Android Application Static and Dynamic Security Assessment

Trace Android history from a 2003 camera project to a Google funded smartphone OS, through the Open Handset Alliance and dessert-named versions up to Android 12.

Explore the Android framework architecture from the Linux kernel through Binder IPC to core libraries, Android runtime, and app framework, covering surface manager and media framework.

Connect and control Android devices using the Android debug bridge, or ADB. Explore the ADB components—client, server, and daemon—and basic commands like adb devices and adb shell.

Explore the Android file structure, including APEX modules, the APKs folder, app and data directories, system and vendor folders, with debugging using ADB, bug reports, and storage layouts.

Explore android application architecture, including activities, content providers, services, and broadcast receivers, and understand manifest, dex, resources, and layouts in an apk, plus normal and dangerous permissions and their groups.

Decompile Android apps with quark, a static analysis tool by LinkedIn, to extract readable Java code and resources, using setup and command-line steps, producing Java code and manifest outputs.

Use the jde-gui jd-gui tool to analyze Android jar files, opening android 01.jar from the quark build folder and inspecting com pedestal lab main activity.

Learn how to decompile android applications with apktool, inspect smiley code and Java code, and recompile after changes using Kali Linux commands and standard folder paths.

Use Android Studio to perform static analysis by decompiling dex files, converting Dalvik bytecode to a jar, and inspecting the Java code, manifest, and resources.

Learn how to use mobSF to analyze Android apps by installing dependencies, running the setup, uploading an app, and viewing Java, Smali, and manifest source code.

Install MobSF on Windows by setting up Python and pip, fulfilling dependencies from requirements.txt, installing OpenSSL, and launching the local web interface at localhost:8000 to upload and analyze apps.

Identify a hard coding issue in an Android app by locating a vendor secret key used as a license key, and show access granted when the input matches.

Explores insecure data storage in Android apps by examining shared preferences, showing how username and password are stored as plaintext key-value pairs, and promoting secure shared preferences with encryption.

Explores insecure data storage by writing credentials to a temporary file in the app's data directory, exposing plaintext, and suggests encrypting or encoding (base64 or hex) the values.

Demonstrate insecure data storage in Android by saving credentials to external storage as plain text, exposing permission gaps, and showing how to store data in the app data folder instead.

Demonstrate how improper input validation in an Android app enables tautology-based sql injection to fetch all user data from a SQLite database with a single malicious search.

Examine improper input validation in web view scenarios and how the file method can access sensitive information or files on Android devices through storage paths.

Explore an access control issue that shows how API credentials can be exposed by triggering exported Android components via ADB and intents, bypassing authentication.

demonstrates bypassing a four-digit pin to access private notes by exploiting an exported content provider via adb and the content resolver, revealing data stored in shared preferences or databases.

Learn how a vendor key is hardcoded inside the Diva Genie library, and how input is passed to the library via JNI to trigger access.

Explore how input fuzzing exposes improper input validation in Android apps by sending long inputs beyond 31 characters, causing app crashes when exception handling is insufficient.

Identify hard-coded credentials in Android apps by testing Pen Tester lab applications on Kali Linux, tracing package, manifest, main activity, and intent flow to reveal the lab_key in strings.xml.

This lecture guides Android security assessment by locating hardcoded values in the manifest and main activity and extracting the hardcoded key from the asset database named data escalate.

Explore a pentester lab application by inspecting the manifest for the package name, locating the main and message activities, and identifying a hardcoded pin passed via intent extras.

Explore how to locate hardcoded values in an Android app by decompiling the main activity, tracing intents and extras to a decrypt function in secure storage, revealing utf-16 plaintext.

Learn to configure Burp Suite Professional with Firefox and Chromium, install the certificate, set up proxies and scope, and use Intruder, Repeater, Sequencer, and Decoder for testing.

Analyze android applications with mob-sf to perform static analysis, identify exported components, manifest details, debug certificates, permissions, and hardcoded secrets for security assessment.

Clone and run the AndroBug framework for static analysis of an Android app, generate a report, and identify issues in the manifest, webview, JavaScript execution, and adb backup exposure.

Learn to use the drozer browser console on Android to enumerate packages, read manifest details, inspect attack surface, and run scanner modules for injections, URIs, and SQL tables.