|
|
| (25 intermediate revisions by 8 users not shown) |
| Line 1: |
Line 1: |
| − | == DRAFT CHEAT SHEET - WORK IN PROGRESS == | + | __NOTOC__ |
| | + | <div style="width:100%;height:160px;border:0,margin:0;overflow: hidden;">[[File:Cheatsheets-header.jpg|link=]]</div> |
| | | | |
| − | == Introduction == | + | {| style="padding: 0;margin:0;margin-top:10px;text-align:left;" |- |
| | + | | valign="top" style="border-right: 1px dotted gray;padding-right:25px;" | |
| | + | Last revision (mm/dd/yy): '''{{REVISIONMONTH}}/{{REVISIONDAY}}/{{REVISIONYEAR}}''' |
| | | | |
| − | <p>This cheat sheet provides a checklist of tasks to be performed when testing an iOS application.</p>
| + | After an exchange with the leaders of the [https://github.com/OWASP/owasp-mstg OWASP Mobile Security Testing Guide (MSTG)] project, it was decided to replace the content of this cheat sheet by a reference to the dedicated content on the MSTG project. |
| − | <p>When assessing a mobile application several areas should be taken into account: client software, the communication channel and the server side infrastructure.</p>
| |
| − | <p>Testing an iOS application usually requires a jailbroken device. (a device that not pose any restrictions on the software that can be installed on it)</p>
| |
| | | | |
| − | == Information gathering ==
| + | The explanation is simple: |
| − | <ul>
| + | # It's an OWASP project too. |
| − | <li>Observe application behavior (for each role available)</li>
| + | # The MSTG project is active. |
| − | <li>Does the application request/store/transmit transactions (performs payments)</li>
| + | # It focus on Android and iOS areas. |
| − | <li>Identify access methods and interfaces used</li>
| + | # It provides good and up-to-date advices about how to handle mobile threats for the both platforms. |
| − | <li>Identify what frameworks are in use</li>
| + | # MSTG content came from various specialists in the mobile domain. |
| − | <li>Identify server side APIs that are in use</li>
| |
| − | <li>Identify what protocols are in use</li>
| |
| − | <li>Identify other applications or services with which the application interacts</li>
| |
| − | <li>Decrypt Appstore binaries: the apps will be decrypted at runtime by the kernel’s mach loader. Cydia has two applications available: Crackulous and AppCrack. Also, you can use GDB. The “cryptid” field of the LC_ENCRYPTION_INFO identifies if the application is encrypted or not. Use otool –l <app name> | grep –A 4 LC_ENCRYPTION_INFO</li>
| |
| − | <li>Determine the architecture the application was compiled for: otool –f <app name></li>
| |
| − | <li>Get information about what functions, classes and methods are referenced in the application and in the dynamically loaded libraries. Use nm <app name></li>
| |
| − | <li>List the dynamic dependencies. Use otool –L <app name>
| |
| − | <li>Dump the load commands for the application. Use otool –l <app name></li>
| |
| − | <li>Dump the runtime information from the compiled application. Identify each class compiled into the program and its associated methods, instance variables and properties. Use class-dump-z <app name></li></ul>
| |
| − | Determine the security features in place:
| |
| − | <ul>
| |
| − | <li>Locate the PIE (Position Independent Executable) - an app compiled without PIE (using the “–fPIE –pie” flag) will load the executable at a fixed address. Check this using the command: otool –hv <app name></li>
| |
