Case study – reverse engineering during a penetration test

One of the primary reasons for reverse engineering a mobile application during a penetration test is to analyze whether the source code has any sensitive information hardcoded, which can further be used by a malicious actor. Other reasons might be bypassing security controls such as SSL pinning, root/jailbreak detection, and role-based client-side access control. However, depending on the type of application and pentest, you might have to spend more effort in performing a more in-depth analysis of a reverse engineered application.

Let's look at one of the case studies. During the penetration test of a FinTech application, it was noticed that the application sent some critical requests to uniquely generated URL endpoints. These endpoints were unique for every request, and in fact, they were getting generated right before the HTTP(s) request was generated. In order to find the way this application generates these...