Bank Vulnerability : Accessing Account Information of Other Users One in the Top 5 Private Bank Vulnerability -

"Saga Of "One of the Top 5 Private Bank Vulnerability - Accessing Account Information of Other Users

This disclosure is regarding a vulnerability which left Remain Open Till 5 Months Even after a Reporting to Bank Officials. God known wether this was actively exploited or not but that was something serious which bank should take care but they did not till 10th May I asked them again about the status.

I have found on "One of the Top 5 Bank" iPad Version application end of the last year Nov 23rd 2018 which is fixed on  10th May 2019.

Read more »

iOS Application Pentesting Part 5 : Insecure HTTP Data Transit

Just like Transmitting Sensitive Credentials Over HTTP, Application which used HTTP to communicate with their server and don`t using any kind of encryption are vulnerable to this issues.

In iGoat application, there is a simple demonstration that username & password passed in application is transmitting over http and without any encryption as result an attacker can capture/sniff those packages and could hijack victim`s account.

Read more »

iOS Application Pentesting Part 4 : Installing iGoat Application

Picture taken from : https://www.owasp.org/index.php/OWASP_iGoat_Project

To perform hands on practice and learning we will use iGoat iOS Application part of OWASP Security Project. You can find their Github page here. This Mobile Application is designed as vulnerable for Security Professionals and learner to enhanced their Skills over iOS Application Pentesting.

This project is Maintained by following folks.
Swaroop
masbog
mtesauro
DinisCruz

Here is the Project Details

For later practices we will install this application XCode and run it, But i recommended you to use a Physical device while performing pentesting.

Read more »

iOS Application Pentesting Part 3 : Extracting iOS App Class Information

Every application has his own group of codes which contents lots of information about the functionality and so on. It will always better if we can extract all the possible information about our application which we are going to attack.

Toady we will see How to Extract Class Information Of iOS Application.

Apple has made some modification in their security and now days most the app store apps are encrypted which first need to decrypt to extract class information.

So first we will see class dumping of non-encrypted apps.

Dumping Class Information Of Pre-Installed Applications
We have 2 ways the find the app.

1) find / -type d -iname "Dam*.app"
2) If the app is customly installed using IPA file then his save directory would be Applications/


I am using the command line search for Damm Vulnerable iOS Application which is developed by  Prateek Gianchandani.

Read more »

iOS Application Pentesting Part 2 : iOS Application Basics

In todays post, we will see iOS Application. Knowing our enemy before attacking is very important for us ;)

iOS : If i can say in simple words, Its an Operating System which run various iDevices which is create By Apple Inc.

iOS (formerly iPhone OS) is a mobile operating system created and developed by Apple Inc. exclusively for its hardware. It is the operating system that presently powers many of the company's mobile devices, including the iPhone, iPad, and iPod Touch. It is the second most popular mobile operating system globally after Android. iPad tablets are also the second most popular, by sales, against Android since 2013.[9]

Read more »

iOS Application Pentesting Part 1 : Setting Up The Attacking Environment

iOS Application Pentesting Part 1 : Introduction To iOS 

In this article, we will see essentials tools and environment which we required to perform penetration testing and Vulnerability assessment on iOS Applications.

JailBreaking Your Device : ;) 

First thing first, if you are very serious about iOS Application Pentesting then you should required a Jailbroken device with you.

Below we will see how we can JailBreak a iOS Device.

iOS JailBreaking have a great history, First pangu have Jailbroke the iOS then other team did the same.

Be frank to Jailbrea iOS device, First you need to check whether your Installed iOS Version is already JailBroken or not. 

Note - For this particular tutorial we will use Xcode Simulator but highly recommended you to get A Jailbreak Device if you are very serious about learning iOS Application Pentesting.

Read more »