🛠️Android Application Pentesting

Android PT Mindmap

Reversing

Java/Kotlin

• Decompile apk

  • Jadx/Jadx-gui

  • Dex2Jar

  • APktool

• Native

  • Identify .so inside app lib/<arch>/*.so

  • rabin2 -I lib/x86_64/libnative-lib.so | grep -E "canary|pic"

  • Decompile with Ghidra/IDApr/R2

• Resources

  • Native decompiling

  • Reversing Native Libraries

  • [Smali](https://mas.owasp.org/MASTG/techniques/android/MASTG-TECH-0016/

  • JavaCode

React Native

• Disassembler and Assembler assets/index.android.bundle

  • hermes-facebook

  • hermes engine

  • hermes-dec

  • hbctool

  • hbctool-fork

  • hasmer

  • hermes_rs

• Resources

  • Reversing and Instrumenting React Native Apps

  • Reversing React Native

  • Reversing React Native apps

  • editing-and-patching-react-native-applications/

  • understanding-modifying-hermes-bytecode

Cordova/Ionic/Phone Gap

• Source code located in assets/www

• Resources

  • effortless-pentesting-of-apache-cordova-applications

  • Cordova Apps

Xamarin

• Find assemblies in apk

  • xamarin-decompress

  • XamAsmUnZ

  • dnSpy

  • dll-extractor-from-so-xamarin-app

• Resources

  • xamarin-apps

  • appknox-reversing-xamaring

Flutter

• Flutter Reversing

Apk Signature

• Verify Signature

  • apksigner verify --verbose example.apk

  • apksigner verify --print-certs --verbose example.apk

Static Analysis

Insecure Crypto-Methods

• Insecure Algorithm

  • DES, 3DES

  • RC2

  • RC4

  • BLOWFISH

  • MD4

  • MD5

  • SHA1

• SecureRandom with Empty Argument

Interesting File

• Android Manifest AndroidManifest.xml

• Network Security Config NetworkSecurityConfig.xml

• assets directory

• res/xml directory

Find Secret/URL/Endpoint

• strings command

• Retrieving String

• Apkleaks

Insecure DeepLink

• Check if exists /.well-known/assetlinks.json

• Exploit deeplink

• DeepLink Vulnerabilities

WebView

• Arbitrary Resources Load

• JavascriptInterface

• Javascript Enable

• Local File Inclusion

• XSS

Setup Device

Emulator

• rootAVD

• OWASP Techniques Emulator

Physical Device

• Rooting

• Magisk

  • lsposed

  • Magisk Hide

  • Enable Zygisk

• Useful Modules

  • MagiskFrida

  • Custom-Certificate-Authorities

  • Magisk hide

Root Detection

• Missing Root Detection

• Bypass

  • Frida

  • Code / Repack

  • Magisk Hide

Emulator Detection

• Missing Check

• Bypass

  • Frida

  • Code Manipulation / Patching

Anti-Tampering

• Check if signature is verified

  • use uber-apk-signer and try to execute app

• Check if integrity of code is verified

  • patch code (native, hermes, js, smali), sign app and try to execute againg

Dynamic Analysis

Pull apk

• list apk

  • adb shell pm list packages

• get path apk (or apks)

  • adb shell pm path sg.vp.owasp_mobile.omtg_android

• Download apk

  • abd pull <path>

Content Provider

• Exploiting Content Provider

Binary Instrumentation

• Dynamic Analysis on non rooted device

  • objection patchapk --source UnCrackable-Level1.apk

• Tools

  • Frida

  • Objection

Interact with App

• Drozer

  • Tutorial Drozer

• Attack Surface

  • run app.package.attacksurface <package_name>

Process Exploration

• Fridump

• Objection

  • objection --gadget sg.vantagepoint.helloworldjni explore

  • memory dump all

• Process Exploation

Method Tracing

• Execution Tracing

• Method Tracing

• Native Code Tracing

• JNI Tracing

Hooking Method

• Getting loaded classes

  • OWASP Getting Loaded Classes

• OWASP Hooking

Library Injection

• Library Injection MASTG

Debugger

• OWASP Debugging

• Exploit App Debuggable

• Resources

  • Debugger

Network

Network Monitoring

• Set Proxy

• monitoring traffic

• iptables

• tcpdump

SSL Pinning bypass

• OWASP: OWASP SSL Pinning Bypass

• Using Frida

  • ssl-pinning-bypass-android-frida

  • bypass-ssl-pinning-for-flutter

• Flutter App

  • reFlutter

  • OWASP Flutter

  • Flutter SSL Pinning Bypass Frida

• Tools

  • apk-mitm

  • frida-interception-and-unpinning

  • frida-android-unpinning

  • reFlutter

Storage

Sensitive information in Local Storage

• path /data/data/<package_name>

  • SharedPref

  • Database

  • Other files

• Objection objection -g sg.vp.owasp_mobile.omtg_android explore

File in External Storage

• Get list of file in /sdcard

  • adb pull /sdcard

• Using Frida and monitoring Api

  • getExternalStorageDirectory

  • getExternalStoragePublicDirectory

  • getExternalFilesDir or FileOutPutStream

• Permission WRITE_EXTERNAL_STORAGE, and MANAGE_EXTERNAL_STORAG

Sensitive Information Logcat

• pidcat

• adb logcat

• Log, Logger, System.out.print, System.err.print, and java.lang.Throwable#printStackTrace

Misconfiguration

Android Backup

• android:allowBackup="true"

• Android backup extractor Android backup extractor

Debug Certificate

• Check if app use debug certificate

  • apksigner verify --verbose example.apk

  • "CN=Android Debug,O=Android,C=US"

App Tampering

• Modifying [smali](https://github.com/JesusFreke/smali/wiki/TypesMethodsAndFields

• Smali-Repack

• Resign apk uber-apk-signer

  # create sign key (can be found in "Android Studio\jbr\bin\keytool.exe" )
  keytool -genkey -v -keystore your-keystore.jks -keyalg RSA -keysize 2048 -validity 10000 -alias <key alias name>
  # align the app (can be found in build-tools)
  zipalign -v 4 <your_app.apk> <your_app_aligned.apk>
  # sign the key (can be found in build-tools )
  apksigner.bat sign --ks your-keystore.jks --ks-key-alias <key alias name> --out <signed_apk.apk> <not_signed_apk.apk>

• Using Objection

Useful Tools

• ghidraScript

• Drozer

• Objection

• RMS

• House

• uber-apk-signer

• Jadx/Jadx-gui

• Dex2Jar

• APktool

• fridump

• Frida

• pidcat

• apkx

• Method Tracing Frida

• reFlutter

• blutter

• ProxyDroid

• ApkHunt

• Sebastian

• PAPIMonitor

• scrcpy

• apk-mitm

Useful Resources

• android-penetration-testing-cheatsheet

• Android Pentesting

• Hacktricks

• OWASP Mobile

  • MASTG Techniques

  • MASTG Test-beta

  • MASTG Test

  • MAS Checklist

  • MAS Checklist xlsx

• Testing Tools

• Frida Script

  • Frida Code Share

  • Frida Mobile Script

  • frida.re

  • learnfrida.info

  • codeshare.frida.re

  • github.com/dweinstein/awesome-frida

  • github.com/interference-security/frida-scripts