Belajar Security Tester - Testing Mobile Apps

#Pendahuluan

Setelah di episode 11 kita mempelajari security reporting, pada episode ini kita beralih ke platform yang berbeda: mobile. Aplikasi mobile memiliki attack surface unik — local storage, certificate pinning, insecure backup — yang tidak ada di web testing.

#OWASP Mobile Top 10

#	Vulnerability
M1	Improper Credential Usage
M2	Inadequate Supply Chain Security
M3	Insecure Authentication/Authorization
M4	Insufficient Input/Output Validation
M5	Insecure Communication
M6	Inadequate Privacy Controls
M7	Insufficient Binary Protections
M8	Security Misconfiguration
M9	Insecure Data Storage
M10	Insufficient Cryptography

#Intercept HTTPS Traffic

#mitmproxy

bash

# Install mitmproxy
sudo apt install mitmproxy
 
# Jalankan proxy
mitmproxy --listen-port 8080
 
# Akses mitmweb UI
mitmweb --listen-port 8080

#Certificate Pinning Bypass

bash

# Android: bypass certificate pinning dengan Frida
frida -U -f com.app.target -l bypass-pin.js --no-pause
 
# iOS: gunakan SSL Kill Switch
# Atau卸载certificate pinning di debug build

#Local Storage Analysis

bash

# Android: akses data aplikasi
adb shell run-as com.app.target ls /data/data/com.app.target/shared_prefs/
 
# Backup data
adb backup -f backup.ab com.app.target
 
# Analisis backup
java -jar abe.jar unpack backup.ab backup.tar
tar xf backup.tar

#Insecure Backup

bash

# Cek apakah backup diizinkan
# AndroidManifest.xml:
# android:allowBackup="true" → vulnerability
# android:allowBackup="false" → secure

#Praktik: Mobile Security Scan

bash

# 1. Install target app di emulator/device
# 2. Setup mitmproxy
# 3. Configure device proxy ke mitmproxy
# 4. Browse aplikasi dan analisis traffic
# 5. Cek local storage untuk sensitive data
# 6. Test backup configuration

Note

Mobile testing membutuhkan device/emulator fisik. Gunakan Android emulator untuk testing cepat, atau device fisik untuk testing production-like.

#Penutup

HTTPS intercept: mitmproxy + certificate installation.
Certificate pinning: bypass dengan Frida atau SSL Kill Switch.
Local storage: analisis SharedPreferences/Keychain untuk sensitive data.
Backup: pastikan allowBackup="false" atau backup terenkripsi.

Di episode 13 selanjutnya kita akan membahas testing cloud & infrastructure — misconfiguration, exposed services, dan cloud-specific security testing. Sampai jumpa di episode 13!