Apisecure, 14 & 15 March 2023 - Gabrielle Botbol, Ethical Hacker | Award-winning Pentester [...]

on YouTube ↗56m

" summary

Step-by-step Android API pentest workflow: build an Ubuntu lab with Android Studio emulator, ADB, Burp Suite, JADX and APKTool; import Burp CA into the VM and set proxy to capture traffic; use static analysis to extract endpoints, check AndroidManifest for permissions, debug and backup flags, and find hard-coded API keys; run dynamic tests to intercept and fuzz endpoints, check for broken object level authorization and background data leaks; produce a report with CVSS/CWE, repro steps, evidence and prioritized remediation.

AI-written summary · about

" chapters (32)

1. 0:00Introduction
2. 1:54Speaker background
3. 3:01From literature to hacker
4. 4:23Pen tester training
5. 7:14Android architecture
6. 8:58Why Android pen testing
7. 11:51APIs in Android apps
8. 14:22Android pen test process
9. 15:27Lab setup for pen testing
10. 17:57Android emulator setup
11. 19:23Burp Suite configuration
12. 23:22Static analysis of apps
13. 26:56Android Manifest checks
14. 28:00Finding API endpoints
15. 31:14Hardcoded secrets in apps
16. 32:18Static analysis tips
17. 34:31Automated static tools
18. 35:13Dynamic analysis with Burp
19. 36:17Info disclosure demo
20. 37:21Automated dynamic tools
21. 38:47Common API vulnerabilities
22. 40:34Checklists in pen testing
23. 42:21Pen test report structure
24. 44:31Broken authorization reporting
25. 45:58Learning resources
26. 47:25Report communication
27. 48:49Android vs iOS testing
28. 50:14Dynamic code analysis with MobSF
29. 51:16Mobile API pen test steps
30. 53:26Learning path for testers
31. 54:52Common API vulnerabilities
32. 55:34Closing remarks and Q&A

" related talks

• 32mHack Your Own App: Getting Started with Mobile Penetration TestingBenedikt Löbbecke, Julius Fischer · AndroidMakers by droidcon 2026
• 43mAttacking Android ApplicationsDario Incalza · Droidcon Italy 2017
• 15mJumpstart Security & Penetration Testing APIsK. Sundaresan · TestFlix 2022
• 57mEnterprise Ethical Hacking Cloud ApplicationsRohit Bhardwaj · Developer Summit 2020
• 42mTesting Android SecurityJose Manuel Ortega Candel · Codemotion Amsterdam 2016
• 45mI just hacked your app!Marcos Placona · NDC Oslo 2018
• 48mMastering Android Security Research: A Guide for the Modern Security ResearcherHahna Latonick, Jacob Swinsinski · BSides Tampa 2024
• 58mResearching Android Device Security with the Help of a Droid ArmyJoshua 'jduck' Drake · Black Hat USA 2014