testing-mobile-applications

测试移动应用

适用场景

• Android APK 分析与利用
• iOS 应用渗透测试
• 移动应用安全评估
• 绕过安全控制（SSL 固定、Root 检测）
• 测试移动端特有漏洞

不适用场景

• 后端 API 测试 — 使用 testing-apis
• 深入逆向原生二进制文件 — 使用 analyzing-binaries
• 分析恶意应用 — 使用 analyzing-malware
• 有源代码可用 — 使用 auditing-code-for-vulnerabilities

首先检查框架

jadx 几乎没有输出，并不意味着应用经过了混淆——通常意味着逻辑根本不在 dex 中。先运行此检查；它会决定你应该使用哪个技能。

unzip -l target.apk | rg 'libflutter|libapp\.so|index\.android\.bundle|libhermes|global-metadata|libil2cpp|Assembly-CSharp'

标记	框架	技能
libflutter.so、libapp.so、flutter_assets/	Flutter / Dart	reversing-flutter-apps
index.android.bundle、libhermes.so、main.jsbundle	React Native	reversing-react-native-apps
global-metadata.dat、libil2cpp.so、Assembly-CSharp.dll	Unity	reversing-unity-il2cpp
libmonodroid.so、assemblies.blob、libxamarin-app.so	Xamarin / .NET MAUI	reversing-xamarin-maui
包含真实应用程序包的 classes*.dex	原生 Android	继续使用此技能

值得指出两种框架特征，因为误判它们最容易浪费时间：Flutter 应用在代理中完全没有流量（它会忽略系统代理和 CA 存储），而 React Native 或 Unity 应用的 dex 几乎为空，所有逻辑都在 assets/ 中。

还有三项独立的流程技能从此技能中拆分出来，因为它们所需的细节远超一般评估所能涵盖的范围：

情况	技能
应用在已 Root 的设备上退出，或在 Frida 附加时崩溃	bypassing-root-jailbreak-detection
iOS 二进制文件相关工作：FairPlay 解密、Mach-O、class-dump、entitlements	analyzing-ios-binaries
导出的组件、深层链接、URL 方案、内容提供程序	testing-mobile-ipc

如果代理因其他原因失效——例如 TLS 握手警报，或者应用启用代理后报告网络错误——请先使用 bypassing-mobile-pinning，再判断是否为证书固定问题。在 Android 7 及更高版本上，最常见的原因是 CA 被安装为用户证书，而应用默认不信任这类证书；绕过证书固定也无法解决这一问题。

Android 渗透测试

APK 分析工具

# Decompile APK
apktool d app.apk -o app_decompiled

# Convert DEX to JAR
d2j-dex2jar app.apk

# View JAR with JD-GUI
jd-gui app-dex2jar.jar

# Automated analysis
mobsf  # Mobile Security Framework
jadx app.apk  # APK to Java decompiler

ADB（Android Debug Bridge）

# List devices
adb devices

# Connect over network
adb connect 192.168.1.100:5555

# Install APK
adb install app.apk

# Uninstall
adb uninstall com.package.name

# List packages
adb shell pm list packages
adb shell pm list packages | grep -i "keyword"

# Get APK path
adb shell pm path com.package.name

# Pull APK from device
adb pull /data/app/com.package.name-xxx/base.apk

# Start activity
adb shell am start -n com.package.name/.MainActivity

# View logs
adb logcat

# Shell access
adb shell

静态分析

搜索敏感数据：

# Extract strings
strings app.apk | grep -i password
strings app.apk | grep -i api
strings app.apk | grep -i token
strings app.apk | grep -i key

# Search in decompiled code
grep -r "password" app_decompiled/
grep -r "http://" app_decompiled/
grep -r "api_key" app_decompiled/

检查 AndroidManifest.xml：

# Decompile and view
apktool d app.apk
cat app_decompiled/AndroidManifest.xml

# Look for:
# - android:debuggable="true"
# - android:allowBackup="true"
# - Exported activities/services
# - Custom permissions
# - URL schemes

动态分析

Frida（运行时插桩）：

# List running apps
frida-ps -U

# Attach to app
frida -U -n "App Name"
frida -U -f com.package.name

# Load script
frida -U -f com.package.name -l script.js

# Common scripts
# - Bypass SSL pinning
# - Bypass root detection
# - Hook functions
# - Dump memory

绕过 SSL 固定：

// Frida script - Universal SSL pinning bypass
Java.perform(function() {
    var TrustManager = Java.use('javax.net.ssl.X509TrustManager');
    TrustManager.checkServerTrusted.implementation = function() {};

    var SSLContext = Java.use('javax.net.ssl.SSLContext');
    SSLContext.init.overload('[Ljavax.net.ssl.KeyManager;', '[Ljavax.net.ssl.TrustManager;', 'java.security.SecureRandom').implementation = function(a,b,c) {
        this.init.overload('[Ljavax.net.ssl.KeyManager;', '[Ljavax.net.ssl.TrustManager;', 'java.security.SecureRandom').call(this, a, null, c);
    };
});

绕过 Root 检测：

// Frida - Bypass root detection
Java.perform(function() {
    var RootClass = Java.use('com.package.name.RootDetection');
    RootClass.isRooted.implementation = function() {
        return false;
    };
});

拦截流量

Burp Suite 设置：

# 1. Install Burp CA certificate
# Download from http://burp:8080 on device
# Install in Settings -> Security -> Install from storage

