Go to main WebsiteLinkedIn

Static Analysis

AndroidManifest.xml

  • AndroidManifest.xml of an example app:

<?xml version="1.0" encoding="utf-8" standalone="no"?>
<manifest xmlns:android="http://schemas.android.com/apk/res/android"
    <!-- The package name, which is the unique identifier for the app in the Android ecosystem. -->
    package="com.example.app"

    <!-- The version of the Android SDK used to compile the app. -->
    android:compileSdkVersion="34"

    <!-- The codename for the compile SDK version (e.g., "14" for Android 14). -->
    android:compileSdkVersionCodename="14"

    <!-- The internal version code of the platform used to build the app. -->
    platformBuildVersionCode="34"

    <!-- The version name of the platform used to build the app, corresponding to the codename of the Android version. -->
    platformBuildVersionName="14">

    <!-- Permissions required by the app -->
    <uses-permission android:name="android.permission.INTERNET" />
    <uses-permission android:name="android.permission.ACCESS_FINE_LOCATION" />
    <uses-permission android:name="android.permission.READ_EXTERNAL_STORAGE" />

    <!-- Declaring minimum and target SDK versions -->
    <uses-sdk android:minSdkVersion="29" android:targetSdkVersion="34" />

    <!-- Declaring features required by the app -->
    <uses-feature android:name="android.hardware.camera" android:required="true" />
    <uses-feature android:name="android.hardware.location.gps" android:required="false" />

    <!-- Main application block -->
    <application
        android:allowBackup="true"
        android:icon="@mipmap/ic_launcher"
        android:label="@string/app_name"
        android:networkSecurityConfig="@xml/network_security_config"
        android:theme="@style/AppTheme">

        <!-- Main launcher activity -->
        <activity android:name=".MainActivity">
            <intent-filter>
                <action android:name="android.intent.action.MAIN" />
                <category android:name="android.intent.category.LAUNCHER" />
            </intent-filter>
        </activity>

        <!-- Another activity with an intent filter -->
        <activity android:name=".DeepLinkActivity"
            android:exported="true">
            <intent-filter>
                <action android:name="android.intent.action.VIEW" />
                <category android:name="android.intent.category.DEFAULT" />
                <category android:name="android.intent.category.BROWSABLE" />
                <data android:scheme="https" android:host="www.example.com" android:pathPrefix="/deeplink" />
            </intent-filter>
        </activity>

        <!-- Service example -->
        <service android:name=".MyService"
            android:enabled="true"
            android:exported="false">
        </service>

        <!-- Broadcast receiver example -->
        <receiver android:name=".MyBroadcastReceiver"
            android:exported="true">
            <intent-filter>
                <action android:name="android.intent.action.BOOT_COMPLETED" />
            </intent-filter>
        </receiver>

        <!-- Content provider example -->
        <provider
            android:name=".MyContentProvider"
            android:authorities="com.example.app.provider"
            android:enabled="true"
            android:exported="true" />

        <!-- Meta-data example -->
        <meta-data
            android:name="com.google.android.geo.API_KEY"
            android:value="your_google_maps_api_key_here" />

    </application>
</manifest>

aapt utility

  • Dump all permissions

  • Dump all strings

  • Dump all intent-filters

NOTE: Make you sure file AndroidManifest.xml is in the same directory as you execute aapt when dump data from any AndroidManifest.xml.

  • Tip: Use grep command to find interesting strings like passwords, leaked tokens, URLs and endpoints, IP addresses, etc...

Getting the APK / APKS directly from the Google Play Store

  1. Download the App from the Google Play Store

  2. List the users present on the Android Device

  1. List the path/s for the APK / APKs (i.e.: base.apk, split_config.arm64_v8a.apk, etc...)

  1. Pull the APK / APKs from the Android Device through ADB shell with the following commands:

Decompiling APK

Use tools like JADX or APKTool to decompile the APK and analyze the source code.

With APKtool (decompiled files)

Decompiling without resources folder (faster method)

Unzip APK (original files)

Structure of an APK package when you unzip it

File/Folder
Description

assets

Pictures / Sounds / Certificates / External files

lib

Libraries (check to see if emulator "x86" is supported)

META-INF

Code Signature (signing)

res

App Icon

AndroidManifest.xml

Configuration file in binary format (not readable by unzipping an app)

classes.dex

Dalvik Bytecode of all classes

resources.arsc

Compiled resources (Strings / Color etc.)

Differences between Unzip and Decompiled APKs

Useful ADB commands

DEX Files

  • Use dex2jar to convert .dex files in .jar files.

  • Then analyze it with Jadx-gui

Using Nuclei to automate the proccess of finding endpoints and hidden information

  1. Extract APK with APKtool

  1. Run Nuclei and find secrets keys and vulnerabilities

  1. Run Nuclei with official Project Discovery templates

Extract Activities exported as "True"

  1. Extract APK with APKtool

  1. Extract with UNIX commands the Activities which are exported="true"

Finding Secrets in APKs with Trufflehog

  1. Extract APK with APKtool

  1. Run Trufflehog

MobSF (Mobile Security Security Framework)

  1. Quick installation:

  1. Upload the APK and then analyze the results

  2. Use MobSF to scan the source code and identify insecure coding practices, hardcoded credentials, insecure data storage, etc.

  3. After read the analysis, print a PDF Report and save it.

Ko-Fi

PreviousBug Bounty HuntingNextDynamic Analysis

Last updated

Was this helpful?