With mobile applications continuing to grow rapidly, developers, quality assurance, and security assessors have the need to test both the applications and the remote backend services consumed. This requires consideration of traffic interception and monitoring to determine what level of capture is possible and what consequences may result. In this presentation, practical methods of intercepting mobile device traffic will be explained and demonstrated focusing on approaches applicable when the device is under tester control and when the device is not. Jeremy Druin (@webpwnized) is a certified (GXPN, GPEN, GWAPT, GWAPT-GOLD, GSEC, GISF, Sec+) application, web, and network security pen-tester for a multi-national transportation logistics company. Additionally, Jeremy is the developer of the open-source OWASP Mutillidae II training system and acts as the Director of Education for Kentuckiana ISSA chapter while authoring the Webpwnized YouTube Channel. Jeremy holds a Bachelors in Computer Science from Indiana University, Associates in Database, Associates in Science and is a GIAC-certified Advanced Network, Web Application Pen-Tester and Exploit Developer.

Back to Louisville InfoSec 2013 video list