Skip to main content
SpringerLink
Log in

Progressive Mobile Web Application Subresource Tampering During Penetration Testing

  • Conference paper
  • First Online:
Advanced Information Networking and Applications (AINA 2021)

Part of the book series: Lecture Notes in Networks and Systems ((LNNS,volume 225))

Abstract

Since the boost of mobile devices popularity, both operating systems and mobile applications have become more complex which in turn transfers into greater vulnerability to hackers' attacks. Penetration testing is aimed at detection of security gaps in mobile systems. On the other hand, Progressive Web uses Web browser API to enhance the range of functionalities to cross-platform. Thus, this paper focuses on mobile Web application penetration tests of Progressive Web. First, some new functionalities were evaluated for vulnerabilities, then an in-depth analysis of the Web push functionalities was carried out. External resources, which deliver Web push services, were explored for the libraries security. Then, Man-in-the-Middle attack on Subresource Integrity Mechanism (SIM) was analyzed to exploit the vulnerabilities detected.

This is a preview of subscription content, log in via an institution to check access.

Access this chapter

Log in via an institution
Chapter
USD 29.95
Price excludes VAT (USA)
  • Available as PDF
  • Read on any device
  • Instant download
  • Own it forever
eBook
USD 169.00
Price excludes VAT (USA)
  • Available as EPUB and PDF
  • Read on any device
  • Instant download
  • Own it forever
Softcover Book
USD 219.99
Price excludes VAT (USA)
  • Compact, lightweight edition
  • Dispatched in 3 to 5 business days
  • Free shipping worldwide - see info

Tax calculation will be finalised at checkout

Purchases are for personal use only

Institutional subscriptions

References

  1. Chalupnik, R., Kedziora, M., Jozwiak, P., Jozwiak, I.: Correspondent sensitive encryption standard (CSES) algorithm in insecure communication channel. In: International Conference on Dependability and Complex Systems, pp. 90–98. Springer, Heidelberg (2019)

    Google Scholar 

  2. Braun, F., Akhawe, D., Weinberger, J., West, M.: Subresourceintegrity. In: W3C Working Draft, vol. 3, pp. 3655–3682 (2014)

    Google Scholar 

  3. Callegati, F., Cerroni, W., Ramilli, M.: Man-in-the-Middle attack to the https protocol. IEEE Secur. Priv. 7(1), 78–81 (2009)

    Article  Google Scholar 

  4. Cortesi, A., Hils, M., Kriechbaumer, T.: Contributors. Mitmdump (2010)

    Google Scholar 

  5. Cortesi, A., Hils, M., Kriechbaumer, T.: Contributors. Mitmproxy: A free and open source interactive HTTPS proxy, 2010–. [Version 5.0] (2010)

    Google Scholar 

  6. GoogleDevelopers.Introductiontoserviceworker. https://developers.google.com/Web/ilt/pwa/introduction-to-service-worker, Accessed 19 Dec 2019

  7. GoogleDevelopers.ProgressiveWebappchecklist. https://developers.google.com/Web/Progressive-Web-apps/checklist, Accessed 17 Dec 2019

  8. Python Software Foundation. json—json encoder and decoder. Accessed 23 Dec 2019

    Google Scholar 

  9. W3Techs. Usage of javascript libraries for Websites. https://w3techs.com/technologies/overview/javascript_library, Accessed 20 Dec 2019

  10. Hodges, J., Jackson, C., Barth, A.: Rfc 6797: Http strict transport security (hsts). IETF (2012). https://tools.ietf.org/html/rfc6797

  11. Kügler, D.: Man in the Middle attacks on bluetooth. In: International Conference on Financial Cryptography, pp. 149–161. Springer, Heidelberg (2003)

    Google Scholar 

  12. Lee, J., Kim, H., Park, J., Shin, I., Son, S.: Pride and prejudice in progressive web apps: abusing native app-like features in Web applications. In: Proceedings of the 2018 ACM SIGSAC Conference on Computer and Communications Security, pp. 1731–1746. ACM (2018)

