Android Pentesing Bootcamp

Perform static analysis of android apk to inspect code and resources without run time, using apk tool, jadx GUI, and MobSF to detect sensitive data like api keys and tokens.

Learn to analyze the Android manifest file as a central configuration that reveals app components, permissions, and security settings, and apply static analysis to detect misconfigurations related to exported flags.

Identify hard-coded secrets like api keys, tokens, and encryption keys in source code and config files, and locate them in strings.xml and the manifest using practical enumeration.

perform manual static analysis to identify exported sensitive activities and dangerous permissions in Android apps, using tools like ZXGUI and ADB, and document with screenshots from the manifest and APK.

Set up MobSF on Kali, clone the repo, install dependencies, run setup.sh and run.sh, and perform static and dynamic analysis of Android apks with automated reporting.

Learn mobile app pen testing reporting through a standardized template, covering executive summary, scope, critical findings, risk, impact, and practical mitigation and reproduction steps.

Explore dynamic analysis overview on Android apps, examining runtime interactions, network traffic, file access, memory, and API calls, with practical use of Burp Suite, Frida, and ADB.

Explore how Android apps store data in sandbox directories—shared preferences, databases, files, and cache—and how insecure data storage can occur, while learning static analysis, mobSF, and Frida-based runtime exploration.

Discover practical techniques to identify insecure data storage in Android apps by inspecting shared preferences and SQLite databases with adb, revealing plaintext credentials and weak encryptions.

Learn how to report insecure data storage findings in Android apps, detailing the impact of plain-text credentials in shared preferences, and using a precise vulnerability description, analysis, and recommendations.

this lecture explains how misconfigured firebase real-time database in android apps allows read and write via the database url, risking tokens, chats, and payments.

Perform static analysis to locate Firebase database URLs and API keys in strings.xml, and manually search resources like values/strings.xml to reveal sensitive data and a ctf-style flag.

Insecure logging exposes sensitive data like usernames, passwords, tokens, and credit card details in logs read via adb logcat; encrypt and avoid logging such information.

Practice insecure logging in Android apps by analyzing a Diva app with adb logcat to uncover credit card numbers and admin credentials in logs, and insecure shared preferences.

Identify and exploit exported Android components with the browser pen testing tool, using ADB from PC and an agent browser.apk on the device, and check insecure permissions.

Install the drozer tool by downloading the apk, deploy the browser agent to a Genymotion device, start the embedded server, and ensure Python is ready.

Set up drozer with adb forward to enumerate an app’s attack surface, identifying exported Android components like activities, receivers, providers, and services.

Learn how Frida enables root and route detection bypass in banking apps on routed devices, by tampering route libraries and falsifying boolean checks in runtime.

Frida is a dynamic instrumentation toolkit that inspects, hooks, and modifies running apps in real time, with the server on the device, enabling bypass of root detection and SSL pinning.

Learn how to configure Frida and Objection on desktop environments, pinning compatible Frida versions, installing via pip, validating Python setup, and handling ARM64 and Genymotion considerations.

Set up the Frida server on Android using Genymotion, pushing the binary to the temp directory and granting execute permissions. Then verify the device processes with frida-ps -Uai.

Explore additional resources and blog guides with commands for practice in the android pentesting bootcamp, referencing the Shubham blog for running processes, and try the pin bypass vulnerability later.

Learn how SSL certificate pinning validates server certificates against a predefined set of tested certificates, preventing man-in-the-middle attacks and ensuring secure HTTPS communication at run time.

Explore SSL pinning bypass techniques by inserting a custom certificate to intercept app traffic with Burp Suite, using Frida or Objection, and modifying APKs before signing.

Demonstrates bypassing SSL pinning on Android apps using Objection and Frida, configuring Burp Suite, installing certificates, and intercepting traffic to reveal requests.

Learn to bypass SSL pinning in Android apps with Frida, using prebuilt scripts and GitHub resources to intercept and bypass certificate pinning.

Explore the StrandHogg vulnerability, a task hijacking attack that uses overlay UI to steal login credentials by impersonating a legitimate banking app on Android.

Explore Android components by examining activities as screens, how backstack and tasks govern navigation, and how task affinity and single task launch mode influence login, main activity, and navigation.