Thunderbird: Setup End-to-End Encryption

2024-12-16T19:23:50Z

AMessner:

== Summary ==

Description what this documentation is about.

== Requirements ==

* 2 Virtual Machines: Ubuntu 22.04.5 LTS
* 2 Email-Accounts for Thunderbird

== S/MIME in Thunderbird ==

=== Step 1: Creating a Self-Signed Certificate (own CA) ===
* Generate the CA private key:
<pre>openssl genrsa -des3 -out ca.key 4096</pre>
* Create a self-signed certificate for the CA:
<pre>openssl req -new -x509 -days 365 -key ca.key -out ca.crt</pre>
* Send ca.crt to both Clients

* Example cert:
[[File:Thunderbird-Using end-to-end encryption Smime CA cert.PNG]]

=== Step 2: Creating a Certificate for Client1, Signed by Your Own CA ===
* Generate the private key for Client1:
<pre>openssl genrsa -des3 -out cert.key 4096</pre>
* Create a Certificate Signing Request (CSR) for Client1:
<pre>openssl req -new -key cert.key -out cert.csr</pre>
* Sign the CSR with your CA to generate Client1's certificate:
<pre>openssl x509 -req -days 365 -in cert.csr -CA ca.crt -CAkey ca.key -out cert.crt</pre>
* Export the certificate and private key to a PKCS#12 file:
<pre>openssl pkcs12 -export -in cert.crt -inkey cert.key -name "Alice Smith" -out cert.p12</pre>

* Example cert:
[[File:Thunderbird-Setup End-to-End Encryption Smime alice cert.PNG]]

=== Step 3: Creating a Certificate for Client2, Signed by Your Own CA ===
* Generate the private key for Client2:
<pre>openssl genrsa -des3 -out cert.key 4096</pre>
* Create a Certificate Signing Request (CSR) for Client2:
<pre>openssl req -new -key cert.key -out cert.csr</pre>
* Sign the CSR with your CA to generate Client2's certificate:
<pre>openssl x509 -req -days 365 -in cert.csr -CA ca.crt -CAkey ca.key -out cert.crt</pre>
* Export the certificate and private key to a PKCS#12 file:
<pre>openssl pkcs12 -export -in cert.crt -inkey cert.key -name "Bob Builder" -out cert.p12</pre>

=== Configuration in Thunderbird ===
* Open Thunderbird and navigate to:
<pre>Settings > Privacy & Security > Certificates > Manage Certificates</pre>
* Import the certificates as follows:
** '''On Client1''':
*** Import the '''Step 1 certificate''' (''ca.crt'') under '''Authorities'''.
*** Import the '''Step 2 certificate''' (your own, ''cert.p12'') under '''Your Certificates'''.
*** Import the '''Step 3 certificate''' (from Client2, ''cert.p12'') under '''People'''.
** '''On Client2''':
*** Import the '''Step 1 certificate''' (''ca.crt'') under '''Authorities'''.
*** Import the '''Step 3 certificate''' (your own, ''cert.p12'') under '''Your Certificates'''.
*** Import the '''Step 2 certificate''' (from Client1, ''cert.p12'') under '''People'''.

By completing these steps, S/MIME will be successfully integrated into Thunderbird, enabling secure email communication with encryption and digital signatures between the two clients.

== Integration of OpenPGP in Thunderbird ==

OpenPGP enables end-to-end encryption in Thunderbird, ensuring secure communication through encrypted emails and digital signatures. The following steps outline the process for setting up OpenPGP in Thunderbird, creating key pairs, and exchanging public keys.

=== Step 1: Enable OpenPGP in Thunderbird ===
# Open Thunderbird.
# Navigate to '''Account Settings''' and select '''End-to-End Encryption'''.
# Click '''Add Key''' to create a new OpenPGP key pair.
* Select your Identity.
* Optionally, set an expiration date for the key or leave it as "Never Expires."
* Choose a Key type.
* Click '''Generate Key'''. Thunderbird will create the key pair and associate it with your email account.

=== Step 2: Exporting Your Public Key ===
# Navigate to '''Account Settings''' and select '''End-to-End Encryption'''.
# Navigate to the '''OpenPGP Key Manager''':
# Locate your newly created key in the list.
# Right-click on your key and '''Select one of these Options to Share your Public Key''':
#* Copy Public Key
#* Export Public Key To File
#* Send Public Key By Email
# Share the Public Key via Email, or other communication, with your Contact

=== Step 3: Importing Public Keys from Contacts ===
# When you receive a contact's public key
#* '''via Message:''' Open the **OpenPGP Key Manager** in Thunderbird, Save the copied Public Key into a `.asc` File & Import it via OpenPGP Key Manager
#* '''via File:''' Open the **OpenPGP Key Manager** in Thunderbird, Click '''File > Import Keys from File''', then select the `.asc` file you received.
#* '''via Email:''' double-click the `.asc` file in the email, and Thunderbird will prompt you to import the key

By following these steps, you can successfully integrate OpenPGP into Thunderbird, enabling secure email communication with encryption and digital signatures.

== Courses ==

* [[Ausgewählte Kapitel der IT-Security]] (2024)

== References ==

* https://www.nakivo.com/blog/virtualbox-network-setting-guide/
* https://www.howtoforge.com/how-to-encrypt-mails-with-ssl-certificates-s-mime
* https://dokuwiki.nausch.org/doku.php/centos:openpgp_beim_mua#openpgp_versus_s_mime

[[Category:Documentation]]

2024-12-16T18:03:20Z

AMessner:

== Summary ==

Description what this documentation is about.

== Transport Layer Security (TLS) ==
TLS is a cryptographic protocol that secures communications over a network by providing confidentiality, integrity, and authentication. It is commonly used to secure connections between a client and a server, as well as between servers.

