Android Pentesting 101

Set up the Mobexler environment for Android and iOS pentesting by installing Mobex flow in a VM, configuring Ubuntu, and exploring bundled tools like Burp Suite, Ghidra, Grapefruit, and FileZilla.

Explore Android emulators that replicate device hardware to run apps on other systems, enabling penetration testing with Genymotion, Android Studio emulator, Bluestacks, and NOX Player.

Install and use the Android Studio emulator to run and test apps. Create a new project and manage devices via the device manager.

Install and configure the Nox player Android emulator for pentesting, connect to Wi-Fi, install apps, adjust orientation, and prepare a Windows setup for dynamic analysis.

Connect your Android device or emulator to BurpSuite as a proxy to capture and analyze requests. Install the certificate, configure proxy settings, and intercept http and https traffic.

Install diva, the insecure vulnerable android application, by downloading the apk from 0XR app and dragging it into Genymotion to tackle its 13 challenges.

Introduce android applications by detailing native, web, and hybrid types, explaining webview usage, and outlining testing with emulators while previewing progressive web apps built with Flutter and React Native.

Explore the Android architecture stack—from applications to the application framework, Android runtime, and Linux kernel—and learn how Dalvik VM, Zygote, and platform libraries empower apps.

Explore Android components such as activities, services, broadcast receivers, and content providers, with examples like notifications and background data handling, and cross-app data sharing.

Explore the Android file system, a Linux-based structure with boot, system, data, and cache folders, accessed via ADB shell as root, and clear-text credentials in shared preferences.

Explore Android data storage options, including shared preferences, SQLite, file storage, content providers, and cloud storage, with notes on encryption, sensitivity, and best usage cautions.

Learn to transfer files from an Android device to a PC using ADB pull. Specify the source path and destination, ensuring the file moves from device to PC.

Discover two methods to obtain apks—apk extractor app or third-party store—and pull the file to your PC with ADB for static analysis.

Learn how to decompile Android apps using Jade GUI by dragging and dropping an APK, then view the source code and resources like AndroidManifest.xml and strings.xml.

Discover how an apk, a zipped java or kotlin package, can be unpacked or decoded to dex, jar, or smali code, then recompiled and signed.

Smali is the human-readable form of the dex bytecode used by the Dalvik VM. It serves as an assembly-like language for dex code, enabling understanding and working with Android instructions.

Explore how android web views embed web content, and compare web view client and web chrome client for javascript execution and xss risks.

Explore the androidmanifest.xml file to identify sensitive information, hardcoded keys, and dangerous permissions, and perform a hands-on demo inspecting an APK for SDK targets and exported components.

Explore the OWASP mobile top ten and compare the 2014 and 2016 versions to map M1 through M10 vulnerabilities and their relevance to mobile applications.

Explore insecure data storage vulnerabilities in Android apps by demonstrating how credentials stored in shared preferences and plain text can be read via ADB shell, highlighting on-device data stores.

Shows insecure authentication, including leaked OTPs and weak password policies, enabling unauthorized access. Also explains insufficient cryptography with weak algorithms like md5 or sha-1 and insecure randomness in apps.

Explore the 2023 owasp mobile top ten draft, covering insecure authentication and authorization, insecure communication, supply chain risk, privacy controls, and other key mobile security threats.

Explore static analysis by decompiling and reverse engineering the APK, then review AndroidManifest.xml and strings.xml to spot debuggable settings, exported components, hardcoded keys, and other secrets.

Explore MobSF, an open-source mobile security framework that automates static and dynamic analysis for Android and iOS apps, supports Docker deployment, and provides downloadable PDF reports.

Discover Vigil, a free mobile security tool that scans Android apps for vulnerabilities, offering a security rating and the ability to view source code and hide third-party library vulnerabilities.

Explore Yazhini, a free, user-friendly Android and API vulnerability scanner, download from vagabond.com/yazhini, upload an APK, scan for high to informational vulnerabilities, and view remediation and reports.

Explore how shared preferences cause a static analysis vulnerability by storing app data in plain text and exposing usernames and passwords, demonstrated via a live analysis on a sample application.

Learn to use ADB Logcat to view device logs, identify insecure logging, and grep for sensitive data such as credentials and credit card numbers.

Learn to filter Android logs by package with pidcat, a python-based script; install via git clone or brew, and run with the package name to display app-specific logs.

Identify hard coded credentials in the app by inspecting source code and resources for secret keys, API tokens, strings.xml and Google Service Info.plist.

Learn to install and connect Rosa, a mobile security testing framework, via Docker or native installs, deploy the Rosa Agent, and run basic commands to interact with Android devices.

