Frida - Objection Tool Usage

•Transferir como PPTX, PDF•

0 gostou•593 visualizações

n|u - The Open Security Community

Educação

WHOAMI
• Dinesh / Dinz
• Security Engineer @ Briskinfosec

WHAT IS FRIDA & OBJECTION
&
Frida is a swiss Army knife
Frida is a dynamic instrumentation toolkit.
It is mainly created for testers, developers and reverse engineering enthusiasts.
we can inject our own JavaScript into apps of Windows, macOS, GNU/Linux, iOS, Android, and QNX.
=
Credits to _leon_jacobs

WHERE IT WILL BE USEFUL
• Will be useful during the static & dynamic analysis (Most of the features will be used
here).
• Patching the Application’s package with Frida.
• Bypassing the Jailbreak/root and SSL pinning.

OBJECTION
• Installation :
pip3 install objection
Reference : https://github.com/sensepost/objection/
• objection is a runtime mobile exploration
toolkit, powered by Frida.
• built to help you assess the security posture
of your mobile applications.
• Supports both iOS and Android
• Has So many cool features.

INJECTING APPLICATIONS
objection --gadget AppName explore

EXPLORING WITH OBJECTION
Basic Commands :
• Commands, frida, reconnect, exit, ui
• env, ls, !, pwd, cd, rm, sqlite
• android, ios
• file, plugin, jobs
• import, memory, Evaluate

STATIC ANALYSIS
• ios info binary
• ios bundles list_bundles
• ios bundles list_frameworks

FINDING CLASS AND METHODS
• ios hooking list classes
• ios hooking list class_methods Classname
• ios hooking search classes keywords
• ios hooking search methods classname
• ios hooking watch class classname --include-parents
• ios hooking set return_value "+[classname methodname]" false

DYNAMIC ANALYSIS
• ios cookies get – for getting the cookie values from the domains used in the
application.
• ios keychain dump – dump the entries in the iOS keychain

Mais conteúdo relacionado

Mais procurados

API Security - Everything You Need to Know To Protect Your APIsAaronLieberman5

Mobile Application Security Testing (Static Code Analysis) of Android AppAbhilash Venkata

Bug Bounty - Play For MoneyShubham Gupta

Pwning mobile apps without root or jailbreakAbraham Aranguren

Implementing generic JNI hardware control for Kotlin based app on AOSPCheng Wig

Writing php extensions in golangdo_aki

Android Security & Penetration TestingSubho Halder

Instructions on how to create account in sonarcloudssuser29f27f

Secure Code Review 101Narudom Roongsiriwong, CISSP

Digital Forensics and Incident Response (DFIR) using Docker ContainersDeep Shankar Yadav

Mobile security part 1(Android Apps Pentesting)- Romansh yadavRomansh Yadav

Live Hacking like a MVH – A walkthrough on methodology and strategies to win bigFrans Rosén

XXE: How to become a JediYaroslav Babin

Burp suiteYashar Shahinzadeh

The Secret Life of a Bug Bounty Hunter – Frans Rosén @ Security Fest 2016Frans Rosén

Secure Coding principles by example: Build Security In from the start - Carlo...Codemotion

iOS Application Penetration Testingn|u - The Open Security Community

Taking Hunting to the Next Level: Hunting in MemoryJoe Desimone

SSRF For Bug BountiesOWASP Nagpur

Bug Bounty 101Shahee Mirza

Mais procurados (20)

API Security - Everything You Need to Know To Protect Your APIs

Mobile Application Security Testing (Static Code Analysis) of Android App

Bug Bounty - Play For Money

Pwning mobile apps without root or jailbreak

Implementing generic JNI hardware control for Kotlin based app on AOSP

Writing php extensions in golang

Android Security & Penetration Testing

Instructions on how to create account in sonarcloud

Secure Code Review 101

Digital Forensics and Incident Response (DFIR) using Docker Containers

Mobile security part 1(Android Apps Pentesting)- Romansh yadav

Live Hacking like a MVH – A walkthrough on methodology and strategies to win big

XXE: How to become a Jedi

Burp suite

The Secret Life of a Bug Bounty Hunter – Frans Rosén @ Security Fest 2016

Secure Coding principles by example: Build Security In from the start - Carlo...

