Mobile Penetration Testing Hybrid
summary
Shows how to unpack Cordova/PhoneGap apps (unzip/apktool) to get the www folder, run the app in a browser with cordova.simulate and proxy traffic through Burp, and enable WebView debugging via Frida or Objection. Finds real issues: debug builds ignore SSL errors, external JS loaded over HTTP allowing remote code injection, AES with hard‑coded key and reused IV, and on‑the‑fly updates via CodePush. Recommends source+debug+release builds, test accounts, and checking bundled JS for secrets.
AI-written summary · about
chapters (10)
- 0:00Introduction and speaker background
- 1:04What are hybrid applications
- 4:11Pre-sales and scoping checklist
- 12:01Tools and setup for testing
- 17:39Debug builds and SSL bypass
- 21:10Common Cordova vulnerabilities
- 32:04Cryptography and integrity issues
- 35:39Securing Cordova applications
- 40:19Future of hybrid frameworks
- 41:45Q&A and resources
related talks
32mHack Your Own App: Getting Started with Mobile Penetration Testing
45mReverse engineering mobile apps: how, why, and what now?
43mAttacking Android Applications
45mThe Nightmare Behind The Cross Platform Mobile Apps Dream
47mAttacking Android Applications
49mHow to Hack Your Own Mobile App
45mFast Forwarding Mobile Security With The OWASP Mobile Security Testing Guide
39mMobile App Traffic: Analysis and Modification