EXPLORING MOBILE AND API (IN)SECURITY. Pre-Workshop Software Set-up Guide

Transcription

1 EXPLORING MOBILE AND API (IN)SECURITY Pre-Workshop Software Set-up Guide Abstract To maximize your time learning in this workshop we ask that participants complete some pre-workshop software set-up. This document describes the software that is required and instructions on how to download and install these. All software is either freely available or is open-source. If you have problems following these instructions, need further advice or are unable to install the required software then please let us know (contact details below) Bill Matthews

2 Exploring Mobile & API (in)security: Pre-Tutorial Software Installation Guide The Exploring Mobile and API (in)security tutorial is a full-day hands-on introduction to security testing in a mobile and web API context. We will learn by testing a deliberately vulnerable Android mobile application and deliberately vulnerable REST API; these will be distributed on the day in the form of a Linux Virtual Machine. Using a Virtual Machine will allow you to have greater control over your testing and prevents interference from other attendees that might arise if you were sharing a single environment; it also means you have a ready to go environment that you can take away with you and continue to practice safely. To run the Virtual Machine, you will need a laptop that meets the following: Any recent operating system (Mac OSX, Linux, Windows). Minimum of 4 GB RAM (8 GB or greater is recommended). o The Virtual Machine can run on a machine with 2GB RAM but maybe slow. A working USB 2 port (USB 3 is preferred). 20 GB of disk-space Local Administrator rights on the laptop. We like to keep environment set-up to less than 30 minutes at the start of the day (usually it s complete within 15 minutes) but this requires that attendees have pre-installed some key software ahead of the tutorial. For this tutorial you will need to have the following product installed on your laptop: Oracle Virtual Box This document provides instructions on how to install the necessary software. If you encounter problems installing any of the software, then please do not hesitate to contact Bill at Bill.Matthew@TargetTesting.co.uk. Bill will also be available on the morning of the tutorial (and probably the night before) to help with any last minute installation problems. VirtualBox VirtualBox can be downloaded from From this page, download and install the VirtualBox platform package for your operating system. Installation guides for different operating systems is provided in the VirtualBox User guide which can be found at Target Testing Ltd P a g e 1

3 Testing your set-up On the day of the workshop we will provide you with a USB memory stick containing a 64-bit Linux VM (Virtual Machine) that will contain the vulnerable web application we will be exploring and the set of tools we will be using. Setting up this environment on the day will be a matter of copying the VM onto your laptop and creating the VM in your chosen; the process normally takes about 15 to 20 mins to copy, unzip and create the VM. The Linux VM we will be using is a modified version of the MobiSec Virtual Machine ( this is a pre-built Linux distribution designed specifically designed for Mobile Security and Penetration Testing but we will add our own vulnerable application and ReST API to the distribution. Occasionally we have found that some participants have problems running 64bit virtual machines on their laptops; particularly if the laptop is old or is a corporate laptop that has user access restrictions (we normally recommend local administrator privileges). To address this, we recommend that, if you do not currently create and run 64bit VMs on your laptop, to attempt to download the MobiSec distribution to confirm that you will be able to use the version we distribute on the day. If you have problems following these instructions then please contact Bill at Bill.Matthews@TargetTesting.co.uk The following instructions describe how to do this. This step is recommended but optional. 1. First download the MobiSec Linux Virtual Machine from and unzip the files to a location on your laptop. a. Although the files are designed for VMWare platforms they will run on VirtualBox. 2. Start Virtual Box and click on the New button to create a new Virtual Machine 3. Complete the first screen of the wizard as follows: Target Testing Ltd P a g e 2

4 Target Testing Ltd P a g e 3

5 4. Click on Next and ensure the Memory Size is set to 1024 MB 5. Select Next and on the Hard Drive screen, select the Use an existing virtual hard drive file and use the file browser to locate Mobisec x vmwarevm file in the unzipped MobiSec folder. This should be in the folder where you unzipped the download and located in the Mobisec x vmwarevm folder. Target Testing Ltd P a g e 4

6 6. Click on the Create button to create the new Virtual Machine. This should complete the creation of the virtual machine and the screen should look similar to the following: Target Testing Ltd P a g e 5

7 Target Testing Ltd P a g e 6

8 7. With the newly created VM selected, click on the Start button to start the VM. 8. If the set-up was successful, this will start up the VM in a separate window once complete you should see a screen such as the following. 9. If this was successful, then you are unlikely to have any problems on the day. Target Testing Ltd P a g e 7

9 10. To shutdown the VM you can: a. Select the Kickoff Application Launcher (blue icon in the bottom left of the VM b. Select the Leave option c. Select the Shut down option. 11. There is no need to keep this VM (unless you want to experiment with it prior to the tutorial) so you can select the VM from the main VirtualBox window and select to remove it (including all files) this is achieved by selecting the Remove option from the Machine menu. Target Testing Ltd P a g e 8