=== Confidentiality ===
* Data is encrypted during transit to ensure it cannot be intercepted and read.
* TLS uses asymmetric encryption during the handshake phase to securely exchange a symmetric session key, which is then used for fast and efficient encryption of the data.

=== Integrity ===
* Message Authentication Codes (MACs) ensure that any modification of the transmitted data is detected.

=== Authentication ===
* TLS uses digital certificates issued by trusted Certificate Authorities (CAs) to confirm the identity of the communicating parties.
* The server presents its certificate to the client during the handshake phase to prove its legitimacy.
* Optionally, mutual authentication can occur, where the client also provides its certificate.

=== How TLS operates ===
TLS operates in two stages:

# TLS Handshake Protocol
#* This phase negotiates security parameters, including the cryptographic algorithms to be used (cipher suites).
#* The server sends its certificate to the client, which verifies the certificate against trusted CAs.
#* Optional client authentication can occur here if needed.
#* A session key, that will be used as a symmetric key, is exchanged using encrypted key-exchange.
#* MACs ensure that data integrity is preserved.

# TLS Record Protocol
#* After the handshake, the Record Protocol manages the symmetric encrypted transmission of data.
#* Data is encrypted using the session key established during the handshake.
#* MACs ensure that data integrity is preserved.

=== Limitations ===
* '''Encryption Only During Transmission:''' TLS protects emails only during transmission. Once the email reaches the server or the recipient's device, the content is unencrypted and stored as plain text unless additional end-to-end encryption encryption is used.
* '''No Guarantee of TLS Usage at Every Step in Communication:''' TLS cannot guarantee encryption for the entire journey of an email. After leaving the sender's device, emails often pass through multiple intermediary Mail Transfer Agents (MTAs) before reaching the recipient. If any of these MTAs do not support or enforce TLS, the email may be transmitted in plaintext, exposing it to potential interception. Additionally, the sender has no control over whether these intermediary MTAs adhere to TLS requirements, leaving a gap in secure delivery.

== OpenPGP ==
OpenPGP is an encryption standard designed to provide end-to-end encryption, ensuring that only the intended recipient can read the message. It combines symmetric and asymmetric cryptography, as well as digital signatures, to achieve confidentiality, authenticity, and integrity. It uses Compresses to reduce the size of the email content before encryption. OpenPGP uses the Web of Trust or other communication channels to share Public Keys.

=== Confidentiality ===
* OpenPGP uses symmetric encryption to encrypt the email content efficiently.
* The symmetric key (called the session key) is encrypted using the recipient's public key and attached to the email.
* Only the recipient can decrypt the session key using their private key, ensuring the message remains confidential.

=== Integrity ===
* OpenPGP ensures message integrity with the MDC, which appends a cryptographic hash to the plaintext before encryption. If tampered, the hash comparison will fail upon decryption.

=== Authentication ===
* Digital signatures validate the sender's identity by linking the message to their private key. They also confirm the message’s integrity, ensuring it has not been altered.

=== How OpenPGP operates ===
# Encryption Process:
#* The sender's OpenPGP implementation generates a random session key.
#* The email content is compressed and encrypted using the session key.
#* The session key is encrypted using the recipient's public key and attached to the message.

# Decryption Process:
#* The recipient decrypts the session key using their private key.
#* The session key is used to decrypt the email content.
#* If compression was used, the message is decompressed after decryption.

# Digital Signature:
#* A hash of the email is created using a cryptographic hash function.
#* The hash is encrypted with the sender's private key to create the signature.
#* The recipient verifies the signature by decrypting the hash using the sender's public key.

=== Limitations ===
* '''Lack of Central Trust:''' Trust is established manually through the Web of Trust, unlike S/MIME's centralized PKI.
* '''Complexity:''' OpenPGP requires key management, which can be challenging for less technical users.

== Secure/Multipurpose Internet Mail Extensions (S/MIME) ==
S/MIME is a standard for securing email communication with end-to-end encryption through encryption and digital signatures. Unlike OpenPGP, S/MIME relies on a centralized Public Key Infrastructure (PKI) to manage certificates, making it a more enterprise-friendly solution.

=== Confidentiality ===
* S/MIME uses the CMS (Cryptographic Message Syntax) format for encryption.
* A symmetric Content Encryption Key (CEK) is used to encrypt the email content.
* The CEK is encrypted using the recipient's public key and attached to the message.

=== Integrity ===
* A hash of the email content is signed using the sender's private key.
* The recipient verifies the signature using the sender's public key, ensuring authenticity and integrity.

=== Authentication ===
* Certificates issued by trusted Certificate Authorities (CAs) manage sender verification.
* Digital Signatures are used to verify the sender's identity, a hash is signed with the sender's private key.

=== How S/MIME operates ===
# Encryption:
#* The sender generates a random CEK to encrypt the email content using a symmetric encryption algorithm.
#* The CEK is encrypted using the recipient's public key and attached to the message.

# Decryption:
#* The recipient decrypts the CEK using their private key.
#* The CEK is then used to decrypt the email content.

# Digital Signatures:
#* A hash of the email content is signed using the sender's private key.
#* The recipient verifies the signature using the sender's public key, ensuring authenticity and integrity.

==== Message Formats ====
* '''Application/PKCS7-MIME:''' Encapsulates the entire message and signature, requiring the recipient to have S/MIME support to read the content.
* '''Multipart/Signed:''' Keeps the email content in plain text while attaching the signature separately, enabling compatibility with non-S/MIME clients.

=== Limitations ===
* '''Dependence on PKI:''' Users and organizations rely on third-party Certificate Authorities.

