Hacking and Pentesting Android Applications

Explore the basics of Android applications, how they are developed, and the file and directory structure of an installed app demonstrated in an Android emulator.

Explore the apk file structure by unpacking an android app, revealing androidmanifest.xml, classes.dex, arias, resources.rc, and layout xmls, and understand how apk packaging works in android studio.

Learn to explore Android app storage on a device using an emulator and ADB, locate the APK in /data/app, and inspect per-app data in /data/data.

Set up a dedicated lab for Android application pentesting, explore common challenges and prerequisites, and configure environments on an emulator and a non-rooted real device.

Set up a proper lab to perform Android application pentesting by running apps on an emulator or rooted device to trace runtime, monitor traffic, and instrument the app.

Assess challenges of Android lab setup, focusing on rooted versus non-rooted devices. Unlock bootloaders or flash a custom ROM when possible, and rely on exploits if not, for lab control.

Set up an x86 android emulator, push Frida server, and install Objection to provide the Frida client for runtime analysis of apps.

Set up a lab on a non-rooted Android device to perform runtime tracing by patching the app with the Frida gadget using Objection, installing via ADB, and verifying the setup.

Explore fundamental pen testing concepts for Android applications, including reverse engineering tools, traffic analysis, insecure data storage, and client-side vulnerabilities. Build a foundation for advanced topics like runtime tracing.

Explore reverse engineering of Android applications using Apktool to disassemble, read AndroidManifest.xml, and patch apps for penetration testing, including understanding decompiled code and patching workflows.

Learn to reverse android apps by decompiling an apk with dex2jar and JD-GUI, converting classes.dex to a jar, and inspecting the decompiled Java source to explore business logic.

Explore intercepting https traffic from Android apps by bypassing root detection and ssl pinning. Use Burp proxy, install root certificates, and patch network security settings to capture https requests.

Expose insecure data storage in Android apps by storing tokens and bank details in shared preferences, SQLite, or internal/external storage, revealing clear text risks and potential authorization bypass.

Intercept mobile app traffic with burp suite to reveal server side vulnerabilities in backend APIs. Identify issues like sensitive data exposure in get requests, cleartext passwords, and pre-authentication SQL injection.

Explore client side vulnerabilities in Android applications, including authorization bypass, exported application components, insecure logging, client side SQL injection, and clipboard data exposure, using Secure Store v1.

Explore an authorization bypass in the secure store Android app by abusing insecure local token storage, MD5 token generation, and data leakage to impersonate other users.

Explore Android application components, including activities, services, broadcast receivers, and content providers, and how exported configurations and intent filters enable or block external access, including root versus non-root risks.

Identify insecure logging in Android apps and the risks of production debug logs exposing credentials. Learn how to prevent exposure by disabling debug logs and safeguarding logcat data.

Identify how sensitive data copied to the device clipboard can be read by other apps and test this by copying a sample account number to demonstrate the risk.

Explore advanced android pentesting using frieda to bypass route detection and ssl pinning, leverage objection, study end-to-end encryption, and dump encryption keys from secure store v2 for server-side attacks.

Identify common Android client side protections—obfuscation, root detection, SSL pinning, debugger detection, and end-to-end encryption—and learn practical bypass strategies during pentesting using Secure Store v2.

Discover frida, a tool for android pentesting, to bypass client side protections via runtime tracing and manipulation, with a shell and scripts to inspect classes, methods, arguments, and return values.

Learn to bypass root detection in Android apps using Objection and Frida. Explore writing custom filter scripts and practical backup methods on a Secure Store v2 app.

Revisit insecure local data storage by bypassing root detection and inspecting secure store v2, where bank details in a local sqlite database are encrypted with AES-256.

Identify and mitigate client-side SQL injection by enforcing parameterized queries, as encryption does not prevent vulnerabilities in secure store v2; decrypted data can be exposed during requests.

Revisit traffic analysis of the secure store v2 app by intercepting traffic, bypassing safeguards with frida and objection, and observing encrypted tokens and the potential for SQL injection.

Learn the Frida CLI basics for Android pentesting, including the Frida shell, writing custom Frida scripts, and checking the Java runtime and Android version before instrumentation.

Learn how Frida scripts inject JavaScript into a running Android app process to enable runtime tracing and manipulation via the V8 engine, with memory access, hooking, and native calls.

Develop a Frida script template in JavaScript that checks for a loaded Java VM with Java.available, attaches via Java.perform, and demonstrates error handling with use strict and console logs.

Load a class with Frida's Java.use, wrap it in a JavaScript wrapper, and dump property names to reveal encryption-related fields like hashCode and bytes to hex.

Explore how Frida scripts bypass root and route detection in android apps, contrasting objections with custom scripts to defeat the Secure Store V2 checks.

Use Frida to dump arguments of android methods by overload with java.lang.string types. Explore encrypt and decrypt functions in secure store v2 and observe the captured arguments.

Use a Frida script to trace Android WebView calls and capture the URLs loaded by WebView, such as about us or google.com, to analyze how the app loads content.

Explore how end-to-end encryption in mobile apps blocks traffic interception during a pentest, necessitating analysis of client and server keys and understanding of symmetric and asymmetric schemes.

Learn to dump an android app's encryption key with frida and objection, tracing the script class and bytes to hex, and assessing the sha-256 based key generation.

Intercept login and profile requests via a proxy to perform sql injection using the obtained encryption key, and craft payloads with server or frida scripts to encrypt and decrypt values.

Explore ssl pinning by comparing the server certificate with a bundled certificate or pinned public key, and examine burp proxy, system versus user certificates, and sdk 24 interception behavior.

Learn to bypass SSL pinning in android apps using Frida and objections, install Burp root certificate, and patch apps with scripts to intercept https traffic.

Resolve errors in the SSL pinning bypass script by removing the return false, reload, and run to confirm the fix. The final script now bypasses SSL pinning without errors.

Learn to bypass ssl pinning by patching android apps with apktool, modify smali code, sign the apk, and verify interception via burp during pentesting.

Complete this course and share your feedback to help us improve, and spread the word to friends and colleagues who are interested in hacking and pentesting android applications.