# Mobile Pentest

[![ko-fi](https://ko-fi.com/img/githubbutton_sm.svg)](https://ko-fi.com/Y8Y41FQ2GA)

## CheckList

{% embed url="<https://github.com/m14r41/PentestingEverything/tree/main/Mobile%20Pentesting/Android%20Pentesting>" %}

## Create a Lab for Android Pentest

{% embed url="<https://www.yeswehack.com/fr/learn-bug-bounty/android-lab-mobile-hacking-tools>" %}

### Emulator

{% hint style="danger" %}
*Genymotion is not compatible with last app running only on ARM devices. Create a AVD with Android Studio for this kind of apps*
{% endhint %}

{% embed url="<https://www.genymotion.com/>" %}

## Intercept traffic

{% embed url="<https://github.com/kaizensecurity/Intercept-Flutter-Apps>" %}

{% embed url="<https://github.com/ptswarm/reFlutter>" %}

## Dex2jar

{% embed url="<https://github.com/pxb1988/dex2jar>" %}

## MobSF

{% embed url="<https://github.com/MobSF/Mobile-Security-Framework-MobSF>" %}

## MARA

```
git clone https://github.com/xtiankisutsa/MARA_Framework.git
cd MARA_Framework
./mara.sh
```

#### Extracting the complete API attack surface <a href="#extracting-the-complete-api-attack-surface-35" id="extracting-the-complete-api-attack-surface-35"></a>

```
./mara.sh -s target.apk
```

## cSploit

{% embed url="<https://github.com/cSploit/android>" %}

## Apepe

{% embed url="<https://github.com/000pp/Apepe>" %}

## Apktool

{% embed url="<https://apktool.org/>" %}

```
# apktool d instant.apk
I: Using Apktool 2.7.0-dirty on instant.apk
I: Loading resource table...
I: Decoding AndroidManifest.xml with resources...
I: Loading resource table from file: /root/.local/share/apktool/framework/1.apk
I: Regular manifest package...
I: Decoding file-resources...
I: Decoding values */* XMLs...
I: Baksmaling classes.dex...
I: Copying assets and libs...
I: Copying unknown files...
I: Copying original files...
I: Copying META-INF/services directory

# ls instant
AndroidManifest.xml  assets  lib       original  smali
apktool.yml          kotlin  META-INF  res       unknown
```

Troubleshooting: "Could not decode"

```
$ apktool d --use-aapt2 app.apk
I: Using Apktool 2.7.0 on app.apk
I: Loading resource table...
I: Decoding AndroidManifest.xml with resources...
W: Could not decode attr value, using undecoded value instead: ns=android, name=versionCode, value=0x77e1502d
W: Could not decode attr value, using undecoded value instead: ns=android, name=versionName, value=0x00000023
<--SNIP-->

$ mkdir -p /tmp/apktool-framework

$ apktool d --use-aapt2 app.apk -frame-path /tmp/apktool-framework -f
I: Using Apktool 2.7.0 on app.apk
I: Loading resource table...
I: Decoding AndroidManifest.xml with resources...
I: Loading resource table from file: /tmp/apktool-framework/1.apk
I: Regular manifest package...
I: Decoding file-resources...
I: Decoding values */* XMLs...
I: Baksmaling classes.dex...
I: Baksmaling classes2.dex...
I: Baksmaling classes3.dex...
I: Copying assets and libs...
I: Copying unknown files...
I: Copying original files...
I: Copying META-INF/services directory
```

## Androguard

{% embed url="<https://github.com/androguard/androguard>" %}

## Drozer

{% embed url="<https://github.com/WithSecureLabs/drozer>" %}

{% embed url="<https://medium.com/@ayushkumar12021987/exploiting-android-activities-with-drozer-a-step-by-step-guide-ebc9b564758d>" %}

## Frida

{% embed url="<https://frida.re/docs/android/>" %}

## SSL-bypass

This Frida script bypasses root detection and SSL pinning in Android apps by blocking root checks, hiding root management tools, and overriding SSL/TLS trust settings to intercept encrypted traffic.

{% embed url="<https://github.com/0xCD4/SSL-bypass>" %}

## Automated URL extraction

```
git clone https://github.com/n0mi1k/apk2url
./apk2url.sh /path/to/target.apk
```

## APKLeaks

{% embed url="<https://github.com/dwisiswant0/apkleaks>" %}

## APKx

Find sensitive info (key, etc.)

