd/smx7MYTQIi2Malpine
com.google.ios.youtube
bash
iPhone:~ root# grep -r <App_name> /private/var/*
bash
frida -U <App_name> -c dki/ios-app-info
bash
[iPhone::App]-> appInfo()
bash
iPhone:~ root# sqlite3 /User/Library/FrontBoard/applicationState.db
bash
sqlite> select * from key_tab;
bash
sqlite> select * from application_identifier_tab;
bash
frida-ps –U
bash
frida -U <App_name> –c mrmacete/objc-method-observer
obser
[iPhone::App]-> obser('*[* *<Method_name>*]’);
bash
frida-trace -U <App_name> -m "-[* <Method_name>*]"
onEnteronLea
objection -g "<App_name>" explore
bash
ios hooking list classes
bash
ios hooking list class_methods <Class_name>
bash
ios hooking search classes|methods <String>
bash
ios hooking watch method "-[<Class_name> <Method_name>]"
bash
ios hooking set return_value "-[<Class_name> <Method_name>]" true
bash
./Impactor ide -u <UDID>
bash
wget
dpkg -i com.nablac0d3.sslkillswitch2_0.14.deb
killall -HUP SpringBoard
bash
ide –l
bash
ioreg -p IOUSB -l | grep "USB Serial"
bash
usbfluxctl list
bash
lsusb -s :lsusb | grep iPhone | cut -d ' ' -f 4 | sed 's/://' -v | grep iSerial | awk '{print $3}'
bash
rvictl -s <UDID>
tcpdump or tshark or wireshark –i rvi0
bash
./r.py --udid <UDID> iPhone.pcap
bash
git clone
bash
mv <IPAfile> IPAPatch/Assets/
bash
curl -O
bash
security find-identity -p codesigning –v
bash
codesign -f -s <IDENTITY> FridaGadget.dylib
bash
security find-identity -p codesigning –v
objection patchipa --源码 <IPAfile> --codesign-signature <IDENTITY>
unzip <patchedIPAfile>
ios-deploy --bundle Payload/my-app.app -W –d
objection explore
NSProtectionCompleteNSProtectionCompleteUntilFirstUserAuthenticationProtectedUnlessOpenNoProtectionbash
frida -U <App_name> -c ay-kay/ios-dataprotection
```

License

The Mobile Hacking CheatSheet is an open 源码 project released under the CC-BY-SA 4.0 licence.

项目信息

开发语言：未知

Star 数：1698

技术要点

该项目属于安全软件方向的开源资源，代码结构清晰，适合安全研究人员学习参考。项目围绕Basics on commands/tools/info on how to assess the security of mobile applications展开，提供了可运行的实现，对理解相关安全机制、工具原理与攻防技术具有较高的研究价值。

从技术实现角度看，此类项目的核心在于对底层原理的深入理解与工程化落地。开发者在研究过程中可以结合官方文档与社区讨论，梳理项目的初始化流程、核心模块职责与数据流转，逐步掌握其中的技术细节与设计思路。

使用与学习建议

1. 下载源码压缩包，解压到本地环境。

2. 根据项目类型准备对应的运行环境与依赖。

3. 按照 README 中的步骤完成配置与部署。

4. 在隔离的测试环境中运行验证，避免影响生产系统。

免责声明

本资源来源于开源社区，仅供安全研究、技术学习与合法授权范围内的攻防演练使用，请勿用于任何非法或侵害他人权益的用途。使用本项目产生的一切后果由使用者自行承担。