{| class="wikitable"
! Feature !! TLS !! OpenPGP !! S/MIME
|-
| Encryption Scope || Transport only || End-to-end || End-to-end
|-
| Certificate Management || Centralized (PKI) || Decentralized (Web of Trust) || Centralized (PKI)
|-
| Digital Signatures || No || Yes || Yes
|-
| Key Management || Transparent to users || Manual (user-controlled) || Automated (certificate-based)
|-
| Complexity || Low || Moderate || Moderate
|}

== Courses ==

* [[Ausgewählte Kapitel der IT-Security]] (2024)

== References ==

* TLS: https://datatracker.ietf.org/doc/html/rfc8446
* OpenPGP: https://datatracker.ietf.org/doc/html/rfc9580
* S/MIME: https://datatracker.ietf.org/doc/html/rfc8551
* Cryptographic Message Syntax (CMS): https://datatracker.ietf.org/doc/html/rfc3852

[[Category:Documentation]]

E-Mail Security

2024-12-16T17:15:23Z

AMessner: Created page with "== Summary == Description what this documentation is about. == Transport Layer Security (TLS) == TLS is a cryptographic protocol that secures communications over a network by providing confidentiality, integrity, and authentication. It is commonly used to secure connections between a client and a server, as well as between servers. === Confidentiality === * Data is encrypted during transit to ensure it cannot be intercepted and read. * TLS uses asymmetric encryption..."

Frida: Root Detection & Certificate Pinning Bypass

2024-06-20T18:16:10Z

AMessner: Created page with "Frida Logo == Summary == This documentation provides detailed instructions for setting up and using Frida to bypass root detection and certificate pinning on an Android emulator. It includes steps for installing necessary tools, configuring the environment, and running specific commands to test and bypass security mechanisms in mobile applications. == Requirements == * Operating System: Kali Linux * Pip installed on your Syst..."

[[File:Frida_logo.PNG|300px|thumb|right|Frida Logo]]
== Summary ==

This documentation provides detailed instructions for setting up and using Frida to bypass root detection and certificate pinning on an Android emulator. It includes steps for installing necessary tools, configuring the environment, and running specific commands to test and bypass security mechanisms in mobile applications.

== Requirements ==

* Operating System: Kali Linux
* Pip installed on your System
* Installed Android Studio ([https://wiki.elvis.science/index.php?title=Android_Studio:_Emulator Guide])
* Android Studio emulator with a Non-production android image ([https://wiki.elvis.science/index.php?title=Android_Studio:_Emulator Guide])
* Installed Apps on the emulator device (Twitter, Paypal, [https://github.com/satishpatnayak/AndroGoat AndroGoat])
* Installed [https://portswigger.net/burp Burpsuite]

== Setup ==
Install the following things using pip:
<pre>
pip install Frida

pip install objection

pip install frida-tools
</pre>

Add this path to ~./bashrc
<pre>
export PATH=$PATH:/home/kali/.local/bin
</pre>

Save & Exit the file.

Execute the bashrc file to make the changes effective:
<pre>
bash
source ~/.bashrc
</pre>
To check if variables are added to PATH:
<pre>
echo $PATH
</pre>

=== Install the frida-server ===
The frida-server will run on the emulator.

Find out which architecture the virtual device has.

If you followed the Android Studio setup the return should be: '''x86'''
<pre>
adb shell getprop ro.product.cpu.abi
</pre>
Download the frida-server from [https://github.com/frida/frida/releases Github].

At the time of testing the latest version is 16.2.1

'''frida-server-16.2.1-android-x86.xz'''

[[File:Frida_server_datei.PNG]]

Go to the Downloads directory
<pre>
cd Downloads/
</pre>
Unzip the downloaded file
<pre>
xz -d frida-server-16.2.1-android-x86.xz
</pre>
Rename the file
<pre>
mv frida-server-16.2.1-android-x86 frida-server
</pre>
Start adb as root (only possible if the emulator is without Google Play)
<pre>
adb root
</pre>
Push the frida-server to the emulator
<pre>
adb push frida-server /data/local/tmp/
</pre>
Make it executable
<pre>
adb shell "chmod +x /data/local/tmp/frida-server"
</pre>
Run the frida-server in the background
<pre>
adb shell "/data/local/tmp/frida-server" &
</pre>
List all processes running on the device to make sure frida-server is running
<pre>
frida-ps -Uia
</pre>

== Root detection bypass using frida-server ==

For testing purposes we use the Uncrackable L1 Apk from OWASP.

=== Download UnCrackable L1 Apk ===

Download the [https://mas.owasp.org/crackmes/ Android UnCrackable L1 Apk]

[[File:Frida_uncrackable.PNG]]

Run the emulator
<pre>
emulator -avd Pixel_6_Pro_API_28 -writable-system -no-snapshot
</pre>
Install the apk on the device
<pre>
adb install UnCrackable-Level1.apk
</pre>
This command outputs the package names for the processes running on the device, only works if the frida-server is still running
<pre>
frida-ps -Uia
</pre>
When opening the UnCrackable-Level1.apk it states the following:

[[File:Frida_uncrackable_devicescreen.PNG]]

To bypass this we use a frida codeshare command
<pre>
frida --codeshare dzonerzy/fridantiroot -f owasp.mstg.uncrackable1 -U
</pre>
The terminal should look like this:

[[File:Frida_rootbypass_cli.PNG]]

Now the UnCrackable-Level1.apk should start without the root detection warning:

[[File:Frida_uncrackable_devicescreen_afterbypass.PNG]]

==== Errors? ====
If any error with the frida-server occurs, it is possible that an old server is already running.
For this you have to look up running servers in the shell.
Don't forget to run '''adb as root'''.
<pre>
adb shell
</pre>
<pre>
ps -e | grep frida-server
</pre>
If any server is running, kill it.
<pre>
kill -9 <process-id>
</pre>
Now you can start a new server.

== Certificate Pinning Bypass using frida-server ==

In order to intercept the communication to the internet of the device, you have to connect it to the Burp Suite proxy.

Frida should be running on the device.