{% embed url="<https://github.com/cyinnove/apkx>" %}

## Firebase checker

{% embed url="<https://github.com/Suryesh/Firebase_Checker>" %}

{% embed url="<https://www.intigriti.com/researchers/blog/hacking-tools/hacking-google-firebase-targets>" %}

## MobApp-Storage Inspector

A tool for inspecting and analyzing mobile application storage files.

{% embed url="<http://github.com/thecybersandeep/mobapp-storage-inspector>" %}

## PAPIMonitor

Monitor user-select APIs during the app execution.

{% embed url="<https://github.com/Dado1513/PAPIMonitor>" %}

## Code Analysis

{% content-ref url="code-analysis" %}
[code-analysis](https://0xss0rz.gitbook.io/0xss0rz/pentest/code-analysis)
{% endcontent-ref %}

### APKHunt

Static code analysis based on the OWASP MASVS framework

{% embed url="<https://github.com/Cyber-Buddy/APKHunt/>" %}

### Search for API Keys

{% embed url="<https://pwn.guide/free/forensics/re-android>" %}

Open the APK with JADX:

```
jadx-gui base.apk
```

**Search for API Keys**:

* Look for hardcoded strings, especially in files like `BuildConfig.java`, `Constants.java`, or any class that handles network requests.

## Common Vulnerabilities

#### Cleartext Communications

In Android applications before 7.0 (API level 24), cleartext traffic was allowed by default. The 7.0 release introduced the **Network Security Configuration** (**NSC**) feature, allowing developers to customize network security settings through a declarative XML file. It wasn't until the release of Android 9 (API level 28) that cleartext traffic was disabled by default.

&#x20;To use an NSC file, it must be declared in the application's AndroidManifest.xml file:

```plaintext
<manifest ... >
    <application
        android:networkSecurityConfig="@xml/network_security_config"
        ... >
        <!-- Place child elements of <application> element here. -->
    </application>
</manifest>
```

The res/xml/network\_security\_config.xml file must be manually created with the cleartextTrafficPermitted set to "false" to override the insecure default setting:

```plaintext
<base-config cleartextTrafficPermitted="false">
    <trust-anchors>
        <certificates src="system" />
    </trust-anchors>
</base-config>
```

### ZipSlip

{% embed url="<https://android-notebook.hanmajid.com/docs/security/security-risks/zip-path-traversal>" %}

## Resources

{% embed url="<https://github.com/vaib25vicky/awesome-mobile-security>" %}

{% embed url="<https://www.bugcrowd.com/blog/the-ultimate-beginners-guide-to-android-hacking/>" %}

{% embed url="<https://www.hackerone.com/blog/pentesting-android-mobile-applications>" %}

{% embed url="<https://www.yeswehack.com/fr/learn-bug-bounty/android-recon-bug-bounty-guide>" %}

***

## iOS Pentesting

{% embed url="<https://www.bugcrowd.com/blog/a-basic-guide-to-ios-testing/>" %}

### Jailbreak for iPhone 5s through iPhone X, iOS 12.0 and up

{% embed url="<https://checkra.in/>" %}

## Interesting Books

{% content-ref url="../interesting-books" %}
[interesting-books](https://0xss0rz.gitbook.io/0xss0rz/interesting-books)
{% endcontent-ref %}

{% hint style="info" %}
**Disclaimer**: As an Amazon Associate, I earn from qualifying purchases. This helps support this GitBook project at no extra cost to you.
{% endhint %}

* [**Learning Pentesting for Android Devices**](https://www.amazon.fr/dp/B00JAAW0ZY?tag=0xss0rz-21)\
  A practical guide to learning penetration testing for Android devices and applications

## Support this Gitbook

I hope it helps you as much as it has helped me. If you can support me in any way, I would deeply appreciate it.

[![ko-fi](https://ko-fi.com/img/githubbutton_sm.svg)](https://ko-fi.com/Y8Y41FQ2GA)

[![buymeacoffee](https://cdn.buymeacoffee.com/buttons/v2/default-yellow.png)](https://buymeacoffee.com/0xss0rz)