> For the complete documentation index, see [llms.txt](https://hackermater.gitbook.io/pentesting-notes/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://hackermater.gitbook.io/pentesting-notes/mobile-pentesting/mobile-application-security/android/static-analysis.md). # Static Analysis Quick reference for the initial static analysis of an Android application. ### Quick workflow ```bash adb shell pm path adb pull ./base.apk apktool d base.apk -o apktool_output jadx -d jadx_output base.apk # or jadx-gui base.apk ``` Use both **JADX** and **Apktool**: JADX for reconstructed Java/Kotlin and cross-references; Apktool for decoded resources, Manifest, and smali. ### APK structure ```bash unzip app.apk -d apk_raw find apk_raw -maxdepth 2 -type f | sort ``` | File / directory | What to inspect | | --------------------- | ----------------------------------------------- | | `AndroidManifest.xml` | Components, permissions, app configuration | | `classes*.dex` | Application bytecode | | `lib/` | Native libraries / architectures | | `assets/` | Configs, databases, certificates, bundled files | | `res/` | Application resources | | `resources.arsc` | Compiled resources / strings | ### Manifest triage ```bash grep -n "]+' jadx_output | sort -u grep -RniE 'baseUrl|BASE_URL|apiUrl|endpoint|graphql|swagger|openapi' jadx_output ``` ### Secrets / sensitive strings ```bash grep -RniE 'api[_-]?key|secret|token|password|authorization|bearer|client[_-]?secret|private[_-]?key' jadx_output grep -RniE 'api[_-]?key|secret|token|password|client[_-]?secret' apktool_output ``` Validate whether a value is actually secret, active, privileged, and environment-specific. ### JADX search list ``` http:// https:// Authorization Bearer token password secret WebView setJavaScriptEnabled addJavascriptInterface loadUrl Cipher SecretKeySpec SharedPreferences SQLiteDatabase Intent getIntent Uri.parse ContentResolver ``` ### DEX / smali ```bash unzip -l app.apk | grep '\.dex$' grep -Rni 'interesting/string' apktool_output/smali* ``` If JADX output looks wrong or incomplete, verify the logic in smali. ### Native libraries ```bash find apktool_output/lib -type f file apktool_output/lib/*/*.so strings apktool_output/lib/*/*.so | grep -Ei 'http|token|secret|password|key|certificate|debug' ``` ### Useful ADB ```bash adb devices adb shell pm list packages | grep adb shell pm path adb shell dumpsys package adb install -r app.apk adb pull adb push adb logcat adb shell input tap adb shell screencap -p /sdcard/screen.png adb shell screenrecord /sdcard/demo.mp4 ``` ### Automated triage MobSF, TruffleHog, Nuclei, and similar tools are useful for leads, not final findings. ```bash trufflehog filesystem apktool_output/ ``` ### Static analysis checklist ``` [ ] Package name / version identified [ ] APK extracted and decoded [ ] Manifest reviewed [ ] Exported components mapped [ ] Deep links identified [ ] Provider authorities identified [ ] Permissions / app flags reviewed [ ] Network Security Config inspected [ ] API endpoints collected [ ] Hardcoded secrets searched [ ] Assets / raw resources reviewed [ ] Native libraries identified [ ] Interesting classes bookmarked [ ] Automated results manually reviewed [ ] Dynamic-testing hypotheses created ``` Static analysis should finish with **things to test**, not just scanner findings. ### References * * * *