iOS Application Penetration Testing

Taking Hunting to the Next Level: Hunting in Memory

SSRF For Bug Bounties

Bug Bounty 101

Semelhante a Frida - Objection Tool Usage

Dmitry 'D1g1' Evdokimov - BlackBox analysis of iOS appsDefconRussia

Droidcon it-2014-marco-grassi-viaforensicsviaForensics

Android village @nullcon 2012 hakersinfo

2013 Toorcon San Diego Building Custom Android Malware for Penetration TestingStephan Chenette

How to Use Open Source Tools to Improve Network SecurityMohammed Almusaddar

ShiftGearsWithInformationSecurity.pdfSteven Carlson

Hacking & Securing of iOS Apps by Saurabh MishraOWASP Delhi

Hacking and Securing iOS Apps : Part 1Subhransu Behera

Hacking Samsung's Tizen: The OS of Everything - Hack In the Box 2015Ajin Abraham

AppSensor - Near Real Time Event Detection and Responsejtmelton

Vulnex app secusa2013drewz lin

OWASP Québec: Threat Modeling Toolkit - Jonathan MarcilJonathan Marcil

Building Custom Android Malware BruCON 2013Stephan Chenette

Infosecurity.be 2019: What are relevant open source security tools you should...B.A.

Securing Container Deployments from Build to Ship to Run - August 2017 - Ranc...Shannon Williams

DEF CON 24 - Dinesh and Shetty - practical android application exploitationFelipe Prado

AndroidVibhu Mishra

voice recognition security system pptNitesh Dubey

Ruxmon April 2014 - Introduction to iOS Penetration Testingeightbit

AllDayDevOps 2019 AppSensorjtmelton

Semelhante a Frida - Objection Tool Usage (20)

Dmitry 'D1g1' Evdokimov - BlackBox analysis of iOS apps

Droidcon it-2014-marco-grassi-viaforensics

Android village @nullcon 2012

2013 Toorcon San Diego Building Custom Android Malware for Penetration Testing

How to Use Open Source Tools to Improve Network Security

ShiftGearsWithInformationSecurity.pdf

Hacking & Securing of iOS Apps by Saurabh Mishra

Hacking and Securing iOS Apps : Part 1

Hacking Samsung's Tizen: The OS of Everything - Hack In the Box 2015

AppSensor - Near Real Time Event Detection and Response

Vulnex app secusa2013

OWASP Québec: Threat Modeling Toolkit - Jonathan Marcil

Building Custom Android Malware BruCON 2013

Infosecurity.be 2019: What are relevant open source security tools you should...

Securing Container Deployments from Build to Ship to Run - August 2017 - Ranc...

DEF CON 24 - Dinesh and Shetty - practical android application exploitation

Android

voice recognition security system ppt

Ruxmon April 2014 - Introduction to iOS Penetration Testing

AllDayDevOps 2019 AppSensor

Mais de n|u - The Open Security Community

Hardware security testing 101 (Null - Delhi Chapter)n|u - The Open Security Community

Osint primern|u - The Open Security Community

SSRF exploit the trust relationshipn|u - The Open Security Community

Nmap basicsn|u - The Open Security Community

Metasploit primaryn|u - The Open Security Community

Api security-testingn|u - The Open Security Community

Introduction to TLS 1.3n|u - The Open Security Community

Gibson 101 -quick_introduction_to_hacking_mainframes_in_2020_null_infosec_gir...n|u - The Open Security Community

Talking About SSRF,CRLFn|u - The Open Security Community

Building active directory lab for red teamingn|u - The Open Security Community

Owning a company through their logsn|u - The Open Security Community

Introduction to shodann|u - The Open Security Community

Cloud security n|u - The Open Security Community

Detecting persistence in windowsn|u - The Open Security Community

OSQuery - Monitoring System Processn|u - The Open Security Community

DevSecOps Jenkins Pipeline -Securityn|u - The Open Security Community

Extensible markup language attacksn|u - The Open Security Community

Linux for hackersn|u - The Open Security Community

News bytes null 200314121904n|u - The Open Security Community

XXEn|u - The Open Security Community

Mais de n|u - The Open Security Community (20)

Hardware security testing 101 (Null - Delhi Chapter)

Osint primer

SSRF exploit the trust relationship

Nmap basics

Metasploit primary

Api security-testing

Introduction to TLS 1.3

Gibson 101 -quick_introduction_to_hacking_mainframes_in_2020_null_infosec_gir...

