# Mobile Pentest

[![ko-fi](https://ko-fi.com/img/githubbutton_sm.svg)](https://ko-fi.com/Y8Y41FQ2GA)

## CheckList

{% embed url="<https://github.com/m14r41/PentestingEverything/tree/main/Mobile%20Pentesting/Android%20Pentesting>" %}

## Create a Lab for Android Pentest

{% embed url="<https://www.yeswehack.com/fr/learn-bug-bounty/android-lab-mobile-hacking-tools>" %}

### Emulator

{% hint style="danger" %}
*Genymotion is not compatible with last app running only on ARM devices. Create a AVD with Android Studio for this kind of apps*
{% endhint %}

{% embed url="<https://www.genymotion.com/>" %}

## Intercept traffic

{% embed url="<https://github.com/kaizensecurity/Intercept-Flutter-Apps>" %}

{% embed url="<https://github.com/ptswarm/reFlutter>" %}

## Dex2jar

{% embed url="<https://github.com/pxb1988/dex2jar>" %}

## MobSF

{% embed url="<https://github.com/MobSF/Mobile-Security-Framework-MobSF>" %}

## MARA

```
git clone https://github.com/xtiankisutsa/MARA_Framework.git
cd MARA_Framework
./mara.sh
```

#### Extracting the complete API attack surface <a href="#extracting-the-complete-api-attack-surface-35" id="extracting-the-complete-api-attack-surface-35"></a>

```
./mara.sh -s target.apk
```

## cSploit

{% embed url="<https://github.com/cSploit/android>" %}

## Apepe

{% embed url="<https://github.com/000pp/Apepe>" %}

## Apktool

{% embed url="<https://apktool.org/>" %}

```
# apktool d instant.apk
I: Using Apktool 2.7.0-dirty on instant.apk
I: Loading resource table...
I: Decoding AndroidManifest.xml with resources...
I: Loading resource table from file: /root/.local/share/apktool/framework/1.apk
I: Regular manifest package...
I: Decoding file-resources...
I: Decoding values */* XMLs...
I: Baksmaling classes.dex...
I: Copying assets and libs...
I: Copying unknown files...
I: Copying original files...
I: Copying META-INF/services directory

# ls instant
AndroidManifest.xml  assets  lib       original  smali
apktool.yml          kotlin  META-INF  res       unknown
```

Troubleshooting: "Could not decode"

```
$ apktool d --use-aapt2 app.apk
I: Using Apktool 2.7.0 on app.apk
I: Loading resource table...
I: Decoding AndroidManifest.xml with resources...
W: Could not decode attr value, using undecoded value instead: ns=android, name=versionCode, value=0x77e1502d
W: Could not decode attr value, using undecoded value instead: ns=android, name=versionName, value=0x00000023
<--SNIP-->

$ mkdir -p /tmp/apktool-framework

$ apktool d --use-aapt2 app.apk -frame-path /tmp/apktool-framework -f
I: Using Apktool 2.7.0 on app.apk
I: Loading resource table...
I: Decoding AndroidManifest.xml with resources...
I: Loading resource table from file: /tmp/apktool-framework/1.apk
I: Regular manifest package...
I: Decoding file-resources...
I: Decoding values */* XMLs...
I: Baksmaling classes.dex...
I: Baksmaling classes2.dex...
I: Baksmaling classes3.dex...
I: Copying assets and libs...
I: Copying unknown files...
I: Copying original files...
I: Copying META-INF/services directory
```

## Androguard

{% embed url="<https://github.com/androguard/androguard>" %}

## Drozer

{% embed url="<https://github.com/WithSecureLabs/drozer>" %}

{% embed url="<https://medium.com/@ayushkumar12021987/exploiting-android-activities-with-drozer-a-step-by-step-guide-ebc9b564758d>" %}

## Frida

{% embed url="<https://frida.re/docs/android/>" %}

## SSL-bypass

This Frida script bypasses root detection and SSL pinning in Android apps by blocking root checks, hiding root management tools, and overriding SSL/TLS trust settings to intercept encrypted traffic.

{% embed url="<https://github.com/0xCD4/SSL-bypass>" %}

## Automated URL extraction

```
git clone https://github.com/n0mi1k/apk2url
./apk2url.sh /path/to/target.apk
```

## APKLeaks

{% embed url="<https://github.com/dwisiswant0/apkleaks>" %}

## APKx

Find sensitive info (key, etc.)

