| name | mobile-android-assessment |
| description | Assess an Android app (static + dynamic). Load when the target is an APK/AAB, a mobile bug-bounty scope, or "test the android app". Signals: .apk file, Java/Kotlin/Smali, AndroidManifest.xml, exported components, WebViews, hardcoded secrets, Frida/objection.
|
| domain | mobile |
| type | technique |
| stability | learning |
| modes | ["pentest","bugbounty"] |
| severity | high |
| owasp | ["M1:2024-Improper-Credential-Usage","M8:2024-Security-Misconfiguration"] |
| cwe | ["CWE-919"] |
| tools | ["jadx","apktool","frida","objection","mobsf","adb"] |
| schema_version | 1 |
Android app assessment
When it applies
You have an APK (or a device/emulator running the app) and program scope covers the mobile
client + its backend. Most impactful mobile bugs are really API bugs the app exposes, plus
local data/secret leaks.
Why it works
Client apps ship their logic and often their secrets. Decompilation reveals endpoints, keys,
and auth flows; exported components and WebViews expose attack surface; and the app trusts its
own device, so runtime instrumentation removes checks the server assumed were enforced.
Method
- Unpack & triage:
apktool d app.apk (resources/manifest) and jadx-gui app.apk
(readable Java). Read AndroidManifest.xml for exported=true activities/services/
receivers/providers, android:debuggable, custom URL schemes, and usesCleartextTraffic.
- Hunt secrets & endpoints: grep decompiled code +
res/ + strings.xml for API keys,
base URLs, firebase configs, tokens (grep -rniE "api[_-]?key|secret|https?://").
- Local storage review: after use, pull
/data/data/<pkg>/ (shared_prefs, sqlite, files)
for tokens/PII stored in cleartext.
- Dynamic: run under Frida/objection —
objection -g <pkg> explore to dump keystore,
bypass root/emulator checks, and hook methods. Proxy traffic (Burp) to test the backend.
- Exported components: invoke exported activities/providers via
adb shell am start/
content query to reach functionality without auth.
Gotchas
- Cleartext-secret finding needs impact — a key with no privilege is informational; tie it to an action.
- Cert pinning blocks proxying → see
mobile-cert-pinning-bypass before concluding "no traffic".
- The real bugs are usually server-side (BOLA/mass-assignment) reached via the app — proxy and test the API.
Verify success
A concrete impact: leaked working credential/endpoint, unauthenticated reach into an exported
component, or a backend bug proven through the app's traffic.
References
OWASP MASVS/MASTG; OWASP Mobile Top 10 (2024); jadx/objection docs.
