Offensive Security

Introduction In the current cybersecurity landscape, the attack surface of mobile applications and their backend services has expanded exponentially. Applications, especially those that handle sensitive information such as health data, become critical entry points for attackers seeking to exploit weaknesses in the authentication layer, data integrity, or access control. This analysis focuses on the interception and exhaustive study of communications from a mobile pulse oximeter application through a network proxy. ...

Introduction This article focuses on the exhaustive analysis of the communication layer of an Android mobile application for a smartwatch through network traffic interception and the manipulation of authentication and data flows. The relevance of this analysis lies in the detection of critical vulnerabilities that, while they may seem like minor implementation flaws, represent severe operational risks. The identified attack vectors range from failures in session and credential management (such as the absence of anti-brute force mechanisms) to deficiencies in business logic and data management, allowing unauthorized access to third-party information. ...

Introduction In the current landscape of mobile application security and API-based services, protecting user flows is a critical point of failure. Modern applications, by depending on application programming interfaces (APIs) for data management and business logic, expose a considerable attack surface. This analysis focuses on examining the implementation of registration, authentication, and credential recovery functionality of an Android mobile application for a health bracelet by intercepting network traffic using tools such as Frida and a web proxy. ...

Introduction The development of mobile networks has been intrinsically linked to the evolution of user security. In previous generation architectures (2G, 3G, and 4G), subscriber identity management relied on the transmission of the IMSI (International Mobile Subscriber Identity) in plain text during certain phases of the registration protocol. This design, while functional for network interconnection, created a cryptographic vulnerability of a physical nature. The exposure of the IMSI allows the execution of passive capture attacks, commonly known as IMSI catchers. These devices operate as fake base stations, whose objective is not to decrypt encrypted traffic, but simply to intercept the identity in clear text, which enables tracking and data correlation over time and space. ...

Introduction When auditing a Kubernetes cluster for the first time, whether as part of an internal pentesting exercise, a configuration review, or simply to understand what is running in production, most of the real problems do not show up in fancy automated scanners but in patient reading of the cluster state. Excessive permissions, privileged containers nobody remembers deploying, secrets in environment variables, TLS certificates about to expire, and hostPath volumes mounting sensitive node paths are recurring findings that anyone can detect with kubectl and a bit of method. ...

Introduction 5G is the fifth generation of mobile networks, designed to surpass 4G significantly in speed, capacity, and latency. Its objective is not limited to just browsing the internet faster, but to enable entirely new applications, such as autonomous vehicles, augmented reality, real-time telemedicine, and millions of connected devices simultaneously in the Internet of Things (IoT). In technical terms, 5G is characterized by three main pillars: eMBB (enhanced Mobile Broadband) for high-speed and large-capacity connections, URLLC (Ultra-Reliable Low Latency Communications) for critical communications with minimal latency, and mMTC (massive Machine-Type Communications) for efficiently connecting millions of IoT devices. ...

Introduction The Bluetooth Low Energy (BLE) protocol has become a fundamental standard within the IoT ecosystem, used in wearables, sensors, peripherals, and a wide variety of connected devices. It is possible to capture and analyze its traffic in real time using dedicated hardware. For this purpose, the nRF52840 Dongle from Nordic Semiconductor, together with the tool nRF Sniffer for Bluetooth LE, constitutes an accessible and powerful solution. The necessary firmware will be installed on the dongle, the sniffer will be integrated into a Linux environment, and BLE traffic will be captured in Wireshark. Three analysis scenarios are also addressed with different levels of security: connections without pairing, vulnerable classic pairing (Legacy Pairing), and modern and robust pairing based on elliptic curves (LE Secure Connections). ...

Introduction Dynamic analysis of Android applications has become an essential discipline for those who develop or audit their own mobile projects. Instrumenting an app in real time allows us to fully understand how it behaves, which code paths are involved in each operation, and how our defensive mechanisms respond to different scenarios. Among the tools that facilitate this process stand out Frida and Objection. To explore these concepts in a controlled way, we will use the application Android SSL Pinning Demo by httptoolkit, an open-source project designed to experiment with various methods of certificate pinning. We will also make use of the scripts published by the same team to analyze the internal workings of TLS verification. This lab is ideal because it offers a secure environment in which it is possible to test instrumentation techniques without impacting third-party software. ...

Introduction After the configuration in previous articles of the lab, we will proceed to its step-by-step resolution. Solution of the environment Now, in order to participate in the resolution of the environment, it will be necessary to deploy a virtual machine with an operating system such as Kali Linux with a network interface connected to the NatNetwork network created earlier with the OpenVPN .ovpn file to connect to the lab network. We connect to the VPN. ...

Introduction With the network infrastructure already defined in OPNsense with the article above, the next step consists of preparing the virtual machines that will form part of the CTF lab. From this point on, each VM must be correctly integrated into the DMZ and internal networks, respecting the previously established segmentation. Installation of the virtual machines We will perform the installation in VirtualBox of two Debian Linux virtual machines with the smallest number of tools installed since the necessary ones will be installed later. To speed up the installation time, the network version of Debian can be used. The requirements for the machines will be 2 CPU cores, 2 GB of RAM, and 8 GB of storage. ...