Static Analysis

Decompiling APK

Use tools like JADX or APKTool to decompile the APK and then analyze the source code.

With APKtool (decompiled files)

apktool d app.apk -o app_output_directory

Decompiling without resources folder (faster method)

apktool d -r app.apk -o app_output_directory

Unzip APK (original files)

unzip app.apk -d app_output_directory

Structure of an APK package when you unzip it

File/Folder	Description
assets	Pictures / Sounds / Certificates / External files
lib	Libraries (check to see if emulator "x86" is supported)
META-INF	Code Signature (signing)
res	App Icon
AndroidManifest.xml	Configuration file in binary format (not readable by unzipping an app)
classes.dex	Dalvik Bytecode of all classes
resources.arsc	Compiled resources (Strings / Color etc.)

Differences between Unzip and Decompiled APKs

# Unzip / Apktool
- "assets / assets"
- "com / unknown"
- "lib / lib"
- "META-INF / original"
- "res / res"
- "resources.arsc / res/values"
- "classes.dex / smali"
- "AndroidManifest.xml / AndroidManifest.xml"

Useful ADB commands

- "adb devices": 
 - "Show connected devices"
- "adb root": 
 - "Get a root shell - Works only on certain images. Example: LineageOS."
- "adb reboot bootloader": 
 - "Reboot the device into the boot loader mode"
- "adb shell install -r": 
 - "Install a new package (overwrite existing one)"
- "adb push <local> <remote>": 
 - "Upload a file from the laptop to the phone"
- "adb pull <remote> <local>": 
 - "Download a file from the phone to the laptop"
- "adb shell dumpsys iphonesybinfo": 
 - "Get the IMEI"
- "adb get-serialno": 
 - "Serial number of the device"
- "adb shell pm list features": 
 - "List the features of the smartphone"
- "adb shell screencap -p \"/Path/To/Save/Image.png\"": 
 - "Take a screenshot"
- "adb shell screen record \"/Path/CaptureRecord.mp4\"": 
 - "Capture a video of the device screen"
- "adb shell am start -W -c android.intent.category.HOME -a android.intent.action.MAIN": 
 - "Simulating pressing the Home Button"
- "adb shell am start|startservice|broadcast <INTENT>": 
 - "Start an Intent / service / broadcast receiver"
- "adb logcat": 
 - "System log information"
- "adb bugreport": 
 - "Dump the whole device information like dumpstate, dumpsys and logcat output. Important to get the Bluetooth Low Energy log!"
- "adb backup": 
 - "Backup all applications that have the 'backup=true' in their Manifest.xml"
- "fastboot devices": 
 - "List available devices in fastboot mode"
- "adb shell pm reset-permissions -p your.app.package": 
 - "Resets all the permissions of an app"
- "adb shell pm path <package name>": 
 - "Shows the path to the APK which can be downloaded (see adb pull) even without root permissions."
- "adb input touch <x> <y>": 
 - "Perform a touch event at the given coordinates"

DEX Files

• Use dex2jar to convert .dex files in .jar files.

d2j-dex2jar classes.dex -o classes.jar

• Then analyze it with Jadx-gui

Using Nuclei to automate the proccess of finding endpoints and hidden information

1. Extract APK with APKtool

apktool d app.apk -o app_output_directory

2. Run Nuclei and find secrets keys and vulnerabilities

echo app_output_directory/ | nuclei -t /path/to/nuclei-templates/files/keys
echo app_output_directory/ | nuclei -t /path/to/nuclei-templates/files/android

3. Run Nuclei with official Project Discovery templates

echo app_output_directory/ | nuclei -tags android,permissions,misconfig,storage,exposure,aws,amazon,azure,firebase

Extract Activities exported as "True"

1. Extract APK with APKtool

apktool d app.apk -o app_output_directory

2. Extract with UNIX commands the Activities which are exported="true"

cat app_output_directory/AndroidManifest.xml | grep 'exported="true"' | awk -F 'android:name=' '{print $2}' | cut -d '"' -f2 > Actvities_Exported_True.txt

Finding Secrets in APKs with Trufflehog

1. Extract APK with APKtool

apktool d app.apk -o app_output_directory

2. Run Trufflehog

docker run --rm -it -v "$PWD:/pwd" trufflesecurity/trufflehog:latest filesystem /path/to/app_output_directory/

MobSF (Mobile Security Security Framework)

1. Quick installation:

docker pull opensecurity/mobile-security-framework-mobsf:latest
docker run -it --rm -p 8000:8000 opensecurity/mobile-security-framework-mobsf:latest

2. Upload the APK and then analyze the results

3. Use MobSF to scan the source code and identify insecure coding practices, hardcoded credentials, insecure data storage, etc.

4. After read the analysis, print a PDF Report and save it.

---