EIEIOTECHNOVATION
← Training programmes

EIEIO / CYBERSECURITY

Mobile Application Security

Course outline

Duration to discuss
Discuss this programme →

Duration

Mobile Application Security

40 hours

Outline

  • The Evolution of Mobile Applications
  • Mobile Application Security
  • Discovering Mobile Platform Attack Vectors
  • 1. Top 10 Risks for Mobile Devices
  • 2. What are the Attacking Vectors & Vulnerabilities?
  • 3. Agent Smith, SS7, & Simjacking
  • MDM – Mobile Device Management
  • 1. MDM Models
  • 2. Mobile Access Control System
  • 3. Remote Wipe
  • 4. Understanding of Miradore
  • OWASP Top 10 Mobile Risks
  • 1. M1: Improper Platform Usage
  • 2. M2: Insecure Data Storage
  • 3. M3: Insecure Communication
  • 4. M4: Insecure Authentication
  • 5. M5: Insufficient Cryptography
  • 6. M6: Insecure Authorization
  • 7. M7: Client Code Quality
  • 8. M8: Code Tampering
  • 9. M9: Reverse Engineering
  • 10. M10: Extraneous Functionality
  • Setting up the mobile device for testing
  • Bypassing business logic for exploitation
  • Experience with tools like MobSF, Drozer, FRIDA, ADB, APPIE, jdGUI, Dex2Jar, Burp, Charles proxy, Cydia Impactor, GDB, Objection, etc.
  • Static Application Analysis
  • 1. Retrieving iOS and Android apps for reverse engineering analysis
  • 2. Decompiling Android applications
  • 3. Circumventing iOS app encryption
  • 4. Accelerating iOS disassembly: Hopper and IDA Pro
  • 5. Android application analysis with MobSF
  • Reverse-Engineering Obfuscated Applications
  • 1. Identifying obfuscation techniques
  • 2. Decompiling obfuscated applications
  • 3. Decrypting obfuscated content with Simplify

Dynamic Application Analysis

  • Manipulating and Analyzing iOS Applications
  • 1. Runtime iOS application manipulation with Cycript and Frida
  • 2. iOS method swizzling
  • 3. iOS application vulnerability analysis with Objection
  • 4. Tracing iOS application behaviour and API use
  • 5. Extracting secrets with KeychainDumper
  • 6. Method hooking with Frida and Objection
  • Manipulating and Analyzing Android Applications
  • 1. Android application manipulation with Apktool
  • 2. Reading and modifying Dalvik bytecode
  • 3. Adding Android application functionality, from Java to Dalvik bytecode
  • 4. Method hooking with Frida and Objection
  • Mobile Application Security Verification Standard
  • 1. Step-by-step recommendations for application analysis
  • 2. Taking a methodical approach to application security verification
  • 3. Common pitfalls while assessing applications

Programme scope, delivery arrangements and suitability are confirmed during enquiry.