If it is not already use this command to start the server.
Don't forget to run adb as root before.
<pre>
adb shell "/data/local/tmp/frida-server" &
</pre>

Run the codeshare command to bypass certificate pinning:
<pre>
frida --codeshare masbog/frida-android-unpinning-ssl -U -f <APP-PACKAGE_NAME> -U
</pre>

=== Twitter ===

Twitter has certificate pinning checks, which means we have to start it with the frida command to intercept the traffic.
Otherwise, Twitter won't allow you to open the login page.
<pre>
frida --codeshare masbog/frida-android-unpinning-ssl -U -f com.twitter.android -U
</pre>
Now we can click on login and capture the encrypted messages in Burp Suite.

'''Twitter:'''

[[File:Frida_twitter_login.PNG]]

'''Burp Suite:'''

[[File:Frida_burpsuite_twitter_login.PNG]]

=== PayPal ===

Another popular app which has certificate pinning is PayPal.
But unlike Twitter, PayPal doesn't encrypt their login requests.
This means we are able to read credentials in cleartext, once we bypassed the certificate pinning.

Download the newest version of PayPal onto your device and find out the package name with frida.
<pre>
frida-ps -Uia
</pre>
When starting PayPal normally it will display an error about the internet connection.
This is because the certificate pinning check will detect your Burp Suite proxy.

[[File:Frida_paypal_login.PNG]]

We start the app again with frida
<pre>
frida --codeshare masbog/frida-android-unpinning-ssl -U -f com.paypal.android.p2pmobile -U
</pre>
Now we won't get any error message when logging in.
When looking into Burp Suite we can see a request to /v1/mfsauth/proxy-auth/token.

In the middle of the green text, the password is highlighted, also as the last the pair, email information is visible.

[[File:Frida_burpsuite_paypal_login.PNG]]

== Root and SSL bypass as one ==

So far we've only tried doing either just root detection or just SSL pinning alone.
But in order to bypass both of them at the same time we can use the frida codeshare.

* For our test we use the root detection bypass by dzonerzy: https://codeshare.frida.re/@dzonerzy/fridantiroot/

* And the SSL pinning bypass by masbog: https://codeshare.frida.re/@masbog/frida-android-unpinning-ssl/

To use both at the same time we will copy the code of those bypasses and paste them into a text file on our local machine.

Now we have a file, for example '''rootandssl.txt''' where both codes are contained.

Here is '''our file containing both bypasses''' uploaded to: https://file.io/6fxSi8IMHqwZ

It is possible to add as many scripts as you like.

To execute our own file we will use the following frida command:
<pre>
frida -l rootandssl.txt -f <APP_PACKAGE_NAME> -U
</pre>
In an app like AndroGoat.apk we can check if both test cases will work.

[[File:Frida_custom_script_execution.PNG]]

== References ==

* [https://frida.re/ Frida]
* [https://mas.owasp.org/MASTG/tests/android/MASVS-RESILIENCE/MASTG-TEST-0045/ OWASP Testing Root Detection]
* [https://mas.owasp.org/MASTG/Android/0x05j-Testing-Resiliency-Against-Reverse-Engineering/ OWASP Testing Resiliency Against Reverse Engineering]
* [https://www.indusface.com/learning/how-to-implement-root-detection-in-android-applications/ Root Detection Explaination]
* [https://sec-consult.com/de/blog/detail/android-mobile-root-detection-allheilmittel-gegen-angriffe/ Root Detection Explaination]
* [https://mas.owasp.org/MASTG/techniques/android/MASTG-TECH-0012/ OWASP Bypassing Certificate Pinning]
* [https://owasp.org/www-community/controls/Certificate_and_Public_Key_Pinning Certificate Pinning Explaination]
* [https://portswigger.net/burp Burpsuite]
* [https://github.com/satishpatnayak/MyTest/blob/master/AndroGoat.apk AndroGoat APK]
* [https://www.apkmirror.com/ APKMirror]

[[Category:Documentation]][[Category:Pentesting]]

File:Frida custom script execution.PNG

2024-06-20T18:14:51Z

AMessner: Image of Frida Server execution with a custom script

== Summary ==
Image of Frida Server execution with a custom script

File:Frida burpsuite paypal login.PNG

2024-06-20T18:09:44Z

AMessner: Image of Burpsuite while Paypal Login with Certificate Pinning Bypass

== Summary ==
Image of Burpsuite while Paypal Login with Certificate Pinning Bypass

File:Frida paypal login.PNG

2024-06-20T18:08:32Z

AMessner: Image of Paypal Login

== Summary ==
Image of Paypal Login

File:Frida burpsuite twitter login.PNG

2024-06-20T18:07:08Z

AMessner: Image of Burpsuite while Twitter Login was captured

== Summary ==
Image of Burpsuite while Twitter Login was captured

File:Frida twitter login.PNG

2024-06-20T18:06:15Z

AMessner: Image of Login Screen of Twitter

== Summary ==
Image of Login Screen of Twitter

File:Frida uncrackable devicescreen afterbypass.PNG

2024-06-20T18:04:58Z

AMessner: Image of Uncrackable App after Frida Root Detection Bypass

== Summary ==
Image of Uncrackable App after Frida Root Detection Bypass

File:Frida rootbypass cli.PNG

2024-06-20T18:03:15Z

AMessner: Image of Fridas CLI while Root Detection Bypass

== Summary ==
Image of Fridas CLI while Root Detection Bypass

File:Frida uncrackable devicescreen.PNG

2024-06-20T18:01:55Z

AMessner: OWASP Uncrackable App Device Screen

== Summary ==
OWASP Uncrackable App Device Screen

File:Frida uncrackable.PNG

2024-06-20T18:00:53Z

AMessner: Image of OWASP Uncrackable APK Logo

== Summary ==
Image of OWASP Uncrackable APK Logo

File:Frida server datei.PNG

2024-06-20T17:58:46Z

AMessner: image of zipped frida server file

== Summary ==
image of zipped frida server file

File:Frida logo.PNG

2024-06-20T17:56:38Z

AMessner: Logo of Frida

== Summary ==
Logo of Frida

MobSF: Root Detection & Certificate Pinning Bypass

2024-06-20T17:32:39Z

AMessner:

[[File:MobSF Logo.png|300px|thumb|right|MobSF Logo]]
== Summary ==

This documentation provides step-by-step instructions for setting up and using MobSF (Mobile Security Framework) for dynamic analysis on Kali Linux. It covers the setup process, bypassing root detection using default and custom scripts, and bypassing SSL pinning. Detailed commands and screenshots are included to ensure successful implementation.

