Skip to content
Pwnversity

Android Pentesting

Android is the most open mobile platform and therefore the easiest to audit: apps ship as an APK (a ZIP with code compiled to DEX, resources, and the manifest), and with standard tools you can decompile them, read their code almost like the original, instrument them at runtime, and intercept their traffic. This card covers the Android-specific flow: getting the APK, static analysis, dynamic analysis, and the typical vectors.

The APK and its pieces

Section titled “The APK and its pieces”
APK = ZIP with:
  AndroidManifest.xml   permissions, components, deeplinks, exported, debuggable
  classes.dex           Dalvik bytecode (the app's code)
  resources.arsc / res/ resources, strings, layouts
  lib/                  native libraries (.so)
  assets/               embedded files (sometimes secrets/config)

Obtain the APK

Section titled “Obtain the APK”
# from the device (installed app)
adb shell pm list packages | grep target
adb shell pm path com.target.app        # APK path
adb pull /data/app/.../base.apk
# or download it from a store/mirror (APKPure, etc.)

Static analysis

Section titled “Static analysis”
# decompile to smali + readable resources
apktool d base.apk                       # manifest and smali
# DEX -> Java (comfortable reading)
jadx-gui base.apk                        # Java decompiler
d2j-dex2jar base.apk ; jd-gui            # alternative
# all automated
mobsf                                     # static+dynamic analysis with report

What to review:

AndroidManifest.xml
android:debuggable="true"                # debuggable app -> extract data easily
android:allowBackup="true"               # extractable backup (adb backup)
<activity ... android:exported="true">   # components reachable by other apps
<data android:scheme="...">              # deeplinks (see mob-deeplinks)
# secrets in code/resources/assets
grep -riE 'api_key|secret|password|BEGIN RSA|http' ./  # keys, endpoints
strings lib/*/*.so                       # secrets in native code

Dynamic environment

Section titled “Dynamic environment”
# emulator or rooted device
adb devices ; adb shell
# proxy to intercept traffic (see mob-ssl)
# set Burp as proxy + install its CA
# runtime instrumentation
frida / objection (see mob-frida)        # hooking, pinning/root-detection bypass

Typical attack vectors

Section titled “Typical attack vectors”
# exported components (Activities, Services, Content Providers, Broadcast Receivers)
adb shell am start -n com.target/.AdminActivity   # launch an exported activity
adb shell content query --uri content://com.target.provider/users   # Content Provider
# deeplinks (see mob-deeplinks)
adb shell am start -W -a android.intent.action.VIEW -d "targetapp://..."
# insecure storage (see mob-storage)
adb shell run-as com.target cat /data/data/com.target/shared_prefs/*.xml
# insecure WebViews: JavaScript enabled, addJavascriptInterface -> RCE/XSS in WebView
# backup: adb backup -f backup.ab com.target (if allowBackup=true)

Content Providers and IPC

Section titled “Content Providers and IPC”

Exported components are a key surface: an Activity/Service/Provider/Receiver with exported="true" (or with an intent-filter) can be invoked by any other app (or by adb), bypassing UI controls.

# enumerate exported components (from the decompiled manifest)
# test SQL injection in Content Providers, path traversal, data access
drozer                                    # IPC/component analysis framework

For the defense

Section titled “For the defense”
  • Don’t hardcode secrets; debuggable=false, allowBackup=false in production.
  • Minimize exported components; protect the needed ones with permissions; validate all input (intents, Content Providers).
  • Encrypted storage (see Insecure Storage), TLS + pinning (SSL Pinning and Bypass).
  • Secure WebViews: no unnecessary addJavascriptInterface, don’t load untrusted content.
  • RESILIENCE protections (root/tamper/debug detection, obfuscation with R8/ProGuard) — raise the cost, don’t replace backend security.

Testing checklist

Section titled “Testing checklist”
  • Obtain the APK (adb pull / store)
  • Decompile (apktool/jadx) and review the manifest
  • debuggable/allowBackup/exported in the manifest
  • Secrets in code/resources/assets/.so
  • Exported components and IPC (drozer, am/content)
  • Deeplinks (Deeplinks and IPC)
  • Insecure storage (Insecure Storage)
  • Traffic + SSL pinning (SSL Pinning and Bypass); WebViews; backend

References

Section titled “References”