Hack Your Own App: Getting Started with Mobile Penetration Testing
summary
Demo shows concrete workflow: run MobSF, Burp Suite, objection for static and dynamic checks, use APKTool and JADX to modify network security config, rebuild and sign an APK, and confirm a proof‑of‑concept exploit that abuses an unsanitized deep link plus a WebView JavaScript bridge to exfiltrate cookies. Presenter cites surprising stats (only ~10–20% commission pentests, 44% of mission‑critical projects use them, 62% with incidents). All demos run live and the cookie‑stealing exploit works.
AI-written summary · about
chapters (12)
- 0:00Mobile pen testing intro
- 2:30Static analysis workflow
- 7:36Demo environment setup
- 10:07Analyzing app manifest
- 13:18Deep link & web view vulns
- 15:24Burp Suite for dynamic analysis
- 19:05Modifying network security config
- 21:18Rebuilding & installing app
- 25:48Exploiting deep link vuln
- 27:42JS exploit for cookie theft
- 29:48Full attack chain demo
- 30:55Q&A on AABs & CI/CD
related talks
44mMobile Penetration Testing Hybrid
01h 13mAutomated Static And Dynamic Security Analysis of Mobile Apps
45mI just hacked your app!
49mHow to Hack Your Own Mobile App
33mHacking and protection of Mobile Apps and backend APIs
41mJust Another Live Hacking - How Insecure Is Secure Enough?
31mTopics of Interest: Unlocking Mobile App Security Secrets
43mAttacking Android Applications