== Requirements ==

* Operating System: Kali Linux
* Installed Android Studio ([https://wiki.elvis.science/index.php?title=Android_Studio:_Emulator Guide])
* Android Studio emulator with a Non-production android image ([https://wiki.elvis.science/index.php?title=Android_Studio:_Emulator Guide])
* Installed Apps on the emulator device

== Setup ==

Use the following commands in the terminal:

Install Git
sudo apt-get install git

Install Python 3.8
sudo apt-get install python3.8

Install the latest version of '''JDK'''

[https://www.oracle.com/java/technologies/downloads/ Oracle Downloads]

Install the required dependencies
sudo apt install python3-dev python3-venv python3-pip build-essential libffi-dev libssl-dev libxml2-dev libxslt1-dev libjpeg62-turbo-dev zlib1g-dev wkhtmltopdf

Clone the MobSF repository
git clone https://github.com/MobSF/Mobile-Security-Framework-MobSF.git

Change working directory to MobSF
cd Mobile-Security-Framework-MobSF/

Setup MobSF
./setup.sh

Run MobSF
./run.sh 127.0.0.1:8000

Access the MobSF web interface with the following URL http://127.0.0.1:8000

== Root Detection Bypass using MobSF ==

=== Root Detection Bypass using Default Scripts ===
'''Follow the steps exactly in the shown order!'''

1. Start your emulator
emulator -avd Pixel_6_Pro_API_28 -writable-system -no-snapshot
2. Wait for the successful boot of the device
<blockquote>The Error "Unable to connect to adb daemon on port:5037" has no impact on successful boot.</blockquote>
3. Start MobSF
./run.sh 127.0.0.1:8000
4. Wait for successful boot of MobSF, the CLI should look like this

[[File:Mobsf_sucessfulboot.png]]

5. Open MobSF in the Browser (http://127.0.0.1:8000/)

6. Click on Dynamic Analyzer -> Android Dynamic Analyzer -> Select the App you want to test -> Click on "Start Dynamic Analysis"

7. The CLI output of MobSF should look like this

[[File:Mobsf_dynamicanalysis_start.png]]

8. Now Select "Root Detection Bypass" under the Default headline

9. Press Spawn&Inject, wait for the Application to Startup & leave it open like it is
<blockquote>Here the Root Detection still works, so you should see a notification, as MobSF First Spawns & then injects the script, therefore you need to restart the application as shown in Step 10.</blockquote>

10. As the Application is still opened, press "StartActivity" to startup the Application with Root Detection Bypass

'''If you followed the Steps in this order, your MobSF CLI should look like this, as you successfully bypassed Root Detection.'''

[[File:Mobsf_successful_rootbypass.png]]

=== Root Detection Bypass using Custom Scripts ===
'''Follow the steps exactly in the shown order!'''

1. Start your emulator
emulator -avd Pixel_6_Pro_API_28 -writable-system -no-snapshot

2. Wait for the successful boot of the device
<blockquote>The ERROR "Unable to connect to adb daemon on port:5037" has no impact on successful boot.</blockquote>

3. Start MobSF
./run.sh 127.0.0.1:8000

4. Open MobSF in Browser (http://127.0.0.1:8000/)

5. Click on Dynamic Analyzer -> Android Dynamic Analyzer -> Select the App you want to Test -> Click on "Start Dynamic Analysis"

6. Now copy & paste the [https://codeshare.frida.re/@dzonerzy/fridantiroot/ fridaantiroot script] into the window on the right in MobSF (Script Window)

7. Press Spawn&Inject, wait for the Application to startup & leave it open like it is
<blockquote>Here the Root Detection still works so you should see a notification, as MobSF First Spawns & then injects the script, therefore you need to restart the application as shown in Step 8.</blockquote>

8. As the Application is still opened, press "StartActivity" to startup the Application with Root Detection Bypass

== SSL Pinning Bypass using MobSF ==
1. Start emulator
emulator -avd Pixel_6_Pro_API_28 -writable-system -no-snapshot

2. Start MobSF
./run.sh 127.0.0.1:8000

3. Start Dynamic Analysis of your App
Select your App & press Start Dynamic Analysis

4. Choose Configurations
* Select '''SSL Pinning Bypass'''
* Check if '''Root CA is installed'''
* Check if '''HTTP(S) Proxy is set '''
[[File:Mobsf_dynamicanalysis_config1.png]]

5. Spawn & Inject

6. Test the App, do your Activities

7. Press Generate Report, the creation can take a while.

[[File:Mobsf_dynamicanalysis_generatereport.png]]

8. Then you are able to see the Logs

[[File:Mobsf_dynamicanalysis_logs.png]]

* '''Start HTTPTools:''' Launches tool to analyze HTTP(S) traffic between the mobile application and the server.
* '''Frida Logs:''' Displays logs generated by Frida, a dynamic instrumentation toolkit used for runtime manipulation of applications.
* '''HTTP(S) Traffic:''' Shows the captured HTTP and HTTPS traffic logs.
* '''Logcat Logs:''' Provides logs from Logcat, a system-wide logging utility for Android.
* '''Dumpsys Logs:''' Displays logs generated by the dumpsys tool, which provides detailed information about the system and application state.
* '''Application Data:''' Downloads the application's data stored on the device.

