Storage/archive analysis
Once we have inserted the data into the apps, is the data secure on the device? The first focus is on what resides in the mobile device itself and how it can be extracted. Many a time, developers make assumptions that user devices can never be compromised and data in the device is always protected. One of the major threats to application data is when the mobile device is stolen or lost. A majority of the vulnerabilities found during penetration testing are discovered while performing storage/archive analysis.
There are two primary folders that might potentially contain sensitive information. Copy all the files to our iOSTarget folder (MAC and Windows) from the following location for offline analysis:
/private/var/mobile/Containers/Bundle/Application/<UUID>/ ...
Get Mobile Application Penetration Testing now with the O’Reilly learning platform.
O’Reilly members experience books, live events, courses curated by job role, and more from O’Reilly and nearly 200 top publishers.
