Mobile App Security Testing: Guía Completa iOS y Android

// INSEGURO: UserDefaults (texto plano)
UserDefaults.standard.set("token", forKey: "auth_token")

// SEGURO: Keychain
func saveToKeychain(key: String, value: String) {
    let query: [String: Any] = [
        kSecClass as String: kSecClassGenericPassword,
        kSecAttrAccount as String: key,
        kSecValueData as String: value.data(using: .utf8)!
    ]
    SecItemAdd(query as CFDictionary, nil)
}

func urlSession(
    _ session: URLSession,
    didReceive challenge: URLAuthenticationChallenge,
    completionHandler: @escaping (URLSession.AuthChallengeDisposition, URLCredential?) -> Void
) {
    let pinnedHash = "sha256_hash"
    let serverHash = serverCertificateData.sha256()

    if serverHash == pinnedHash {
        completionHandler(.useCredential, URLCredential(trust: serverTrust))
    }
}

// INSEGURO: SharedPreferences
val prefs = getSharedPreferences("prefs", MODE_PRIVATE)
prefs.edit().putString("token", "sensitive").apply()

// SEGURO: EncryptedSharedPreferences
val masterKey = MasterKey.Builder(context)
    .setKeyScheme(MasterKey.KeyScheme.AES256_GCM)
    .build()

val encryptedPrefs = EncryptedSharedPreferences.create(
    context, "secure_prefs", masterKey,
    EncryptedSharedPreferences.PrefKeyEncryptionScheme.AES256_SIV,
    EncryptedSharedPreferences.PrefValueEncryptionScheme.AES256_GCM
)

# Instalar Frida
pip install frida-tools

# Listar apps
frida-ps -U

# Bypass detección root
frida -U -l bypass-root.js -f com.example.app

# Decompile APK
apktool d app.apk

# Buscar secretos hardcoded
grep -r "api_key" decompiled/