# Mobile Penetration Testing Training

We teach following technical and business logic issues related to mobile application on the different mobile platforms such as android, IOS and windows.

|     |
| --- |
| Jailbreak Warning<br> Checks |
| Certificate Pinning Checks |
| Dangerous<br> enabled settings(debug mod etc) |
| Decompile/Reversing tests |
| Hardcoded Passwords checks in the sources |
| Token, 3rd party data leakage checks in<br> the sources |
| Information leakage in the real time<br> device logs |
| Application logs checks if there is<br> critical information |
| Application’s stored cache data checks |
| Password protection situation of the<br> local databases |
| Sensitive information storing situation<br> of the databases |
| Checks all critical files(xml, plist etc) |
| Run time tests |
| Memory analyse in the run time |
| Certificate Pinning Bypass |
| Situation of the keyboard cache in the<br> text inputs |
| Data storage shared sdcard |
| Tcpdump analysis whilst app is working |
| All backup file, logs and spesific files<br> analysis |
| Sensitive strings search with grep in the<br> whole app directory |
| Mobile app recompile tests |
| Android APK obfuscation situation |
| Input manipulation tests |
| 2-factor auth tests |
| Data transmission security between device<br> and server |
| Server side tests |
| Full port scan for server IP address |
| Full vulnerability scanning for server IP<br> address |
| Mobile web site tests like a website test |
| Testing app permissions |
| Testing critical information in the<br> clipboard |
| Application Session Timeout situation. |
| Username and password policy check |
| Predictable credentials checks |
| Login form captcha, anti-csrf usage<br> situation |
| Business logic vulnerabilities on the<br> application functions |
| Code injection tests |
| Command execution tests |
| Iframe injection |
| LFI/RFI Tests |
| LFI via iframe injections on the device |
| XSS tests(Reflected, Dom, Stored, Blind) |
| XSS tests with payload injections via<br> cross platforms(mobile-web) |
| XXE vulnerability checks |
| Technical and business logic tests on the<br> registration form |
| Password reset function tests |
| Access via web browser to mobile app with<br> user agent changing |
| Takeover account tests |
| Deployment and configuration issues |
| Mobile API and web services tests |
| SSRF Tests(local and remote) |
| Insecure Direct Object Reference Tests |
| Privilege Escalation with different roles |
| Directory traversal |
| Advanced authorization and authentication<br> tests |
| Username enumeration via warning messages<br> or mis-developments |
| Automate Scanning |