
Introduction to the author and the curriculum of this course.
Discussion on Penetration Testing and Phases of Penetration Testing.
Discussion on Android Penetration Testing and Android Phases of Penetration Testing.
This Lecture gives the basic knowledge of android and its architecture.
This Lecture gives a basic understanding of the android apk and its structure.
This Lecture gives basic information on Android components and Lifecycle methods.
In this lecture, we can understand what is decompiling process and what are decompilers.
Here we have discussed Static analysis and its Importance in Penetration Testing.
we discuss the various static analysis tools and their installation procedure.
Jax: https://github.com/skylot/jadx/releases
JEB: https://www.pnfsoftware.com/jeb/community-edition
GDA: https://github.com/charles2gan/GDA-android-reversing-Tool/releases
In this lecture, we have discussed how to install MOBSF and how to use MOBSF, features of MOBSF, and also how to perform Dynamic analysis on android apk in MOBSF.
MOBSF: https://mobsf.github.io/docs/#/
Here, we have discussed how to analyze the apk, we have shown static analysis of 3 different frameworks( Java, react, Cordova) and also discussed how to find weak codes and vulnerabilities.
Github : https://github.com/dwisiswant0/apkleaks
Lets us automate the use of drozer to find vulnerabilities in android components.
Tool link: https://github.com/themalwarenews/drozscan
In this video, we gonna discuss what is dynamic analysis and its importance.
we will set up a dynamic analysis lab using burp suite and genymotion.
Burpsuite: https://portswigger.net/burp/releases/professional-community-2021-12-1?requestededition=community
Genymotion: https://www.genymotion.com/download/
Yaazhini:https://www.vegabird.com/yaazhini/
Let us understand what is SSL-PINNING, why developers implement it in the applications.
let us understand some dynamic illustration tools.
Frida: https://frida.re/docs/android/
Objection: https://github.com/sensepost/objection/wiki
Frida Universal SSL Bypass script : https://codeshare.frida.re/@pcipolloni/universal-android-ssl-pinning-bypass-with-frida/
Frida-server: https://github.com/frida/frida/releases
Here is the bonus video on other ways to bypass SSL-PINNING.
Apk-mitm: https://github.com/shroudedcode/apk-mitm
In this video, let us discuss attack vectors in dynamic analysis and the endpoints we can look into during dynamic analysis.
mlogcat: https://mlogcat.tistory.com/
Configuring Xposed framework
Xposed Installer apk : https://forum.xda-developers.com/attachments/xposedinstaller_3-1-5-apk.4393082/
Xposed archive flash file : https://dl-xda.xposed.info/framework/sdk25/x86/xposed-v89-sdk25-x86.zip
Inspeckage : https://github.com/ac-pm/Inspeckage/releases
Xposed modules repo : https://repo.xposed.info/module
Let us make things easier to remember all the attack vectors for android pen-testing.
link: https://www.xmind.net/m/KERydp/
Brief on the topics, that we gonna discuss in Android Pentesting 201.
Thank you all, wishing you all the best wishes for your android pentesting Journey.
The Android Penetration Testing 101 course is designed for beginners who are interested in exploring Android security but don't know where to start. This comprehensive course covers everything from understanding the Android architecture to analyzing Android applications using various attack vectors.
Throughout the course, you will learn how to perform static analysis on Android applications, including those developed with frameworks like React Native, Java, Flutter, and Cordova. You'll be introduced to essential tools such as Jadx, Jeb decompiler, and GDA decompiler, which aid in the static analysis process. Additionally, the course covers the installation and usage of automated scanners like MOBSF, enabling you to perform dynamic analysis on apps and identify common vulnerabilities. The course also highlights the key endpoints to focus on during static analysis.
One of the most exciting aspects of penetration testing is dynamic analysis. In this course, you'll understand why dynamic analysis is crucial for mobile applications and its role in vulnerability hunting. The course provides a step-by-step guide for setting up a dynamic analysis lab, featuring the use of Burp Suite with Genymotion. SSL pinning is a fundamental concept covered extensively in the dynamic analysis section. The course explores SSL pinning in detail and demonstrates various methods to bypass it on Android.
To enhance your dynamic analysis skills, the course introduces powerful tools like Frida and objection, and provides instructions on their setup and usage. The course concludes with a live dynamic analysis session on an Android application, during which you'll learn how to identify common vulnerabilities, locate relevant endpoints, and extract sensitive information from the app's database.
As a bonus, the course includes an Android pentesting checklist, which serves as a handy reference guide during real-time analysis, ensuring a smoother pentesting experience.