eMAPT & Mobile Apps/Sec Guide

Introduction

On May 23rd, 2022, I successfully passed my eMAPT exam from eLearnsecurity. Whenever I strive to obtain a certification, I always follow a set of steps to ensure a thorough understanding of the topic. These steps are:

1. Understanding and learning the topic as a developer or IT professional.
2. Applying and practicing the topic through building applications, for instance.
3. Learning and applying the security aspect of the topic.

In this blog, I will provide an honest review of the eMAPT course and exam, as well as offer a guide for mobile application security.

You can join the eMAPT Telegram group from the following link: https://t.me/+pBYo2XBMfa5hNGFk

Course Content

The eMAPT course content was simple and not too bad, so it does not require a lot of description. However, there were some parts that were not clear, particularly in the early modules. If you are a beginner or someone with no prior knowledge, you will learn a lot, but if you have previous experience, you may not learn as much. The course covers both major mobile computing platforms, Android and iOS, starting with the OS architecture, followed by the setup of the necessary environment for the course. The course then moves on to the application building process and discusses how to hack each OS, either through rooting Android or jailbreaking iOS. Finally, the course covers vulnerabilities and security issues that can affect applications on both platforms, as well as how to test for these issues through static and dynamic analysis. Overall, the content is simple and easy to understand.

The Exam

For the exam, it is important to have both development and security knowledge related to the topic. You will be tested on your ability to develop applications, identify specific security vulnerabilities, and create an app that exploits these vulnerabilities. ==Note that there are no iOS apps included in the exam==, but if you have the necessary equipment such as a Mac and iPhone, it is recommended that you study iOS development specifically.

Mobile App/Sec Guide

The most important than the certificate itself is to build the knowledge and the skills of the topic. So let’s move on with this guide that i put it from my view you don’t have to fully follow it, But i explained each part to make everything clear from my point of view:

How to enhance your skills, knowledge & also prepar for the eMAPT ?

Before learn how to hack the thing, learn the thing, do the thing and then hack the thing

So, first is the basics of the both Android & IOS with development & security also pentest.

So, we will start with the basics from TCM-Academy that course will give you some basic knowledge and skills about the Android & IOS both from the security & pentesting side. So, you will be able to understand the up coming courses from the security side and increase your mindset from the security side more.

Tcm-Academy link: https://academy.tcm-sec.com/p/mobile-application-penetration-testing

Second step is to study the eMAPT course materials but when we reach the Application fundamentals module we go to the development in Android or IOS depending on the section you are studying And here are two courses that i do recommend for the development:

Android Development: https://www.udemy.com/course/android-development-and-android-application-hacking/

IOS Development: https://www.udemy.com/course/iphone-developer-course/

You can also look for the development resources that you see its good for you.

Now you can complete the eMAPT course & learning materials, And after that we will do the following:

As we know the mobile apps pentesting is divided into 2 thing, first the static analysis part which is for reverse engineering the application and reading the code for understanding and spotting some vulnerabilities or hardcoded credentials, etc.. & the second part is dynamic analysis which is the part for testing the application in the runtime such as looking for insecure data storing, some leaks & network traffic and many more.

• Static Analysis courses: The following 2 courses are focused on static analysis more and vulnerabilities such as Owasp Mobile Top 10, how to use drozer & have a small part about exploit development on the mobile apps libraries.

Android: https://insectechs.usefedora.com/p/android-application-penetration-testing-7536

IOS: https://insectechs.usefedora.com/p/ios-application-penetration-testing-ethical-hacking-domain-7542

• Dynamic Analysis:

Now, after you have done your static analysis and understand the logic of the app let’s go for the dynamic analysis part. In this part you run the application and start to analysis the behaviour of the app, network flaw and trying to exploit the behaviour and other flaws that happen during the runtime.

Android: https://www.udemy.com/course/hacking-and-pentesting-android-applications/

IOS: https://www.udemy.com/course/hacking-and-pentesting-ios-applications/

Now we can say that we have fill most of the gaps that could happen to us and if you want to go more deeper and advance your level. You can start to read the books and the books are divided into 2 parts, The first part related to the applications itself and the second part related to exploit development in terms of exploitation to something like native C/C++ libraries that used in the applications and so on.

First part Focusing on Applications:

OWASP Mobile Security Testing Guide: https://owasp.org/www-project-mobile-security-testing-guide/

Mobile Application Penetration Testing: https://www.amazon.com/Mobile-Application-Penetration-Testing-Vijay-ebook/dp/B019IOX4Y2/

the following book focuses more on applications and it has a part about exploit development in native libraries.

The Mobile Application Hacker’s Handbook: https://www.amazon.com/Mobile-Application-Hackers-Handbook/dp/1118958500/

Second part Focusing on Exploit Development:

This is especially for the exploit development section. These books explain the internals of mobile operating systems such as Android & iOS, and they are divided into two parts. The first part focuses on in-depth analysis and understanding of the operating systems, how they work, and their architecture. The second part focuses more on exploit development.

The first book helps you understand mobile operating systems in a more in-depth and broad way through digital forensic analysis: Practical Mobile Forensics: https://www.amazon.com/Practical-Mobile-Forensics-hands-mastering/dp/1788839196

This is the second section, which focuses more on exploit development:

Android Hacker’s Handbook: https://www.amazon.com/Android-Hackers-Handbook-Joshua-Drake/dp/111860864X/

iOS Hacker’s Handbook: https://www.amazon.com/iOS-Hackers-Handbook-Charlie-Miller/dp/1118204123/

Conclusion

Don’t forget to conduct your own research and read articles/blogs. Additionally, there is a distribution built on Ubuntu called Mobexler which is a mobile app security and pentesting distribution. It comprises all the tools and frameworks necessary for mobile app pentesting. There is also a checklist available for both Android and iOS app pentesting that you can follow

Download link: https://lnkd.in/gTunVyXW

Checklist link: https://lnkd.in/gbKAgxir

Used Tools: https://lnkd.in/gkZDDKas