Beginners Guide - Think Like, and Act Like A Hacker To Secure Your Own System
For educational purpose only!
Disclaimer: This guide is provided "as is" with no warranties with regard to the
accuracy and completeness of the information provided herein. I am not
responsible for any bad outcomes you or anyone may have because you followed
this guide. When I say beginners, I expect you to have knowledge of some
programming language (Java, Kotlin, C#), an inquisitive mind to try things
out, and the patience to first google and try to find answers to simple
questions.
Requirements:
What is Reverse Engineering?
Reverse engineering is a process is breaking something down to understand
it, build a copy or improve it. This process can be applied to hardware,
software, databases or even human DNA.
Reverse engineering can be used for many purposes such as a learning tool
or to expose security flaws and bad practices.
Reverse engineering of a software, hardware or database are legal unless
the EULA prohibits it, then it is prohibited no matter what. Also beware
of Digital Millennium Copyright Act (DMCA) and Google Play Console Developer Program Policy.
Think Like A Hacker, Mindset
You have in-app purchases but someone published a full paid version of your
app for free? YOUR APP WAS PIRATED, HOW IS IT EVEN POSSIBLE?!
You need to to think like a hacker.
I believe that to protect your own system, you need to think like as an
adversary or "think like a hacker".
This mindset is necessary to know how to response to an actual attack,
know the tools, techniques and goals of a hacker. You need to study past
attacks, common patterns attackers follow to tamper a build or compromise
a system or network.
Example attack:
- A mobile apps store informations they obtained from their server in a variable and use this in an if-else condition to determine if the user account can access premium content. The hacker can then alter this variable to build a full paid version of your app.
- Look for connection properties such as api endpoints, api credentials, and network traffic. Then they can use curl terminal tool to modify the backend databases. This only works if the backend-api do not validate their clients.
- Stealing sensitive informations.
Get Inside, and Attack
The best way to learn hacking is to practice hacking.
It's hard to find a hacking crash course since its generally illegal. For
educational purpose, I want you to go to my repo and do the task such as
tamper the build to steal login credentials ->
https://bitbucket.org/ron_ang/hack-one/src/master/
Securing Your Mobile Apps
The OWASP Mobile Security Project is a centralized resource intended to give
developers and security teams the resources they need to build and maintain
secure mobile applications. Through the project, their goal is to classify
mobile security risks and provide developmental controls to reduce their
impact or likelihood of exploitation. Visit https://owasp.org/www-project-mobile-security/
to learn more.
Comments
Post a Comment