Testando Autenticação de API Mobile

Quando Usar

Use esta habilidade quando:

• Avaliando a autenticação de API de backend de aplicativos móveis durante testes de penetração
• Testando a implementação de tokens JWT para vulnerabilidades comuns (algoritmo none, assinatura fraca)
• Avaliando fluxos OAuth 2.0 / OIDC em aplicativos móveis para problemas de redirecionamento, PKCE e escopo
• Testando autorização quebrada em nível de objeto (BOLA/IDOR) em endpoints de API

Não use esta habilidade contra APIs de produção sem autorização explícita e consciência de limitação de taxa.

Pré-requisitos

• Burp Suite ou mitmproxy configurado como proxy de dispositivo móvel
• SSL pinning contornado no aplicativo alvo (se implementado)
• Credenciais de conta de teste válidas para o aplicativo alvo
• Postman ou curl para criação de requisições de API
• jwt.io ou PyJWT para análise e manipulação de JWT

Fluxo de Trabalho

Etapa 1: Mapear Endpoints de Autenticação

Intercepte o tráfego do aplicativo móvel para identificar endpoints relacionados à autenticação:

POST /api/v1/auth/login          - Initial authentication
POST /api/v1/auth/register       - Account registration
POST /api/v1/auth/refresh        - Token refresh
POST /api/v1/auth/logout         - Session termination
POST /api/v1/auth/forgot-password - Password reset
POST /api/v1/auth/verify-otp     - OTP verification
GET  /api/v1/auth/me             - Authenticated user profile

Etapa 2: Analisar Formato e Segurança do Token

Análise JWT:

# Decode JWT without verification
echo "eyJhbGciOiJIUzI1NiIs..." | cut -d. -f2 | base64 -d 2>/dev/null

# Check for common JWT vulnerabilities:
# 1. None algorithm attack
# Change header to: {"alg":"none","typ":"JWT"}
# Remove signature: header.payload.

# 2. Algorithm confusion (RS256 to HS256)
# If server uses RS256, try HS256 with public key as secret

# 3. Weak signing key
# Use hashcat or jwt-cracker to brute-force HMAC secret
hashcat -m 16500 jwt.txt wordlist.txt

# 4. Expiration bypass
# Modify "exp" claim to future timestamp

Análise de Token Opaco:

- Test token length and entropy
- Check if tokens are sequential/predictable
- Test token reuse after logout
- Verify token invalidation on password change

Etapa 3: Testar Bypass de Autenticação

# Test missing authentication
curl -X GET https://api.target.com/api/v1/users/profile

# Test with empty/null token
curl -X GET https://api.target.com/api/v1/users/profile \
  -H "Authorization: Bearer "

curl -X GET https://api.target.com/api/v1/users/profile \
  -H "Authorization: Bearer null"

# Test with expired token (should fail)
curl -X GET https://api.target.com/api/v1/users/profile \
  -H "Authorization: Bearer <expired_token>"

# Test token from different user
curl -X GET https://api.target.com/api/v1/users/123/profile \
  -H "Authorization: Bearer <user_456_token>"

Etapa 4: Testar IDOR / Autorização Quebrada em Nível de Objeto

# Change user ID in request path
curl -X GET https://api.target.com/api/v1/users/123/orders \
  -H "Authorization: Bearer <user_456_token>"

# Change object ID in request body
curl -X PUT https://api.target.com/api/v1/orders/789 \
  -H "Authorization: Bearer <user_456_token>" \
  -d '{"status": "cancelled"}'

# Test horizontal privilege escalation
# Access admin endpoints with regular user token
curl -X GET https://api.target.com/api/v1/admin/users \
  -H "Authorization: Bearer <regular_user_token>"

Etapa 5: Testar Gerenciamento de Sessão

# Test concurrent sessions
# Login from multiple devices simultaneously - should both remain valid?

# Test session invalidation after logout
TOKEN=$(curl -s -X POST https://api.target.com/api/v1/auth/login \
  -d '{"email":"test@test.com","password":"pass"}' | jq -r '.token')

# Logout
curl -X POST https://api.target.com/api/v1/auth/logout \
  -H "Authorization: Bearer $TOKEN"

# Try using the same token (should fail)
curl -X GET https://api.target.com/api/v1/users/me \
  -H "Authorization: Bearer $TOKEN"

# Test session invalidation after password change
# Token obtained before password change should be invalidated

Etapa 6: Testar Fluxos Mobile OAuth 2.0 / OIDC

# Test for authorization code interception
# Check if PKCE (Proof Key for Code Exchange) is enforced
# Test with missing code_verifier parameter

# Test redirect URI manipulation
# Try custom scheme hijacking: myapp://callback
# Test with modified redirect_uri parameter

# Test scope escalation
# Request higher privileges than granted

Conceitos Chave

| Termo | Definição |

…