Where's My Browser? Learn Hacking iOS and Android WebViews - ICON C
Event Information
Description
Where's My Browser? Learn Hacking iOS and Android WebViews
Instructors - David Turco & Jon Overgaard Christiansen
Pre-Requisites - The workshop is aimed at an audience with an intermediate skill level. It is expected a basic knowledge of mobile and web application security testing (can you tell the difference between XSS and CSRF?) and a basic understanding of JavaScript and common programming concepts.
Abstract - WebViews allow developers to embed HTML pages into mobile applications and their use is widespread, from merely displaying a simple help page to wrapping an entire website inside a mobile app.
Developers now "control the browser" and things can go very wrong: a cross site scripting vulnerability can be catastrophic for a mobile application and result in the exfiltration of user’s data stored on the device or in someone listening to user conversations.
The "Where's My Browser?" vulnerable-by-design mobile applications for Android and iOS have been written by the presenter as a teaching tool for hacking WebViews.
The workshop covers the attack surface of Android and iOS WebViews and presents techniques and tools for identifying and exploiting those vulnerabilities. Attendees will practice their skills against the "Where's My Browser?" mobile apps. The source code of the applications will help students in recognising common coding mistakes.
Required Materials - The best setup to cover all exercises is a Mac OS X laptop with Android Studio, Apple Xcode and Google Chrome installed. All exercises can be done using the Android and iOS simulators. A physical mobile device is not necessary.
Alternatively a Linux or Windows laptop with Android Studio and Google Chrome installed plus an iPhone (preferably jailbroken) are sufficient. An Apple ID is required to deploy the iOS application to a physical device.
