Tweet

ZwinK

Mar 30 • 3 tweets • 1 min read Twitter logo

I've recently become obsessed with getting better at pen testing Android apps. So, I would like to start a thread. Post useful tools, #bugbountytips , and tricks you know here! I'll start:

1] You can recompile an APK using "APK-MITM" tool which removes certificate pinning...

This allows you to install the APK to an unrooted device and install a user CA (EG: Burp, MITM proxy, etc.) to intercept the app traffic. Its life changing. Formerly I had used Frida with Nox Emulator but if your app requires physical things (EG: bluetooth), Nox may not work. ..

2] The "apkleaks" program makes a great attempt at farming out secrets and URLs from APKs, but in my experience it misses a bunch. Does anyone know of anything better here that attempts to find URLs, secrets, etc. from the APK to save time?

• • •

Missing some Tweet in this thread? You can try to force a refresh

This Thread may be Removed Anytime!

Twitter may remove this content at anytime! Save it as PDF for later use!

More from @_zwink

ZwinK

@_zwink

Jun 3, 2022

Broken Access Control: #bugbounty and web #pentesting pro tips 💪

When hunting broken access control issues, try this:
1. First use EVERY exposed GUI function available
2. Look for API docs and extract URLs
3. Look for URLs in code
4. Look for URLs in search engines

5. Look for URLs in Wayback Engine
6. Use word lists to fuzz known API paths for additional end points
7. Create two lists of all known object IDs for two different accounts
8. Logged in as account 1, try to access the object IDs of account 2 in all URLs where IDs are used

9. Replay all authenticated requests without the cookies or authorization header present.
10. On high risk endpoints which return PII or sensitive info, try parameter fuzzing to see if IDs are accepted via parameters.

This is a recipe for success. 🥳

Read 4 tweets

Share this page!

ZwinK

People who liked this thread also liked...

Try unrolling a thread yourself!

More from @_zwink

ZwinK

Did Thread Reader help you today?

Don't want to be a Premium member but still want to support us?

Send Email!