# 2. Configure proxy
adb shell settings put global http_proxy 192.168.1.100:8080

# 3. For apps with SSL pinning, use Frida bypass

# 4. Clear proxy when done
adb shell settings put global http_proxy :0

mitmproxy：

# Start mitmproxy
mitmproxy --listen-port 8080

# Install certificate on device
# http://mitm.it

# Set device proxy to attacker IP:8080

修改并重新打包 APK

# 1. Decompile
apktool d app.apk -o app_mod

# 2. Modify smali code
# Edit files in app_mod/smali/

# 3. Recompile
apktool b app_mod -o app_modified.apk

# 4. Sign APK
# Generate keystore (first time only)
keytool -genkey -v -keystore my-key.keystore -alias alias_name -keyalg RSA -keysize 2048 -validity 10000

# Sign
jarsigner -verbose -sigalg SHA1withRSA -digestalg SHA1 -keystore my-key.keystore app_modified.apk alias_name

# Or use uber-apk-signer
java -jar uber-apk-signer.jar -a app_modified.apk

# 5. Install
adb install app_modified.apk

常见漏洞

不安全的数据存储：

# Check shared preferences
adb shell
cd /data/data/com.package.name/shared_prefs/
cat *.xml

# Check databases
cd /data/data/com.package.name/databases/
sqlite3 database.db
.tables
SELECT * FROM users;

# Check files
cd /data/data/com.package.name/files/
ls -la
cat *

导出的组件：

# List exported activities
adb shell dumpsys package com.package.name | grep -A 20 "Activity"

# Start exported activity
adb shell am start -n com.package.name/.ExportedActivity

# Call exported service
adb shell am startservice -n com.package.name/.ExportedService

# Broadcast to receiver
adb shell am broadcast -a com.package.name.ACTION

不安全的 WebView：

# Check for JavaScript enabled
# Look in code for:
webView.getSettings().setJavaScriptEnabled(true);

# Check for addJavascriptInterface
# Can lead to RCE if exposed

iOS 渗透测试

设置

越狱工具：

• checkra1n（iOS 12-14）
• unc0ver（iOS 11-14.8）
• Taurine（iOS 14-14.3）

SSH 访问：

# Default credentials
ssh root@<device-ip>
# password: alpine

# Change default password!
passwd

IPA 分析

# Extract IPA
unzip app.ipa

# View binary
otool -L Payload/App.app/App
strings Payload/App.app/App

# Class dump
class-dump Payload/App.app/App > classes.txt

# Decrypt binary (on jailbroken device)
frida-ios-dump -u App

# Static analysis with Hopper/Ghidra

运行时分析

在 iOS 上使用 Frida：

# List apps
frida-ps -Ua

# Attach
frida -U -n "App Name"
frida -U -f com.company.app

# SSL pinning bypass (iOS)
objection -g "App Name" explore
ios sslpinning disable

Objection：

# Launch objection
objection -g com.company.app explore

# Common commands
ios info binary
ios hooking list classes
ios hooking search methods MainActivity
ios sslpinning disable
ios jailbreak disable
ios keychain dump
ios nsuserdefaults get

文件系统访问

# Connect via SSH
ssh root@device-ip

# App data location
cd /var/mobile/Containers/Data/Application/<UUID>/

# Find app UUID
ipainstaller -l  # List apps
ls /var/mobile/Containers/Data/Application/

# Common paths
Documents/
Library/
Library/Preferences/  # plist files
Library/Caches/
tmp/

钥匙串访问

# Using objection
ios keychain dump

# Manual (requires keychain-dumper on device)
./keychain_dumper

# Specific item
security find-generic-password -s "ServiceName"

常见 iOS 漏洞

不安全的数据存储：

# Check plist files
plutil -p Info.plist

# Check UserDefaults
ios nsuserdefaults get

# Check SQLite databases
sqlite3 database.db
.tables
SELECT * FROM sensitive_table;

二进制保护：

# Check for PIE
otool -hv App | grep PIE

# Check for stack canaries
otool -I App | grep stack_chk

# Check for ARC
otool -I App | grep objc_release

移动端特有攻击

深层链接利用：

# Android
adb shell am start -a android.intent.action.VIEW -d "app://open?param=value"

# iOS
xcrun simctl openurl booted "app://open?param=value"

Intent 注入：

# Send malicious intent
adb shell am start -n com.package/.Activity --es "extra_key" "malicious_value"

备份提取：

# Android backup
adb backup -f backup.ab com.package.name
# Extract
java -jar abe.jar unpack backup.ab backup.tar

# iOS backup
idevicebackup2 backup --full backup_directory

工具

Android：

• APKTool - 反编译/重新编译 APK
• dex2jar - 将 DEX 转换为 JAR
• JADX - APK 转 Java 反编译器
• Frida - 动态插桩
• Objection - 基于 Frida 的工具包
• MobSF - 自动化分析
• Drozer - Android 安全框架

iOS：

• Frida - 动态插桩
• Objection - Frida 工具包
• class-dump - 提取类信息
• Hopper/Ghidra - 反汇编器
• frida-ios-dump - 解密二进制文件
• iproxy - 转发端口

快速测试工作流

1. 静态分析 - 反编译、搜索字符串、分析 manifest/Info.plist
2. 安装 - 在模拟器/设备上安装
3. 拦截流量 - 配置 Burp/mitmproxy，绕过 SSL pinning
4. 动态分析 - 使用 Frida hook 函数，绕过保护机制
5. 测试组件 - 测试导出的组件、深层链接、intent
6. 数据存储 - 检查文件/DB/keychain 中是否存在不安全的数据存储
7. 重新打包 - 修改并重新编译，以测试其他场景

参考资料

• https://book.hacktricks.xyz/mobile-pentesting
• https://github.com/OWASP/owasp-mstg
• https://mobile-security.gitbook.io/