{% embed url="<https://github.com/cyinnove/apkx>" %}

## Firebase checker

{% embed url="<https://github.com/Suryesh/Firebase_Checker>" %}

{% embed url="<https://www.intigriti.com/researchers/blog/hacking-tools/hacking-google-firebase-targets>" %}

## MobApp-Storage Inspector

A tool for inspecting and analyzing mobile application storage files.

{% embed url="<http://github.com/thecybersandeep/mobapp-storage-inspector>" %}

## PAPIMonitor

Monitor user-select APIs during the app execution.

{% embed url="<https://github.com/Dado1513/PAPIMonitor>" %}

## Code Analysis

{% content-ref url="code-analysis" %}
[code-analysis](https://0xss0rz.gitbook.io/0xss0rz/pentest/code-analysis)
{% endcontent-ref %}

### APKHunt

Static code analysis based on the OWASP MASVS framework

{% embed url="<https://github.com/Cyber-Buddy/APKHunt/>" %}

### Search for API Keys

{% embed url="<https://pwn.guide/free/forensics/re-android>" %}

Open the APK with JADX:

```
jadx-gui base.apk
```

**Search for API Keys**:

* Look for hardcoded strings, especially in files like `BuildConfig.java`, `Constants.java`, or any class that handles network requests.

## Common Vulnerabilities

#### Cleartext Communications

In Android applications before 7.0 (API level 24), cleartext traffic was allowed by default. The 7.0 release introduced the **Network Security Configuration** (**NSC**) feature, allowing developers to customize network security settings through a declarative XML file. It wasn't until the release of Android 9 (API level 28) that cleartext traffic was disabled by default.

&#x20;To use an NSC file, it must be declared in the application's AndroidManifest.xml file:

```plaintext
<manifest ... >
    <application
        android:networkSecurityConfig="@xml/network_security_config"
        ... >
        <!-- Place child elements of <application> element here. -->
    </application>
</manifest>
```

The res/xml/network\_security\_config.xml file must be manually created with the cleartextTrafficPermitted set to "false" to override the insecure default setting:

```plaintext
<base-config cleartextTrafficPermitted="false">
    <trust-anchors>
        <certificates src="system" />
    </trust-anchors>
</base-config>
```

### ZipSlip

{% embed url="<https://android-notebook.hanmajid.com/docs/security/security-risks/zip-path-traversal>" %}

## Resources

{% embed url="<https://github.com/vaib25vicky/awesome-mobile-security>" %}

{% embed url="<https://www.bugcrowd.com/blog/the-ultimate-beginners-guide-to-android-hacking/>" %}

{% embed url="<https://www.hackerone.com/blog/pentesting-android-mobile-applications>" %}

{% embed url="<https://www.yeswehack.com/fr/learn-bug-bounty/android-recon-bug-bounty-guide>" %}

***

## iOS Pentesting

{% embed url="<https://www.bugcrowd.com/blog/a-basic-guide-to-ios-testing/>" %}

### Jailbreak for iPhone 5s through iPhone X, iOS 12.0 and up

{% embed url="<https://checkra.in/>" %}

## Interesting Books

{% content-ref url="../interesting-books" %}
[interesting-books](https://0xss0rz.gitbook.io/0xss0rz/interesting-books)
{% endcontent-ref %}

{% hint style="info" %}
**Disclaimer**: As an Amazon Associate, I earn from qualifying purchases. This helps support this GitBook project at no extra cost to you.
{% endhint %}

* [**Learning Pentesting for Android Devices**](https://www.amazon.fr/dp/B00JAAW0ZY?tag=0xss0rz-21)\
  A practical guide to learning penetration testing for Android devices and applications

## Support this Gitbook

I hope it helps you as much as it has helped me. If you can support me in any way, I would deeply appreciate it.

[![ko-fi](https://ko-fi.com/img/githubbutton_sm.svg)](https://ko-fi.com/Y8Y41FQ2GA)

[![buymeacoffee](https://cdn.buymeacoffee.com/buttons/v2/default-yellow.png)](https://buymeacoffee.com/0xss0rz)


---

# Agent Instructions: Querying This Documentation

If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter:

```
GET https://0xss0rz.gitbook.io/0xss0rz/pentest/mobile-pentest.md?ask=<question>
```

The question should be specific, self-contained, and written in natural language.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.