=== HTTPTools ===

In HTTPTools you can analyze HTTP(S) traffic.
You also have the Option to replay your captured traffic to a Fuzzer(Burpsuite).

[[File:Mobsf_dynamicanalysis_httptools.png]]

== References ==

* [https://mobsf.github.io/docs/#/ MobSF Documentation]
* [https://github.com/MobSF/Mobile-Security-Framework-MobSF MobSF Github]
* [https://mas.owasp.org/MASTG/tests/android/MASVS-RESILIENCE/MASTG-TEST-0045/ OWASP Testing Root Detection]
* [https://mas.owasp.org/MASTG/Android/0x05j-Testing-Resiliency-Against-Reverse-Engineering/ OWASP Testing Resiliency Against Reverse Engineering]
* [https://www.indusface.com/learning/how-to-implement-root-detection-in-android-applications/ Root Detection Explaination]
* [https://sec-consult.com/de/blog/detail/android-mobile-root-detection-allheilmittel-gegen-angriffe/ Root Detection Explaination]
* [https://mas.owasp.org/MASTG/techniques/android/MASTG-TECH-0012/ OWASP Bypassing Certificate Pinning]
* [https://owasp.org/www-community/controls/Certificate_and_Public_Key_Pinning Certificate Pinning Explaination]

[[Category:Documentation]][[Category:Pentesting]]

MobSF: Root Detection & Certificate Pinning Bypass

2024-06-20T17:31:40Z

AMessner:

[[File:MobSF Logo.png|300px|thumb|right|MobSF Logo]]
== Summary ==

This documentation provides step-by-step instructions for setting up and using MobSF (Mobile Security Framework) for dynamic analysis on Kali Linux. It covers the setup process, bypassing root detection using default and custom scripts, and bypassing SSL pinning. Detailed commands and screenshots are included to ensure successful implementation.

== Requirements ==

* Operating System: Kali Linux
* Installed Android Studio [https://wiki.elvis.science/index.php?title=Android_Studio:_Emulator Installation Guide]
* Android Studio emulator with a Non-production android image [https://wiki.elvis.science/index.php?title=Android_Studio:_Emulator Installation Guide]
* Installed Apps on the emulator device

== Setup ==

Use the following commands in the terminal:

Install Git
sudo apt-get install git

Install Python 3.8
sudo apt-get install python3.8

Install the latest version of '''JDK'''

[https://www.oracle.com/java/technologies/downloads/ Oracle Downloads]

Install the required dependencies
sudo apt install python3-dev python3-venv python3-pip build-essential libffi-dev libssl-dev libxml2-dev libxslt1-dev libjpeg62-turbo-dev zlib1g-dev wkhtmltopdf

Clone the MobSF repository
git clone https://github.com/MobSF/Mobile-Security-Framework-MobSF.git

Change working directory to MobSF
cd Mobile-Security-Framework-MobSF/

Setup MobSF
./setup.sh

Run MobSF
./run.sh 127.0.0.1:8000

Access the MobSF web interface with the following URL http://127.0.0.1:8000

== Root Detection Bypass using MobSF ==

=== Root Detection Bypass using Default Scripts ===
'''Follow the steps exactly in the shown order!'''

1. Start your emulator
emulator -avd Pixel_6_Pro_API_28 -writable-system -no-snapshot
2. Wait for the successful boot of the device
<blockquote>The Error "Unable to connect to adb daemon on port:5037" has no impact on successful boot.</blockquote>
3. Start MobSF
./run.sh 127.0.0.1:8000
4. Wait for successful boot of MobSF, the CLI should look like this

[[File:Mobsf_sucessfulboot.png]]

5. Open MobSF in the Browser (http://127.0.0.1:8000/)

6. Click on Dynamic Analyzer -> Android Dynamic Analyzer -> Select the App you want to test -> Click on "Start Dynamic Analysis"

7. The CLI output of MobSF should look like this

[[File:Mobsf_dynamicanalysis_start.png]]

8. Now Select "Root Detection Bypass" under the Default headline

9. Press Spawn&Inject, wait for the Application to Startup & leave it open like it is
<blockquote>Here the Root Detection still works, so you should see a notification, as MobSF First Spawns & then injects the script, therefore you need to restart the application as shown in Step 10.</blockquote>

10. As the Application is still opened, press "StartActivity" to startup the Application with Root Detection Bypass

'''If you followed the Steps in this order, your MobSF CLI should look like this, as you successfully bypassed Root Detection.'''

[[File:Mobsf_successful_rootbypass.png]]

=== Root Detection Bypass using Custom Scripts ===
'''Follow the steps exactly in the shown order!'''

1. Start your emulator
emulator -avd Pixel_6_Pro_API_28 -writable-system -no-snapshot

2. Wait for the successful boot of the device
<blockquote>The ERROR "Unable to connect to adb daemon on port:5037" has no impact on successful boot.</blockquote>

3. Start MobSF
./run.sh 127.0.0.1:8000

4. Open MobSF in Browser (http://127.0.0.1:8000/)

5. Click on Dynamic Analyzer -> Android Dynamic Analyzer -> Select the App you want to Test -> Click on "Start Dynamic Analysis"

6. Now copy & paste the [https://codeshare.frida.re/@dzonerzy/fridantiroot/ fridaantiroot script] into the window on the right in MobSF (Script Window)

7. Press Spawn&Inject, wait for the Application to startup & leave it open like it is
<blockquote>Here the Root Detection still works so you should see a notification, as MobSF First Spawns & then injects the script, therefore you need to restart the application as shown in Step 8.</blockquote>