Talking About SSRF,CRLF

Building active directory lab for red teaming

Owning a company through their logs

Introduction to shodan

Cloud security

Detecting persistence in windows

OSQuery - Monitoring System Process

DevSecOps Jenkins Pipeline -Security

Extensible markup language attacks

Linux for hackers

News bytes null 200314121904

XXE

Último

4.16.24 Poverty and Precarity--Desmond.pptxmary850239

Daily Lesson Plan in Mathematics Quarter 4JOYLYNSAMANIEGO

GRADE 4 - SUMMATIVE TEST QUARTER 4 ALL SUBJECTSJoshuaGantuangco2

FINALS_OF_LEFT_ON_C'N_EL_DORADO_2024.pptxConquiztadors- the Quiz Society of Sri Venkateswara College

Full Stack Web Development Course for BeginnersSabitha Banu

INTRODUCTION TO CATHOLIC CHRISTOLOGY.pptxHumphrey A Beña

Virtual-Orientation-on-the-Administration-of-NATG12-NATG6-and-ELLNA.pdfErwinPantujan2

Transaction Management in Database Management SystemChristalin Nelson

How to do quick user assign in kanban in Odoo 17 ERPCeline George

ICS2208 Lecture6 Notes for SL spaces.pdfVanessa Camilleri

ENGLISH 7_Q4_LESSON 2_ Employing a Variety of Strategies for Effective Interp...JhezDiaz1

Raw materials used in Herbal Cosmetics.pptxAshokrao Mane college of Pharmacy Peth-Vadgaon

How to Add Barcode on PDF Report in Odoo 17Celine George

USPS® Forced Meter Migration - How to Know if Your Postage Meter Will Soon be...Postal Advocate Inc.

Grade 9 Quarter 4 Dll Grade 9 Quarter 4 DLL.pdfJemuel Francisco

YOUVE_GOT_EMAIL_PRELIMS_EL_DORADO_2024.pptxConquiztadors- the Quiz Society of Sri Venkateswara College

Karra SKD Conference Presentation Revised.pptxAshokKarra1

Active Learning Strategies (in short ALS).pdfPatidar M

Barangay Council for the Protection of Children (BCPC) Orientation.pptxCarlos105

Incoming and Outgoing Shipments in 3 STEPS Using Odoo 17Celine George

Frida - Objection Tool Usage

1. OBJECTION N U L L C H E N N A I M E E T

2. WHOAMI • Dinesh / Dinz • Security Engineer @ Briskinfosec

3. WHAT IS FRIDA & OBJECTION & Frida is a swiss Army knife Frida is a dynamic instrumentation toolkit. It is mainly created for testers, developers and reverse engineering enthusiasts. we can inject our own JavaScript into apps of Windows, macOS, GNU/Linux, iOS, Android, and QNX. = Credits to _leon_jacobs

4. WHERE IT WILL BE USEFUL • Will be useful during the static & dynamic analysis (Most of the features will be used here). • Patching the Application’s package with Frida. • Bypassing the Jailbreak/root and SSL pinning.

5. OBJECTION • Installation : pip3 install objection Reference : https://github.com/sensepost/objection/ • objection is a runtime mobile exploration toolkit, powered by Frida. • built to help you assess the security posture of your mobile applications. • Supports both iOS and Android • Has So many cool features.

6. INJECTING APPLICATIONS objection --gadget AppName explore

7. EXPLORING WITH OBJECTION Basic Commands : • Commands, frida, reconnect, exit, ui • env, ls, !, pwd, cd, rm, sqlite • android, ios • file, plugin, jobs • import, memory, Evaluate

8. STATIC ANALYSIS • ios info binary • ios bundles list_bundles • ios bundles list_frameworks

9. FINDING CLASS AND METHODS • ios hooking list classes • ios hooking list class_methods Classname • ios hooking search classes keywords • ios hooking search methods classname • ios hooking watch class classname --include-parents • ios hooking set return_value "+[classname methodname]" false

10. DYNAMIC ANALYSIS • ios cookies get – for getting the cookie values from the domains used in the application. • ios keychain dump – dump the entries in the iOS keychain

11. ENDING NOTES

12. ANY QUESTIONS

Frida - Objection Tool Usage

Recomendados

Recomendados

Mais conteúdo relacionado

Mais procurados

Mais procurados (20)

Semelhante a Frida - Objection Tool Usage

Semelhante a Frida - Objection Tool Usage (20)

Mais de n|u - The Open Security Community

Mais de n|u - The Open Security Community (20)

Último

Último (20)

Frida - Objection Tool Usage