Learning pentesting for Android devices : a practical guide to learning penetration testing for Android devices and applications / Aditya Gupta ; foreword by Elad Shapira ; cover Image by Michal Jasej.

Format:

Book

Author/Creator:

Gupta, Aditya, author.

Shapira, Elad, author of introduction, etc.

Contributor:

Jasej, Michal, cover designer.

Series:

Community experience distilled.

Community Experience Distilled

Language:

English

Subjects (All):

Android (Electronic resource).

Application software--Design.

Application software.

Application software--Development.

Computer networks--Security measures.

Computer networks.

Physical Description:

1 online resource (154 p.)

Edition:

1st ed.

Place of Publication:

Birmingham, England : Packt Publishing, 2014.

Language Note:

English

Biography/History:

Gupta Aditya: Aditya Gupta is the founder of Attify, and an IoT and mobile security researcher. He is also the creator of the popular training course Offensive IoT Exploitation, and the founder of the online store for hackers Attify-Store. Gupta has also published security research papers, authored tools, and spoken numerous times at conferences such as BlackHat, DefCon, OWASP AppSec, ToorCon, and more. In his previous roles, he has worked with various organizations helping to build their security infrastructure and internal automation tools, identify vulnerabilities in web and mobile applications, and lead security planning. He can be reached out to on Twitter at @adi1391 and over email at adityag@attify. com.

Summary:

This is an easy-to-follow guide, full of hands-on and real-world examples of applications. Each of the vulnerabilities discussed in the book is accompanied with the practical approach to the vulnerability, and the underlying security issue. This book is intended for all those who are looking to get started in Android security or Android application penetration testing. You don't need to be an Android developer to learn from this book, but it is highly recommended that developers have some experience in order to learn how to create secure applications for Android.

Contents:

Cover; Copyright; Credits; Foreword; About the Author; Acknowledgments; About the Reviewers; www.PacktPub.com; Table of Contents; Preface; Chapter 1: Getting Started with Android Security; Introduction to Android; Digging deeper into Android; Sandboxing and the permission model; Application signing; Android startup process; Summary; Chapter 2: Preparing the Battlefield; Setting up the development environment; Creating an Android virtual device; Useful utilities for Android Pentest; Android Debug Bridge; Burp Suite; APKTool; Summary; Chapter 3: Reversing and Auditing Android Apps

Android application teardownReversing an Android application; Using Apktool to reverse an Android application; Auditing Android applications; Content provider leakage; Insecure file storage; Path traversal vulnerability/local file inclusion; Client-side injection attacks; OWASP top 10 for mobile; Summary; Chapter 4: Traffic Analysis for Android Devices; Android traffic interception; Ways of Android traffic analysis; Passive analysis; Active analysis; HTTPS Proxy interception; Other ways for SSL Traffic interception; Extracting sensitive files from packet capture; Summary

Chapter 5: Android ForensicsTypes of forensics; Filesystems; Android filesystem partitions; Using dd to extract data; Using a custom recovery image; Using Andriller to extract an application's data; Using AFLogical to extract contacts, calls, and text messages; Dumping application databases manually; Logging the logcat; Using backup to extract an application's data; Summary; Chapter 6: Playing with SQLite; Understanding SQLite in depth; Analyzing a simple application using SQLite; Security vulnerability; Summary; Chapter 7: Lesser-known Android Attacks; Android WebView vulnerability

Using WebView in the applicationIdentifying the vulnerability; Infecting legitimate APKs; Vulnerabilities in ad libraries; Cross Application Scripting in Android (XAS); Summary; Chapter 8: ARM Exploitation; Introduction to ARM architecture; Execution modes; Setting up the environment; Simple stack-based buffer overflow; Return-oriented programming; Android root exploits; Summary; Chapter 9: Writing the Pentest Report; Basics of a penetration testing report; Writing the pentest report; Executive summary; Vulnerabilities; Scope of the work; Tools used; Testing methodologies followed

RecommendationsConclusion; Appendix; Summary; Index

Notes:

Description based upon print version of record.

Description based on online resource; title from PDF title page (ebrary, viewed April 11, 2014).

ISBN:

9781783288991

178328899X

OCLC:

875818937