How to Hack & Protect Flutter Apps
summary
Demonstrates live hacks: Magisk + Total Commander lets an attacker edit SharedPreferences and extract a Firebase JWT that immediately impersonates a user; repackaging with APKTool + jadx injects malicious code and harvests tokens; hooking and proxying with Frida, Reflatter and Burp Suite shows how to bypass Flutter’s static pinning and read JSON API traffic. Presents a working free RASP SDK used on 10,000+ apps for root/emulator/hooking detection and a server-side cryptogram attestation that decrypts signals to block illegitimate API calls.
AI-written summary · about
chapters (14)
- 0:00Introduction and motivation
- 1:28Real-world hacking case study
- 4:21Common mobile app attacks
- 6:48Tools used by attackers
- 8:16Modifying shared preferences
- 13:37Shared preferences risks
- 14:41Firebase token theft
- 16:51Repackaging attacks
- 19:45Runtime application self-protection
- 21:11Root and emulator detection
- 23:19OASP mobile security standard
- 24:43Reading network traffic
- 26:57Limitations of RASP
- 27:42App attestation for APIs
related talks
36mSecuring Flutter Apps
43mDangerous Flutter... Or Not?
42mHack My App: Learn Flutter Security by Breaking It
32mSecurity in Flutter: Our Priority
19mSecuring your app: Classic Android vs Other frameworks
33mHacking and protection of Mobile Apps and backend APIs
38mHack and Protect Your App
45mHacking and protecting Android apps