| − | <li>Stack smashing protection - specify the –fstack-protector-all compiler flag. A “canary” is placed on the stack to protect the saved base pointer, saved instruction pointer and function arguments. It will be verified upon the function return to see if it has been overwritten. Check this using: otool –I –v <app name> | grep stack . If the application was compiled with the stack smashing protection two undefined symbols will be present: “___stack_chk_fail” and “___stack_chk_guard”.</li>
| |
| − | <li>Identify the use of Automatic Reference Counting (ARC – memory management feature). Set the compiler option “Objective-C Automatic Reference Counting” to “yes”. Check this using: otool –I –v <app name> | grep “_objc_release”. Check for symbols that indicate the presence of ARC: _objc_retainAutoreleaseReturnValue, _objc_autoreleaseReturnValue, _objc_storeStrong, _objc_retain, _objc_release, _objc_retainAutoreleaseReturnValue </li>
| |
| − | </ul>
| |
| | | | |
| − | == Application traffic analysis ==
| + | Consult this [https://github.com/OWASP/owasp-mstg#ios-testing-guide section] for information about iOS platform. |
| − | <ul>
| |
| − | <li>Analyze error messages</li>
| |
| − | <li>Analyze cacheable information</li>
| |
| − | <li>Transport layer security (TLS version; NSURLRequest object )</li>
| |
| − | <li>Attack XML processors</li>
| |
| − | <li>SQL injection</li>
| |
| − | <li>Privacy issues (sensitive information disclosure)</li>
| |
| − | <li>Improper session handling</li>
| |
| − | <li>Decisions via untrusted inputs</li>
| |
| − | <li>Broken cryptography</li>
| |
| − | <li>Unmanaged code</li>
| |
| − | <li>URL Schemes</li>
| |
| − | <li>Push notifications</li>
| |
| − | <li>Authentication</li>
| |
| − | <li>Authorization</li>
| |
| − | <li>Session management</li>
| |
| − | <li>Data storage</li>
| |
| − | <li>Data validation (input, output)</li>
| |
| − | <li>Transport Layer protection – are the certificates validated, does the application implement Certificate Pinning</li>
| |
| − | <li>Denial of service</li>
| |
| − | <li>Business logic</li>
| |
| − | <li>UDID usage (privacy concerns)</li>
| |
| − | </ul>
| |
| − | | |
| − | == Runtime analysis ==
| |
| − | <ul>
| |
| − | <li>Disassemble the application (gdb)</li>
| |
| − | <li>Analyze file system interaction</li>
| |
| − | <li>Analyze the application with a debugger (gdb): inspecting objects in memory and calling functions and methods; replacing variables and methods at runtime.</li>
| |
| − | <li>Investigate CFStream and NSStream</li>
| |
| − | <li>Investigate protocol handlers (application: openURL - validates the source application that instantiated the URL request) for example: try to reconfigure the default landing page for the application using a malicious iframe.</li>
| |
| − | <li>Buffer overflows and memory corruption</li>
| |
| − | <li>Client side injection</li>
| |
| − | <li>Injection using dynamic linker attack</li>
| |
| − | </ul>
| |
| − | | |
| − | == Insecure data storage ==
| |
| − | <ul>
| |
| − | <li>Investigate log files</li>
| |
| − | <li>Insecure data storage in application folder (var/mobile/Applications), caches, in backups (iTunes)</li>
| |
| − | <li>Investigate custom created files</li>
| |
| − | <li>Analyze SQLlite database</li>
| |
| − | <li>Investigate property list files</li>
| |
| − | <li>Investigate file caching</li>
| |
| − | <li>Insecure data storage in keyboard cache</li>
| |
| − | <li>Investigate Cookies.bynarycookies</li>
| |
| − | <li>Analyze iOS keychain (/private/var/Keychains/keychain-2.db) – when it is accessible and what information it contains; data stored in the keychain can only be accessible if the attacker has physical access to the device.</li>
