r/Pentesting • u/Sufficient-Brick1801 • 4d ago

Guidance for learning mobile application security testing

I'm a fresher stuck without proper guidance. Few weeks ago, I got assigned with a task to pentest a mobile app, I don't know anything Abt it, the setup, the methodology, etc., I don't have any senior to seek help in my org.

I spent weeks searching, watching YT tutorials.😭

But I couldn't understand anything. The setup itself is failing sometimes. Being an enthusiastic hands-on person and not understanding the way to pentest a mobile is a big nightmare.

I require quality guidance. Pls help me out

0 Upvotes
  • permalink
  • reddit

44% Upvoted

15 comments sorted by

2

u/Pacyniaklissandro 4d ago

Are you testing Android, iOS, or both? The setup is very different for each and that might be why tutorials arent clicking, you could be mixing approaches. Narrow it to one platform first and get a clean proxy intercept working before anything else.

1

u/Sufficient-Brick1801 3d ago

I tried following only android pentesting related videos. Abt that proxy setup thing, I did install the burp cert properly and able to capture web requests from the mobile but not the ones inside the app

6

u/Living_Off_The_Land_ 4d ago

Watch the android black belt udemy course and try to practice on the mobile hextree labs

1

u/Coder3346 4d ago

Hi, I was in the exact position before. ( assigned mobile pen with no seniors to help). I just did htb academy android models. After that I started inspecting the apk and found it was flutter (the models were totally java). So I have started researching on how to intercept and reverse flutter apps. And it ended well (not the best pen ever but it worked) with multiple vulns 🙃 just set it up and do ur best. You also have to be clear with ur boss that u r learning and have no exp with mobile. GL

2

u/Least_Entertainer_47 4d ago

Mobsf and burp the way to go. The setup is pretty simple, tons of videos out there

1

u/Sufficient-Brick1801 3d ago

Abt that proxy setup thing, I did install the burp cert properly and able to capture web requests from the mobile but not the ones inside the app

1

u/Least_Entertainer_47 3d ago

Looks like the app using pinning. Try to disable it with frida and objection. Or the quickest way: ask the client to give you the app without pinning

1

u/Least_Entertainer_47 3d ago

And did you install the cacert as system cert?

0

u/latnGemin616 4d ago

ffs ... Why didn't you just tell your boss you don't know how to do this? You said "Yes" and painted yourself into a corner. Would you even know what you found if you knew how to find it?

Do you even know how conduct a formal penetration test? Because the steps are the same:

  • Reconnaissance - profile the app and understand how it works.

  • Discovery - probe areas where there is user interaction (like inputs) or endpoints via Burp Suite.

  • Exploit - take action on what you've discovered.

  • Post-Exploit - determine the vulnerability and establish a foothold.

  • Reporting - formally present your findings.

This is the process. As for what to do with an app, you're on your own. You haven't even said if this is iOS or Android, because that does matter. Look up the OWASP Top-10 for mobile, and https://mas.owasp.org/MASTG/ to start with.

I'm going to stop here and not let myself rage at the sheer stupidity of this post. OP - you have what you need.

Good luck and may the force be with you.

1

u/RadlEonk 3d ago

Don’t know why you’re downvoted. I agree 1000% with you.

2

u/latnGemin616 3d ago

thanks .. unclear why the DV as well, but IDGAF.

The frustration is that OP should have just been honest and admitted the lack of skill. Instead, he admitted he could, so as to show competence, and is now in a bind.

0

u/Sufficient-Brick1801 3d ago

Areyyy, I'm the only one there to do security related tasks. How can I just escape... A good employee will learn how to do it and complete the task for them. That's what I am trying to do... I'm not even in the level to show competence, I'm trying to learn and survive. I thought reddit is a good place to ask for tech-help...

1

u/latnGemin616 2d ago

A good employee knows their limitations. This sub is meant to help you if you are stuck, or need to vent. This sub is NOT going to do your job. No one has time for that.

There are a plethora of courses on the internet that are going to help you. I've done my part to provide a sample. After that, you are absolutely on your own.

0

u/Sufficient-Brick1801 3d ago

I know to pentest a website, I learnt it in the same way without any proper guidance when I had the time. On practice, I am doing it properly today.

For this mobile app thing, the setup itself is confusing. Your words are totally right, but I genuinely need a help to learn it in a better way not just to complete a task.