Hack My App: Learn Flutter Security by Breaking It
summary
A deliberately vulnerable fintech app called Open Wallet demo is decompiled with apktool decompile and searched with strings to extract a hardcoded API key (revealed as skive super secret key 1 2 3 4 5), showing how trivial leaks are; fixes use flutter_secure_storage backed by Android Keystore/iOS Keychain and a free RASP (telsac) to detect debuggers and tampering; static analysis with MobSF gives an app security score 46.
AI-written summary · about
chapters (19)
- 0:00Flutter app security intro
- 2:09Why mobile security matters
- 3:56Flutter security strengths
- 7:47Insecure fintech app demo
- 9:25Extracting API keys with APKTool
- 15:42KeyStore vs Keychain explained
- 19:19Secure data with Flutter Secure Storage
- 24:35Runtime threats to Flutter apps
- 27:12Detecting hooking and injection
- 28:42Preventing repackaging and tampering
- 30:00Bypassing TLS pinning risks
- 31:26Runtime Application Self-Protection with RASP
- 32:56Free RASP implementation
- 36:30Free RASP limitations
- 37:11Security testing before release
- 38:57MobSF static analysis
- 39:19Dependency security scanning
- 40:03Penetration testing basics
- 41:07OWASP security guidelines
related talks
33mHacking and protection of Mobile Apps and backend APIs
45mI just hacked your app!
45mI just hacked your app!
36mSecuring Flutter Apps
36mI just hacked your app!
19mSecuring your app: Classic Android vs Other frameworks
44mI just hacked your app!
29mScorthter, Hacking Banks and Cryptocurrency Exchanges through their APIs