Discover how Android clipboard vulnerabilities allow data leakage by monitoring copied content with objection, demonstrating insecure login and sensitive data like passwords and credit cards, and how to report findings.

Explore hotpatching and enforced updating, where apps are remotely patched to the latest version without resubmission. WhatsApp is cited as an example of this low-level vulnerability in Android pentesting.

Explore webview vulnerabilities in Android apps, including xss via javascript, sql injection through insecure input validation, and reading internal files via file or data uri schemes.

Explore Android Debug Bridge (ADB) as a versatile command line tool to communicate with an attached Android device for debugging, including adb shell, adb pull, adb push, and adb logcat.

Frida and Objection teach you to install a dynamic code instrumentation toolkit to inject JavaScript into native apps and bypass SSL pinning and root checks, all without jailbreaking or rooting.

Explore Frida code share and GitHub to download JavaScript snippets for Frida, including Android and iOS scripts on SSL pinning, route detection bypass, and Android crypto operations.

Bypassing root detection and emulator detection in android apps using Frida and freedom, by running root and emulator bypass scripts via adb for dynamic analysis.

Explore how Medusa enables dynamic analysis of Android apps and demonstrates bypassing root detection with anti-debug scripts.

Learn to bypass Android root detection with objection by hijacking the show route status class and forcing does exist to false for Insecure Bank Version two login.

Develop practical skills to bypass ssl pinning in android apps using frida, hooking ssl pinning scripts, and capturing requests with burp suite to analyze https traffic.

Learn how to bypass SSL pinning in Android apps using objection, identifying the app bundle identifier, and verifying bypass with Burp Suite to intercept HTTPS requests.

Learn how to bypass SSL pinning by overwriting the packaged CA certificate with a custom CA cert, using APK Mitm to modify, patch, and repack the APK for interception.

Explore how to bypass fingerprint authentication in Android apps using Frida, by hooking fingerprint checks and converting false responses to true in an Insecure Bank demo.

Learn how to bypass root and ssl pinning in progressive web apps using Flutter tools, patch the Flutter library, sign the apk, and intercept traffic with a proxy.

Explore the Janus vulnerability and application signing on Android by inspecting Lime Road, extracting the APK, examining AndroidManifest.xml, and noting V1 signing as vulnerable on devices 5.0–8.0.

Explore how a live Android app's shared preferences can expose sensitive data, such as Firebase instance IDs, user tokens, and session IDs, via ADB access and XML inspection.

Examine real-world signs of insufficient cryptography through static analysis, highlighting CBC with PKCS5/PKCS7 padding vulnerable to padding oracle attacks, and the use of MD5 and SHA-1 as weak hashes.

This lecture shows how non parameterized raw SQL queries in Android apps using SQLite create injection risks, highlighting raw queries in multiple files and recommending preventive measures.

Identify and exploit pasteboard vulnerabilities in an Android app by monitoring the clipboard with Frida and Objection, showing how copied data including passwords can be intercepted.

Demonstrate exploiting Android screenshot and background screen caching vulnerabilities using Objection to capture and save a screenshot from a target app, then report findings to the app owner.

Learn to bypass root detection and ssl pinning on a live target app using proxy setup, Frida scripts, and adb techniques to observe and capture network traffic.

Bypass fingerprint authentication on a live target with Frida, demonstrated using the App locker, and reveal a fingerprint bypass vulnerability.

Learn how an authentication bypass arises in a mobile app by manipulating response codes to log in with a fake OTP, exposing victims' addresses and contact details.

demonstrate a business logic vulnerability where client-side validation is bypassed after ssl and route checks, enabling adding a fourth mobile number and forging a custom toyota id.

Explore an Android pentesting mind map that covers static and dynamic analysis, including ecosystem checks and sensitive strings. Learn tools like ADB, Apktool, Frida, and Burp Suite to support testing.

Learn to use nuclei mobile templates to automate vulnerability discovery in Android apps, including APK decompilation with Apktool, and detecting issues in manifest, WebView, and API keys.

Android pentesting reports simplify vulnerability reporting with seven to eight templates, featuring steps to reproduce, proof of concept, and severity updates aligned with OWASP, including exported components and bypass techniques.

Learn to use objection and frida on a non-rooted Android device without rooting by patching an APK, injecting the Frida gadget, and testing clipboard vulnerabilities with requests and UI screenshots.

Find and report Android app vulnerabilities ethically by navigating bug bounty programs on HackerOne and Bugcrowd, and Google Play Security Reward Programs for apps with 100 million+ downloads.