Mobile app traffic analysis: prepared captures, TLS and pinning
You read a mobile app's network behaviour from prepared traffic captures: you assess which servers it sends what to, its TLS settings, certificate validation and pinning, and find the leaks.
Level 201 · 22 lessons · 18 practice labs
Lessons
Reading a capture
- How app traffic is captured: proxy, VPN and key log
- A first look at a capture with tshark: conversations and endpoints
- DNS and SNI inventory: who the app talks to
- Reading HAR and mitmproxy flow files
- Short task: list the servers an app talks to from a capture
TLS and certificates
- The TLS handshake in a capture: version and cipher suite
- Finding cleartext traffic
- Reading certificate validation in code: the unsafe TrustManager
- Decrypting lab traffic with a key log
- Short task: find the connection that uses an outdated TLS version in a capture
Pinning and trust settings
- Auditing the network security configuration: trust anchors and domains
- Kinds of pinning: configuration, OkHttp and the iOS side
- Pin rotation, backup pins and expiry
- Auditing App Transport Security settings on iOS
- Short task: verify that the pin in the configuration matches the server certificate
Content and leaks
- Sensitive data in requests: tokens in URLs, needless personal data
- Analytics and ad traffic: what goes to third parties
- Push notification, WebSocket and gRPC traffic
- Reporting network findings
- Domain ownership: who really runs the server the app talks to
- Short task: find the email address sent to an analytics server in a flow file
Capstone
- Capstone: prepare the network behaviour report for a hotel booking app
Practice labs
- List the servers the app talks to from a capture: Use tshark to extract the DNS queries and SNI values in the prepared capture and produce the domain list.
- Split the servers into first and third party: Classify the domains in the Turnalı Perakende app's capture as company-owned, analytics, advertising and unknown.
- Diff the endpoints of two versions: Compare the captures of two versions, find the newly added servers and note who owns each.
- Count the TLS versions in a capture: Extract each connection's TLS version from the handshakes and flag the one using an old version.
- Find the requests sent in cleartext: Filter the unencrypted HTTP requests in the capture and report the data they carry.
- Decrypt traffic with the key log and examine the login request: Decrypt the lab traffic with the given key log and assess the login request body and response headers.
- Find the custom TrustManager in the code: Find the class that alters certificate validation in jadx output.
- Prove that code accepts every certificate: Show the empty validation method and the lines disabling hostname checks as evidence and write the finding.
- Confirm a trust flaw by combining capture and code: Match a capture of a lab connection made with a bogus certificate to the validation flaw in the code and write the fix advice.
- Read the pins in the network security configuration: List the domains, pins and expiry in the configuration file.
- Verify that the pin matches the server certificate: Compute the public key digest from the lab server's certificate and compare it with the pin in the configuration.
- Report a pin near expiry with no backup: Audit the pinning settings of three apps and find the one with no backup pin, the expired one and the subdomain left out of scope.
- Find the ATS exceptions in Info.plist: List the ATS keys in an IPA's Info.plist.
- Reduce a global ATS switch-off to a domain exception: Turn the setting that allows arbitrary loads into an exception for just the domain that needs it.
- Compare Android and iOS trust settings: Tabulate the network trust settings of one app on both platforms and report the inconsistency.
- Find the token carried in a URL: Find the request carrying a session token in its query string in the HAR file.
- Find the email sent to an analytics server: Find the personal data going to a third party in the mitmproxy flow file and state which event sends it.
- Write the network report for a hotel booking app: Gather endpoint, TLS, pinning and leak findings from the Mercanköşk Otelcilik app's captures into one report.
About this course
You read a mobile app's network behaviour from prepared traffic captures: you assess which servers it sends what to, its TLS settings, certificate validation and pinning, and find the leaks.
What you will learn
- Reading a capture
- TLS and certificates
- Pinning and trust settings
- Content and leaks
- Capstone
Prerequisites
Finishing the level 101 courses of the same path, or knowing those topics, is enough.
Lab environment
Lessons run in your own Kali Linux terminal that opens in the browser. Nothing to install; the lab starts clean in every lesson.
Frequently asked questions
- Is this course right for my level?
- The course is at level 201; it assumes you know the topics of the lower-level courses.
- Is there anything to install?
- No. Every lesson runs in your own lab environment that opens in the browser.
- How do lessons work?
- Each lesson has 8 to 10 steps and a short quiz. Early steps show the command to type, later steps give less help; if two attempts fail, the solution opens.
- Can I try it for free?
- Yes. The first three lessons of every course are free.