Stefan Bernhardsgrütter
Lead Security Tester
As Security Tester at Redguard AG, Stefan conducts penetration tests in various fields such as web applications, networking, embedded devices, and cloud environments. His primary expertise lies in mobile security, a specialized area he leads at Redguard. In this role, he is responsible for advancing mobile application security testing within Redguard but also to contribute to the broader security community.
Stefan has been working in information security since 2012 and joined Redguard AG in 2017. He holds an M.Sc. in Engineering with a focus on IT security and part-time teaches an IT security course at a higher technical college in Switzerland.
It Finally Works (Mostly): Rewiring Mobile App Network Interception
During mobile app penetration tests, assessing app backend APIs is a crucial step that necessitates interception of app network traffic. Testers typically rely on techniques like API hooking, proxy interception, or connecting via a Machine-in-the-Middle (MitM) Wi-Fi access point.
But not all techniques are equal. Some require specialized hardware, while others are highly situational. We are looking at you, flutter app on a non-jailbroken Android device ;)
In this lightning talk we give an overview of the current state of network interception during mobile app penetration tests, common pitfalls, and limitations.
We then present a simple, custom VPN-based solution which attempts to overcome these challenges for most Android and iOS apps.
Off the Hook: Simplifying Function Hooking with frooky 1.0
Function hooking is an important part of mobile application penetration testing. With this technique, it is possible to observe an app's API usage at runtime in order to detect potential risks. Security testers usually do that with the de-facto default tool, Frida.
frooky is a Frida-based tool developed as part of the OWASP Mobile Application Security Project with the goal to simplify this process. It uses YAML to configure hooks and outputs easy-to-parse JSON, allowing testers to quickly intercept functions at runtime.
After an introduction to the basics of function hooking, we use frooky version 1.0 against mobile applications to quickly find various vulnerabilities.
In a second step, we build a simple vulnerability scanner which parses the output generated by frooky for certain patterns in order to automatically generate a report.