Android App Security: Step-by-Step Penetration Testing Tutorial Part-3

We will cover a few of the basic tools commonly used during testing. This blog will be updated with additional tools as tutorials for other topics are added.

Disclaimer This blog post is intended for educational and ethical purposes only. The techniques and tools discussed here are meant to help developers, security professionals, and enthusiasts understand Android application vulnerabilities in a legal and responsible manner.

Credits The vulnerable Android application used in this demonstration, Bug Bazar, was created and is maintained by Payatu. Full credit goes to the developers for providing this educational resource.

You can find more details and access the official repository here: https://github.com/payatu/BugBazar

The intentionally vulnerable applications discussed in this post, Piva and InsecureBank 2, are created and maintained by their respective developers. Full credit goes to the developers for providing these valuable educational resources to help individuals learn about common security vulnerabilities.

You can find more details and access the official repositories here:

Piva: https://github.com/HTBridge/pivaa

InsecureBank 2: https://github.com/dineshshetty/Android-InsecureBankv2

ADB

First, we will start with getting package name of the app that we are testing, due to multiple application, we need to provide app name that we want to interact

Command: adb shell pm list packages

pm: package manager

tip: if you want to search specific package name then pipe it with grep

adb shell pm list packages | grep application name

Once we get the package name, we will first check the apps data, so for that there is specific folder called data/data that store mostly private data.

Command: adb shell run-as-package name cp -r /data/data/package-name /storage (you can use any folder in the device it doesn't matter)

What is Run As? It is used to interact with a specific application that we provide, and it functions only when debugging is enabled. Root access is not required for interaction in this case. However, when attempting to use it for tasks such as copying a protected folder, it will not allow the operation.

tip: always go with storage folder or sdcard it will make life easy😁

you may wonder why it is showing permission denied, guess what root access required to access that folder, run as might not work for few folders, so we need manually copy it by using root.

still, we use ls or say logcat option to dump logs combined with run-as.

Now let's with few recons using android, first will collect information of devices and all activity.

Command: adb shell dumpsys activity

Command: adb shell dumpsys package

Command: adb shell dumpsys package (package Name)

Command: abb shell pm path (package Name)

Command: adb logcat (to view logs real time)

Let's move on basic things we do commonly in adb.

1. adb push (file in local system) (remote destination)
2. adb pull (Remote file) (Path to save)
3. adb shell (command to run on the devices)

Will end with adb connect, in case of longer testing we can use this method.

1. Ensure your system and Android device are connected via USB and on the same Wi-Fi network.
2. Obtain the IP address of the Android device (navigate to the Wi-Fi settings to check the IP manually if needed).
3. Use the command adb connect IP: Port to establish the connection

JADX

We need to covert our Dex files to read for jar, so that we can decompile and read that code.

command: d2-dex2jar APK

Now open the jar file with jd-gui jarfile.

these files are only opened using jd-gui because it converted the dex files to java files, let say if you want to read dex or apk file then we can use another tool called JADX-GUI.

the code we read above will be similar even without obfuscation, but won't be exact source code

Sqlite3

This tool is used to read db files that are found in the apk files.

Command: sqlit3 db_file

MoboSF

URL: https://mobsf.live/

Installation Step on system (Prerequisites Docker)

1. docker pull opensecurity/mobile-security-framework-mobsf:latest
2. docker run -it — rm -p 8000:8000 opensecurity/mobile-security-framework-mobsf:latest

OAT Files

In case of any .oat files found in the extracted file; these are basically results of Ahead-of-Time (AOT).

The idea is converting these files to dex for reverse engineering.

Github: https://github.com/testwhat/SmaliEx

Dex files

Instead of directly using dex2jar on the apk, we can use it on individual files, there we instance were the app decompiled directly were not opening so better individually during those time.

Command: d2j-dex2jar file

Rabin2

After going through the application and test, we can dump files and analyze it using with regular expressions.

Command: adb exec-out run-as package tar -cf — . > filename.tar

Command: rabin2 -zzz -q File | grep -Pi ‘regular expression’.

Androguard

GitHub: https://github.com/androguard/androguard

This tool helps us in static and reverse engineering.

androguard analyze (APK File).

Note: One thing I observed in this tool, in some case the task takes a long time, the screen might freeze if you have given less resource to your VM. If this happens, consider closing it and rerunning the task.

Feedback

Thank you for reading! If you feel any information is missing or unclear, or if you think more details or examples should be added, please share your thoughts. Your feedback is crucial for improving the content and ensuring it’s as informative and useful as possible.