    Google Scholar 

  13. Luotonen, A., Altis, K.: World-wide Web proxies. Comput. Netw. ISDN Syst. 27(2), 147–154 (1994)

    Article  Google Scholar 

  14. Meyer, U., Wetzel, S.: A Man-in-the-middle attack on umts. In: Proceedings of the 3rd ACM workshop on Wireless security, pp. 90–97. ACM (2004)

    Google Scholar 

  15. W3C. W3c recommendation (2015). https://www.w3.org/TR/2015/REC-notifications-20151022/, Accessed 19 Dec 2019

  16. Poza, D.: Why you should not Manage your users’ identities. https://auth0.com/blog/why-you-should-not-Manage-your-users-identities/, Accessed 20 Dec 2019

  17. W3C. Application cache as part of the w3c recommendation. https://html.spec.whatwg.org/multipage/offline.html#appcache, Accessed 17 Dec 2019

  18. Singh, A.: Proxy.py – a lightweight, single file http proxy server in python (2018). Accessed 23 Dec 2019

    Google Scholar 

  19. Kołaczek, G., Mizera-Pietraszko, J.: Security framework for dynamic service-oriented IT systems. J. Inf. Telecommun. 2, 428–448 (2018). https://doi.org/10.1080/24751839.2018.1479926

    Article  Google Scholar 

  20. Kołaczek, G., Mizera-Pietraszko, J.: Analysis of dynamic service oriented systems for security related problems detection. In: 2017 IEEE International Conference on Innovations in Intelligent Systems and Applications (INISTA), Gdynia, pp. 472–477 (2017). https://doi.org/10.1109/INISTA.2017.8001206

  21. Stock, B., Johns, M., Steffens, M., Backes, M.: How the Web tangled itself: uncovering the history of client-side Web (in) security. In: 26th {USENIX} Security Symposium ({USENIX} Security 17), pp. 971–987 (2017)

    Google Scholar 

Download references

Author information

Authors and Affiliations

  1. Faculty of Computer Science and Management, Wroclaw University of Science and Technology, Wrocław, Poland

    Tobiasz Wróbel, Michał Kędziora, Michał Szczepanik & Piotr P. Jóźwiak

  2. Faculty of Architecture, Wroclaw University of Science and Technology, Wrocław, Poland

    Alicja M. Jóźwiak

  3. Department of Innovative Projects Management, Military University of Land Forces, Wrocław, Poland

    Jolanta Mizera–Pietraszko

Authors
  1. Tobiasz Wróbel
    View author publications

    You can also search for this author in PubMed Google Scholar

  2. Michał Kędziora
    View author publications

    You can also search for this author in PubMed Google Scholar

  3. Michał Szczepanik
    View author publications

    You can also search for this author in PubMed Google Scholar

  4. Piotr P. Jóźwiak
    View author publications

    You can also search for this author in PubMed Google Scholar

  5. Alicja M. Jóźwiak
    View author publications

    You can also search for this author in PubMed Google Scholar

  6. Jolanta Mizera–Pietraszko
    View author publications

    You can also search for this author in PubMed Google Scholar

Corresponding author

Correspondence to Jolanta Mizera–Pietraszko .

Editor information

Editors and Affiliations

  1. Department of Information and Communication Engineering, Fukuoka Institute of Technology, Fukuoka, Japan

    Leonard Barolli

  2. Department of Computer Science, Ryerson University, Toronto, ON, Canada

    Isaac Woungang

  3. Faculty of Business Administration, Rissho University, Tokyo, Japan

    Tomoya Enokido

Rights and permissions

Reprints and permissions

Copyright information

© 2021 The Author(s), under exclusive license to Springer Nature Switzerland AG

About this paper

Check for updates. Verify currency and authenticity via CrossMark

Cite this paper

Wróbel, T., Kędziora, M., Szczepanik, M., Jóźwiak, P.P., Jóźwiak, A.M., Mizera–Pietraszko, J. (2021). Progressive Mobile Web Application Subresource Tampering During Penetration Testing. In: Barolli, L., Woungang, I., Enokido, T. (eds) Advanced Information Networking and Applications. AINA 2021. Lecture Notes in Networks and Systems, vol 225. Springer, Cham. https://doi.org/10.1007/978-3-030-75100-5_26

Download citation

Publish with us

Policies and ethics

Search

Navigation