| |
| − | <li>Check for sensitive information in snapshots</li>
| |
| − | </ul>
| |
| − | | |
| − | == Tools ==
| |
| − | <table border=1>
| |
| − | <tr>
| |
| − | <th>Tool</th>
| |
| − | <th>Link</th>
| |
| − | <th>Description</th>
| |
| − | </tr>
| |
| − | <tr>
| |
| − | <td>Mallory proxy</td>
| |
| − | <td>http://intrepidusgroup.com/insight/mallory/</td>
| |
| − | <td>Proxy</td>
| |
| − | </tr>
| |
| − | <tr>
| |
| − | <td>Charles/Burp proxy</td>
| |
| − | <td>http://www.charlesproxy.com/ ;
| |
| − | http://www.portswigger.net/burp/
| |
| − | </td>
| |
| − | <td>Proxy</td>
| |
| − | </tr>
| |
| − | <tr>
| |
| − | <td>OpenSSH</td>
| |
| − | <td>http://www.openssh.com/</td>
| |
| − | <td>Connect to the iPhone remotely over SSH</td>
| |
| − | </tr>
| |
| − | <tr>
| |
| − | <td>Sqlite3</td>
| |
| − | <td>http://www.sqlite.org/</td>
| |
| − | <td>Sqlite database client</td>
| |
| − | </tr>
| |
| − | <tr>
| |
| − | <td>GNU Debugger</td>
| |
| − | <td>http://www.gnu.org/software/gdb/</td>
| |
| − | <td>For run time analysis & reverse engineering</td>
| |
| − | </tr>
| |
| − | <tr>
| |
| − | <td>Syslogd</td>
| |
| − | <td>https://developer.apple.com/library/mac/#documentation/Darwin/Reference/ManPages/man8/syslogd.8.html</td>
| |
| − | <td>View iPhone logs</td>
| |
| − | </tr>
| |
| − | <tr>
| |
| − | <td>Tcpdump</td>
| |
| − | <td>http://www.tcpdump.org/</td>
| |
| − | <td>Capture network traffic on phone</td>
| |
| − | </tr>
| |
| − | <tr>
| |
| − | <td>Otool</td>
| |
| − | <td>http://developer.apple.com/library/mac/#documentation/Darwin/Reference/ManPages/man1/otool.1.html</td>
| |
| − | <td>Odcctools: otool – object file displaying tool</td>
| |
| − | </tr>
| |
| − | <tr>
| |
| − | <td>Cycript </td>
| |
| − | <td>http://www.cycript.org/</td>
| |
| − | <td>A language designed to interact with Objective-C classes</td>
| |
| − | </tr>
| |
| − | <tr>
| |
| − | <td>SSL Kill switch</td>
| |
| − | <td>https://github.com/iSECPartners/ios-ssl-kill-switch</td>
| |
| − | <td>Blackbox tool to disable SSL certificate validation - including certificate pinning </td>
| |
| − | </tr>
| |
| − | <tr>
| |
| − | <td>Plutil</td>
| |
| − | <td>http://scw.us/iPhone/plutil/</td>
| |
| − | <td>To view Plist files</td>
| |
| − | </tr>
| |
| − | <tr>
| |
| − | <td>nm</td>
| |
| − | <td></td>
| |
| − | <td>Analysis tool to display the symbol table, which includes names of functions and methods, as well as their load addresses.</td>
| |
| − | </tr>
| |
| − | <tr>
| |
| − | <td>sysctl</td>
| |
| − | <td>https://developer.apple.com/library/mac/#documentation/Darwin/Reference /ManPages/man8/sysctl.8.html</td>
| |
| − | <td>A utility to read and change kernel state variables</td>
| |
| − | </tr>
| |
| − | </table>
| |
| − | | |
| − | == Related Articles ==
| |
| − | <ul>
| |
| − | <li>https://www.owasp.org/index.php/Projects/OWASP_Mobile_Security_Project_-_Security_Testing_Guide</li>
| |
| − | <li>http://pen-testing.sans.org/blog/pen-testing/2011/10/13/mobile-application-assessments-attack-vectors-and-arsenal-inventory#</li>
| |
| − | <li>http://resources.infosecinstitute.com/iphone-penetration-testing-3/</li>
| |
| − | <li>Jonathan Zdziarski “Hacking and securing iOS applications” (ch. 6,7,8)</li>
| |
| − | <li>http://www.mdsec.co.uk/research/iOS_Application_Insecurity_wp_v1.0_final.pdf</li>
| |
| − | </ul>
| |
| − | | |
| − | = Authors and Primary Editors =
| |
| − | Oana Cornea - oanacornea123[at]gmail.com
| |
| − | | |
| − | = Other Cheatsheets =
| |
| − | {{Cheatsheet_Navigation}}
| |
| − | | |
| − | [[Category:Cheatsheets]]
| |
