Android Pentesting 101

Set up the Mobexler environment for Android and iOS pentesting by installing Mobex flow in a VM, configuring Ubuntu, and exploring bundled tools like Burp Suite, Ghidra, Grapefruit, and FileZilla.

Explore Android emulators that replicate device hardware to run apps on other systems, enabling penetration testing with Genymotion, Android Studio emulator, Bluestacks, and NOX Player.

Install and use the Android Studio emulator to run and test apps. Create a new project and manage devices via the device manager.

Connect your Android device or emulator to BurpSuite as a proxy to capture and analyze requests. Install the certificate, configure proxy settings, and intercept http and https traffic.

Introduce android applications by detailing native, web, and hybrid types, explaining webview usage, and outlining testing with emulators while previewing progressive web apps built with Flutter and React Native.

Explore Android components such as activities, services, broadcast receivers, and content providers, with examples like notifications and background data handling, and cross-app data sharing.

Explore Android data storage options, including shared preferences, SQLite, file storage, content providers, and cloud storage, with notes on encryption, sensitivity, and best usage cautions.

Learn to transfer files from an Android device to a PC using ADB pull. Specify the source path and destination, ensuring the file moves from device to PC.

Explore how android web views embed web content, and compare web view client and web chrome client for javascript execution and xss risks.

Explore the androidmanifest.xml file to identify sensitive information, hardcoded keys, and dangerous permissions, and perform a hands-on demo inspecting an APK for SDK targets and exported components.

Explore the OWASP mobile top ten and compare the 2014 and 2016 versions to map M1 through M10 vulnerabilities and their relevance to mobile applications.

Shows insecure authentication, including leaked OTPs and weak password policies, enabling unauthorized access. Also explains insufficient cryptography with weak algorithms like md5 or sha-1 and insecure randomness in apps.

Explore the 2023 owasp mobile top ten draft, covering insecure authentication and authorization, insecure communication, supply chain risk, privacy controls, and other key mobile security threats.

Explore static analysis by decompiling and reverse engineering the APK, then review AndroidManifest.xml and strings.xml to spot debuggable settings, exported components, hardcoded keys, and other secrets.

Explore MobSF, an open-source mobile security framework that automates static and dynamic analysis for Android and iOS apps, supports Docker deployment, and provides downloadable PDF reports.

Discover Vigil, a free mobile security tool that scans Android apps for vulnerabilities, offering a security rating and the ability to view source code and hide third-party library vulnerabilities.

Explore Yazhini, a free, user-friendly Android and API vulnerability scanner, download from vagabond.com/yazhini, upload an APK, scan for high to informational vulnerabilities, and view remediation and reports.

Explore how shared preferences cause a static analysis vulnerability by storing app data in plain text and exposing usernames and passwords, demonstrated via a live analysis on a sample application.

Learn to install and connect Rosa, a mobile security testing framework, via Docker or native installs, deploy the Rosa Agent, and run basic commands to interact with Android devices.

Frida and Objection teach you to install a dynamic code instrumentation toolkit to inject JavaScript into native apps and bypass SSL pinning and root checks, all without jailbreaking or rooting.

Explore Frida code share and GitHub to download JavaScript snippets for Frida, including Android and iOS scripts on SSL pinning, route detection bypass, and Android crypto operations.

Bypassing root detection and emulator detection in android apps using Frida and freedom, by running root and emulator bypass scripts via adb for dynamic analysis.

Explore how Medusa enables dynamic analysis of Android apps and demonstrates bypassing root detection with anti-debug scripts.

Learn to bypass Android root detection with objection by hijacking the show route status class and forcing does exist to false for Insecure Bank Version two login.

Learn how to bypass SSL pinning by overwriting the packaged CA certificate with a custom CA cert, using APK Mitm to modify, patch, and repack the APK for interception.

Explore how to bypass fingerprint authentication in Android apps using Frida, by hooking fingerprint checks and converting false responses to true in an Insecure Bank demo.

Learn how to bypass root and ssl pinning in progressive web apps using Flutter tools, patch the Flutter library, sign the apk, and intercept traffic with a proxy.

Explore the Janus vulnerability and application signing on Android by inspecting Lime Road, extracting the APK, examining AndroidManifest.xml, and noting V1 signing as vulnerable on devices 5.0–8.0.

Examine real-world signs of insufficient cryptography through static analysis, highlighting CBC with PKCS5/PKCS7 padding vulnerable to padding oracle attacks, and the use of MD5 and SHA-1 as weak hashes.

This lecture shows how non parameterized raw SQL queries in Android apps using SQLite create injection risks, highlighting raw queries in multiple files and recommending preventive measures.

Identify and exploit pasteboard vulnerabilities in an Android app by monitoring the clipboard with Frida and Objection, showing how copied data including passwords can be intercepted.

Bypass fingerprint authentication on a live target with Frida, demonstrated using the App locker, and reveal a fingerprint bypass vulnerability.

Learn how an authentication bypass arises in a mobile app by manipulating response codes to log in with a fake OTP, exposing victims' addresses and contact details.

demonstrate a business logic vulnerability where client-side validation is bypassed after ssl and route checks, enabling adding a fourth mobile number and forging a custom toyota id.

Learn to use nuclei mobile templates to automate vulnerability discovery in Android apps, including APK decompilation with Apktool, and detecting issues in manifest, WebView, and API keys.

Android pentesting reports simplify vulnerability reporting with seven to eight templates, featuring steps to reproduce, proof of concept, and severity updates aligned with OWASP, including exported components and bypass techniques.

Find and report Android app vulnerabilities ethically by navigating bug bounty programs on HackerOne and Bugcrowd, and Google Play Security Reward Programs for apps with 100 million+ downloads.