O'Reilly logo

IoT Penetration Testing Cookbook by Aditya Gupta, Aaron Guzman

Stay ahead with the world's most comprehensive technology and business learning platform.

With Safari, you learn the way you learn best. Get unlimited access to videos, live online training, learning paths, books, tutorials, and more.

Start Free Trial

No credit card required

Step 4 - identifying vulnerabilities

With all application features and API calls noted in our web proxy, we can now start to identify vulnerabilities in the design and also test logic flaws for vulnerabilities. The following is a list of the observed vulnerabilities:

  1. The web application sends all remote service calls over the URL as a GET request while the mobile applications send remote service calls as a POST with the parameters in the body. There are no randomly generated sessionIds used to execute remote service calls for the web.
  2. Certificate pinning and validation is not enforced for mobile applications.
  3. All requests and responses are cached for the iOS application.
  4. Account configuration changes, such as editing the vehicle details ...

With Safari, you learn the way you learn best. Get unlimited access to videos, live online training, learning paths, books, interactive tutorials, and more.

Start Free Trial

No credit card required