8. As the Application is still opened, press "StartActivity" to startup the Application with Root Detection Bypass

== SSL Pinning Bypass using MobSF ==
1. Start emulator
emulator -avd Pixel_6_Pro_API_28 -writable-system -no-snapshot

2. Start MobSF
./run.sh 127.0.0.1:8000

3. Start Dynamic Analysis of your App
Select your App & press Start Dynamic Analysis

4. Choose Configurations
* Select '''SSL Pinning Bypass'''
* Check if '''Root CA is installed'''
* Check if '''HTTP(S) Proxy is set '''
[[File:Mobsf_dynamicanalysis_config1.png]]

5. Spawn & Inject

6. Test the App, do your Activities

7. Press Generate Report, the creation can take a while.

[[File:Mobsf_dynamicanalysis_generatereport.png]]

8. Then you are able to see the Logs

[[File:Mobsf_dynamicanalysis_logs.png]]

* '''Start HTTPTools:''' Launches tool to analyze HTTP(S) traffic between the mobile application and the server.
* '''Frida Logs:''' Displays logs generated by Frida, a dynamic instrumentation toolkit used for runtime manipulation of applications.
* '''HTTP(S) Traffic:''' Shows the captured HTTP and HTTPS traffic logs.
* '''Logcat Logs:''' Provides logs from Logcat, a system-wide logging utility for Android.
* '''Dumpsys Logs:''' Displays logs generated by the dumpsys tool, which provides detailed information about the system and application state.
* '''Application Data:''' Downloads the application's data stored on the device.

=== HTTPTools ===

In HTTPTools you can analyze HTTP(S) traffic.
You also have the Option to replay your captured traffic to a Fuzzer(Burpsuite).

[[File:Mobsf_dynamicanalysis_httptools.png]]

== References ==

* [https://mobsf.github.io/docs/#/ MobSF Documentation]
* [https://github.com/MobSF/Mobile-Security-Framework-MobSF MobSF Github]
* [https://mas.owasp.org/MASTG/tests/android/MASVS-RESILIENCE/MASTG-TEST-0045/ OWASP Testing Root Detection]
* [https://mas.owasp.org/MASTG/Android/0x05j-Testing-Resiliency-Against-Reverse-Engineering/ OWASP Testing Resiliency Against Reverse Engineering]
* [https://www.indusface.com/learning/how-to-implement-root-detection-in-android-applications/ Root Detection Explaination]
* [https://sec-consult.com/de/blog/detail/android-mobile-root-detection-allheilmittel-gegen-angriffe/ Root Detection Explaination]
* [https://mas.owasp.org/MASTG/techniques/android/MASTG-TECH-0012/ OWASP Bypassing Certificate Pinning]
* [https://owasp.org/www-community/controls/Certificate_and_Public_Key_Pinning Certificate Pinning Explaination]

[[Category:Documentation]][[Category:Pentesting]]

MobSF: Root Detection & Certificate Pinning Bypass

2024-06-20T17:22:51Z

AMessner: Created page with "MobSF Logo == Summary == This documentation provides step-by-step instructions for setting up and using MobSF (Mobile Security Framework) for dynamic analysis on Kali Linux. It covers the setup process, bypassing root detection using default and custom scripts, and bypassing SSL pinning. Detailed commands and screenshots are included to ensure successful implementation. == Requirements == * Operating System: Kali Linux * Inst..."

[[File:MobSF Logo.png|300px|thumb|right|MobSF Logo]]
== Summary ==

This documentation provides step-by-step instructions for setting up and using MobSF (Mobile Security Framework) for dynamic analysis on Kali Linux. It covers the setup process, bypassing root detection using default and custom scripts, and bypassing SSL pinning. Detailed commands and screenshots are included to ensure successful implementation.

== Requirements ==

* Operating System: Kali Linux
* Installed Android Studio
* Android Studio emulator with a Non-production android image
* Installed Apps on the emulator device

== Setup ==

Use the following commands in the terminal:

Install Git
sudo apt-get install git

Install Python 3.8
sudo apt-get install python3.8

Install the latest version of '''JDK'''

[https://www.oracle.com/java/technologies/downloads/ Oracle Downloads]

Install the required dependencies
sudo apt install python3-dev python3-venv python3-pip build-essential libffi-dev libssl-dev libxml2-dev libxslt1-dev libjpeg62-turbo-dev zlib1g-dev wkhtmltopdf

Clone the MobSF repository
git clone https://github.com/MobSF/Mobile-Security-Framework-MobSF.git

Change working directory to MobSF
cd Mobile-Security-Framework-MobSF/

Setup MobSF
./setup.sh

Run MobSF
./run.sh 127.0.0.1:8000

Access the MobSF web interface with the following URL http://127.0.0.1:8000

== Root Detection Bypass using MobSF ==

=== Root Detection Bypass using Default Scripts ===
'''Follow the steps exactly in the shown order!'''

1. Start your emulator
emulator -avd Pixel_6_Pro_API_28 -writable-system -no-snapshot
2. Wait for the successful boot of the device
<blockquote>The Error "Unable to connect to adb daemon on port:5037" has no impact on successful boot.</blockquote>
3. Start MobSF
./run.sh 127.0.0.1:8000
4. Wait for successful boot of MobSF, the CLI should look like this

[[File:Mobsf_sucessfulboot.png]]

5. Open MobSF in the Browser (http://127.0.0.1:8000/)

6. Click on Dynamic Analyzer -> Android Dynamic Analyzer -> Select the App you want to test -> Click on "Start Dynamic Analysis"

7. The CLI output of MobSF should look like this

[[File:Mobsf_dynamicanalysis_start.png]]

8. Now Select "Root Detection Bypass" under the Default headline

9. Press Spawn&Inject, wait for the Application to Startup & leave it open like it is
<blockquote>Here the Root Detection still works, so you should see a notification, as MobSF First Spawns & then injects the script, therefore you need to restart the application as shown in Step 10.</blockquote>

10. As the Application is still opened, press "StartActivity" to startup the Application with Root Detection Bypass

'''If you followed the Steps in this order, your MobSF CLI should look like this, as you successfully bypassed Root Detection.'''

