Mobile Pentesting: A Comprehensive Guide

Mobile applications are integral to our daily lives, but they also present significant security risks. This guide covers the essential tools, techniques, and methodologies for pentesting Android apps.

1. Lab Setup: Tools and Installation

Android Debug Bridge (ADB)

ADB facilitates communication with Android devices for debugging and interaction.

Steps to Set Up ADB:

1. Install ADB (on Linux):

sudo apt install adb 

2. Connect a device via USB:

• Enable Developer Options (tap “Build Number” 7 times).
• Enable USB Debugging under Developer Options.
• Verify device connectivity:

adb devices  

3. Connect over the network:

adb tcpip 5555  
adb connect DEVICE_IP_ADDRESS:5555  
adb shell

JADX-GUI

A decompiler for APKs to analyze source code.

• Install: Download from the JADX GitHub Releases.
• Usage: Open the APK in the GUI to explore its Java source code.

Apktool

A tool for reverse engineering Android APKs.

• Install:

sudo apt install apktool

• Commands:

Decompile APK:

apktool d app.apk

Recompile APK:

apktool b folder_name -o new_app.apk

Frida

A dynamic instrumentation toolkit for mobile apps.

Setup:

1. Download the Frida server for your device architecture from Frida Releases.
2. Push it to the device:

adb push frida-server /data/local/tmp/  
adb shell chmod +x /data/local/tmp/frida-server  
adb shell ./data/local/tmp/frida-server &

3. List running processes:

frida-ps -U

Objection

A runtime mobile exploration toolkit.

• Install:

pip3 install objection

• Usage:

objection explore

MobSF (Mobile Security Framework)

An automated static and dynamic analysis tool.

Setup:

docker pull opensecurity/mobile-security-framework-mobsf  
docker run -it --rm -p 8000:8000 opensecurity/mobile-security-framework-mobsf:latest

Access it at [http://127.0.0.1:8000.](http://127.0.0.1:8000.)

Drozer

A dynamic Android app testing framework.

Setup:

docker pull fsecurelabs/drozer  
adb forward tcp:31415 tcp:31415  
docker run -it fsecurelabs/drozer  
drozer console connect --server <device IP>

2. Reconnaissance

Gathering App Information

• Find package details:

run app.package.list -f keyword

• Check app info

run app.package.info -a com.example.app

• Identify exposed components:

run app.package.attacksurface com.example.app

Permissions and Components

• Review permissions in AndroidManifest.xml using Apktool or MobSF.
• Identify exported activities, services, and content providers:

run app.activity.info -a com.example.app  
run app.service.info -a com.example.app  
run app.provider.info -a com.example.app

3. Static Analysis

APK Structure Overview

• AndroidManifest.xml: Permissions, activities, and intent filters.
• classes.dex: Compiled Java code in DEX format.
• lib/: Native libraries for different architectures.
• assets/: Runtime-accessible raw files.
• META-INF/: Metadata and APK signatures.

Common Static Analysis Tools

• JADX-GUI: View Java source code.
• Apktool: Decompile and recompile APKs.
• MobSF: Automated analysis to uncover vulnerabilities and hardcoded values (e.g., API keys).

Identifying Hardcoded Strings

Search for sensitive data, such as API keys, URLs, and credentials, in strings.xml or source code.

4. Dynamic Analysis

Traffic Interception

• Use Burp Suite to intercept HTTP/HTTPS traffic.
• SSL Pinning Bypass:
• With Objection:

android sslpinning disable

• With Frida:

frida -U -n com.example.app -e "console.log('Bypassing SSL Pinning');"

Root Detection Bypass

• Objection:

android root disable

• Frida:

frida -U -n com.example.app -e "console.log('Root check bypassed');"

Activity and Component Interaction

• Launch exported activities:

run app.activity.start --component com.example.app com.example.app.ActivityName

• Test broadcast receivers:

run app.broadcast.send --component com.example.app com.example.app.BroadcastReceiver

5. Vulnerability Scanning with Drozer

1. Start the Drozer agent on the device.
2. Open a network connection to the console:

adb forward tcp:31415 tcp:31415  
drozer console connect

3. List packages:

run app.package.list

4. Check exported activities, services, and providers:

run app.activity.info -a com.example.app  
run app.service.info -a com.example.app  
run app.provider.info -a com.example.app

This entire document was crafted by Mr. Srinath Karli. Lead Penetration Tester Cipher Legion Pvt. Ltd. Pune, Maharashtra.

🔓Follow our LinkedIn: https://www.linkedin.com/company/cipherlegion/ 🎯Follow our Website: https://cipherlegion.com/