Case: the Yelkovan Bankası mobile banking assessment
You bring the whole path together in one case: you assess Yelkovan Bankası's Android and iOS apps, backend and staff fleet, respond to a lookalike app incident, retest the fixes and present to leadership.
Level 501 · 21 lessons · 18 practice labs
Lessons
Preparation
- Case briefing, scope and authorisation
- The threat model for a banking app
- The test plan and division of work
- Evidence handling and note keeping
- Short task: deliver the scope document and test plan for the case
App assessment
- Static review of the Android package
- Static review of the iOS package
- Storage exports and traffic captures
- Auditing the backend API
- Resilience and app attestation
- Short task: produce the combined finding list for both platforms
Fleet and incident
- Compliance audit of the staff fleet
- Triage of the lookalike app
- Examining the affected device
- Containment, customer notice and the takedown request
- Short task: write the response note and indicator list for the lookalike app incident
Closing
- Retesting the fixed version
- The remediation plan: priority, owner, date
- Lessons learned and programme recommendations
- Short task: fill in the retest table and flag the findings still open
Capstone
- Capstone: write the final report and prepare the ten-minute board presentation
Practice labs
- List the assets in the case scope: Extract the app, API and fleet assets from the case file.
- Draw up the threat model for the banking app: Write ten threats and their priority order for Yelkovan Bankası.
- Deliver the scope document and test plan: Prepare the two documents covering authorisation, calendar, control groups and evidence handling.
- Extract the banking APK's identity and signer: Record the package name, version and certificate digest.
- Pull five static findings each from the APK and IPA: Write findings from the manifest, plist, secrets and network settings.
- Produce the combined finding list for both platforms: Separate shared and platform-specific findings, rate them and deliver one table.
- Find the session token in the data export: Show which file holds the token and how.
- Find the customer data sent to a third party in the capture: Prove the analytics request carrying an account number.
- Compare storage and network findings on both platforms: Derive and report the differences from the Android and iOS exports and captures.
- Derive the case API's endpoint list: List the endpoints from the APK.
- Test the authorisation check on the transactions endpoint: Verify the ownership check with two lab accounts and fix it if missing.
- Assess integrity verdict verification on the backend: Test whether the verdict is verified on the server, fix the gaps and attach retest evidence.
- Tell the lookalike app from the real one by its signer: Compare the certificate digests of the two APKs.
- Triage the lookalike app: Extract the inert sample's permissions, behaviour signs and indicators.
- Deliver the response note and the fleet sweep: Sweep the staff fleet with the indicators, examine the affected device and write the containment and customer notice text.
- Fill in the retest table: Mark the status of five findings in the fixed version.
- Prioritise the remediation plan: Assign owner, date and priority to the open findings.
- Prepare the final report and the board presentation: Deliver the report with all case findings, the incident summary and programme recommendations, plus the ten-minute presentation.
About this course
You bring the whole path together in one case: you assess Yelkovan Bankası's Android and iOS apps, backend and staff fleet, respond to a lookalike app incident, retest the fixes and present to leadership.
What you will learn
- Preparation
- App assessment
- Fleet and incident
- Closing
- Capstone
Prerequisites
You should be experienced in the topics of the same path up to level 401.
Lab environment
Lessons run in your own Kali Linux terminal in the browser, connected to a private lab network. Nothing to install.
Frequently asked questions
- Is this course right for my level?
- The course is at level 501; it assumes you know the topics of the lower-level courses.
- Is there anything to install?
- No. Every lesson runs in your own lab environment that opens in the browser.
- How do lessons work?
- Each lesson has 8 to 10 steps and a short quiz. Early steps show the command to type, later steps give less help; if two attempts fail, the solution opens.
- Can I try it for free?
- Yes. The first three lessons of every course are free.