[[File:Mobsf_successful_rootbypass.png]]

=== Root Detection Bypass using Custom Scripts ===
'''Follow the steps exactly in the shown order!'''

1. Start your emulator
emulator -avd Pixel_6_Pro_API_28 -writable-system -no-snapshot

2. Wait for the successful boot of the device
<blockquote>The ERROR "Unable to connect to adb daemon on port:5037" has no impact on successful boot.</blockquote>

3. Start MobSF
./run.sh 127.0.0.1:8000

4. Open MobSF in Browser (http://127.0.0.1:8000/)

5. Click on Dynamic Analyzer -> Android Dynamic Analyzer -> Select the App you want to Test -> Click on "Start Dynamic Analysis"

6. Now copy & paste the [https://codeshare.frida.re/@dzonerzy/fridantiroot/ fridaantiroot script] into the window on the right in MobSF (Script Window)

7. Press Spawn&Inject, wait for the Application to startup & leave it open like it is
<blockquote>Here the Root Detection still works so you should see a notification, as MobSF First Spawns & then injects the script, therefore you need to restart the application as shown in Step 8.</blockquote>

8. As the Application is still opened, press "StartActivity" to startup the Application with Root Detection Bypass

== SSL Pinning Bypass using MobSF ==
1. Start emulator
emulator -avd Pixel_6_Pro_API_28 -writable-system -no-snapshot

2. Start MobSF
./run.sh 127.0.0.1:8000

3. Start Dynamic Analysis of your App
Select your App & press Start Dynamic Analysis

4. Choose Configurations
* Select '''SSL Pinning Bypass'''
* Check if '''Root CA is installed'''
* Check if '''HTTP(S) Proxy is set '''
[[File:Mobsf_dynamicanalysis_config1.png]]

5. Spawn & Inject

6. Test the App, do your Activities

7. Press Generate Report, the creation can take a while.

[[File:Mobsf_dynamicanalysis_generatereport.png]]

8. Then you are able to see the Logs

[[File:Mobsf_dynamicanalysis_logs.png]]

* '''Start HTTPTools:''' Launches tool to analyze HTTP(S) traffic between the mobile application and the server.
* '''Frida Logs:''' Displays logs generated by Frida, a dynamic instrumentation toolkit used for runtime manipulation of applications.
* '''HTTP(S) Traffic:''' Shows the captured HTTP and HTTPS traffic logs.
* '''Logcat Logs:''' Provides logs from Logcat, a system-wide logging utility for Android.
* '''Dumpsys Logs:''' Displays logs generated by the dumpsys tool, which provides detailed information about the system and application state.
* '''Application Data:''' Downloads the application's data stored on the device.

=== HTTPTools ===

In HTTPTools you can analyze HTTP(S) traffic.
You also have the Option to replay your captured traffic to a Fuzzer(Burpsuite).

[[File:Mobsf_dynamicanalysis_httptools.png]]

== References ==

* [https://mobsf.github.io/docs/#/ MobSF Documentation]
* [https://github.com/MobSF/Mobile-Security-Framework-MobSF MobSF Github]
* [https://mas.owasp.org/MASTG/tests/android/MASVS-RESILIENCE/MASTG-TEST-0045/ OWASP Testing Root Detection]
* [https://mas.owasp.org/MASTG/Android/0x05j-Testing-Resiliency-Against-Reverse-Engineering/ OWASP Testing Resiliency Against Reverse Engineering]
* [https://www.indusface.com/learning/how-to-implement-root-detection-in-android-applications/ Root Detection Explaination]
* [https://sec-consult.com/de/blog/detail/android-mobile-root-detection-allheilmittel-gegen-angriffe/ Root Detection Explaination]
* [https://mas.owasp.org/MASTG/techniques/android/MASTG-TECH-0012/ OWASP Bypassing Certificate Pinning]
* [https://owasp.org/www-community/controls/Certificate_and_Public_Key_Pinning Certificate Pinning Explaination]

[[Category:Documentation]][[Category:Pentesting]]

File:Mobsf dynamicanalysis httptools.png

2024-06-20T17:21:57Z

AMessner: HTTP Tools with traffic in dynamic analysis in MobSF

== Summary ==
HTTP Tools with traffic in dynamic analysis in MobSF

File:Mobsf dynamicanalysis logs.png

2024-06-20T17:21:15Z

AMessner: Logs of Dynamic Analysis in MobSF

== Summary ==
Logs of Dynamic Analysis in MobSF

File:Mobsf dynamicanalysis generatereport.png

2024-06-20T17:20:23Z

AMessner: mobsf generate report button

== Summary ==
mobsf generate report button

File:Mobsf dynamicanalysis config1.png

2024-06-20T17:19:42Z

AMessner: buttons set in mobsf dynamic analysis

== Summary ==
buttons set in mobsf dynamic analysis

File:Mobsf successful rootbypass.png

2024-06-20T17:17:03Z

AMessner: CLI of a successful Root Detection Bypass with MobSF

== Summary ==
CLI of a successful Root Detection Bypass with MobSF

File:Mobsf dynamicanalysis start.png

2024-06-20T17:14:37Z

AMessner: CLI of successful started Dynamic Analysis of MobSF

== Summary ==
CLI of successful started Dynamic Analysis of MobSF

File:Mobsf sucessfulboot.png

2024-06-20T17:13:06Z

AMessner: CLI of successful booted MobSF

== Summary ==
CLI of successful booted MobSF