Android

1
# Install Genymotion
2
https://www.genymotion.com/
3

4
# Install VirtualBox
5
https://www.virtualbox.org/wiki/Downloads

1
# Install gmsaas
2
pip install gmsaas
3

4
# Android SDK setup
5
https://developer.android.com/tools/releases/platform-tools
6

7
# Copy and extract the platform-tools zip, then point gmsaas at the SDK
8
gmsaas config set android-sdk-path C:\Users\user\AndroidPlatformTools\platform-tools
9

10
# In Windows Terminal add adb to your PATH (temporary - make it permanent if you want)
11
$env:PATH += ";C:\Users\user\AndroidPlatformTools"
12

13
# Login to gmsaas
14
gmsaas auth login [email protected]       # Enter password at prompt
15

16
# Start a virtual device from the Genymotion GUI
17
https://cloud.geny.io/launchpad
18

19
# Start a virtual device from the Genymotion CLI
20
gmsaas recipes list
21
gmsaas instances start <RECIPE-UUID> 'Example Test Phone Android 13' --no-wait --max-run-duration 30
22

23
# Connect to the virtual device using ADB
24
gmsaas instances list
25
gmsaas instances adbconnect <INSTANCE-UUID>

1
# Export the Burp certificate
2
openssl x509 -inform DER -in Burp_cert.cer -out Burp_cert.pem
3
openssl x509 -inform PEM -subject_hash_old -in Burp_cert.pem | head -1
4
mv Burp_cert.pem 9a5ba575.0
5

6
# Remount the system partition
7
adb remount
8

9
# Upload the certificate
10
adb push C:\Users\user\Downloads\9a5ba575.0 /system/etc/security/cacerts/
11

12
# If you get a "system is read-only" error use:
13
adb shell
14
mount -o rw,remount /system
15

16
# If still not working, use the below first
17
mount -o rw,remount /
18

19
# Once done
20
mount -o ro,remount /
21
# Change the certificate rights
22

23
adb shell chmod 664 /system/etc/security/cacerts/9a5ba575.0
24
adb reboot

1
# Install APK
2
adb install 'C:\path\to\example.apk'
3

4
# Proxy to Burp
5
adb shell settings put global http_proxy localhost:3333
6
adb reverse tcp:3333 tcp:8080
7

8
adb shell settings put global http_proxy :0    # Disable proxy
9

10
# Proxy multiple instances to Burp
11
gmsaas instances list
12
gmsaas instances adbconnect <INSTANCE-UUID-1>
13
adb -s localhost:33819 shell settings put global http_proxy localhost:3333
14
adb -s localhost:33819 reverse tcp:3333 tcp:8080
15

16
gmsaas instances adbconnect <INSTANCE-UUID-2>
17
adb -s localhost:41549 shell settings put global http_proxy localhost:4444
18
adb -s localhost:41549 reverse tcp:4444 tcp:8080
19

20
# If not root on the emulator
21
adb shell
22
setprop persist.sys.root_access 3
23
gmsaas instances adbconnect <INSTANCE-UUID>
24
adb shell
25
su

1
# The virtual device you add in Genymotion must be Android 8.0 (e.g. the Pixel 2, Android 8.0)
2

3
# Step 1: Download v8.0 from https://github.com/m9rco/Genymotion_ARM_Translation
4
# Step 2: Open an administrative CMD and cd to C:\Program Files\Genymobile\Genymotion\tools
5
# Step 3: Push the zip to the device
6
adb push C:\Users\user\Downloads\Genymotion-ARM-Translation_for_8.0.zip /sdcard/Download
7

8
# Step 4: Open an adb shell
9
adb shell
10

11
# Step 5: Flash the archive
12
sh /system/bin/flash-archive.sh /sdcard/Download/Genymotion-ARM-Translation_for_8.0.zip
13

14
# Step 6: Exit the adb shell and reboot (also close Genymotion and re-open)
15
adb reboot
16

17
# Step 7: Install GApps

1
# Install Android Studio
2
https://developer.android.com/studio
3

4
# Create a virtual device
5
# 1. Open Android Studio
6
# 2. Click More Actions --> Virtual Device Manager
7
# 3. Choose a device (a Pixel 3XL without Google Play keeps the device rooted)
8
# 4. Choose a system image (e.g. API 29 x86 Android 10 with Google APIs - needed if the app talks to Firebase etc.)
9

10
# Make the system partition mountable
11
cd C:\Users\user\AppData\Local\Android\Sdk\emulator
12
.\emulator.exe -writable-system -no-snapshot-load -avd Example -gpu host
13

14
# In another terminal while the above is running:
15
cd C:\Users\user\AppData\Local\Android\Sdk\platform-tools
16
.\adb.exe root
17
.\adb.exe shell avbctl disable-verification
18
.\adb.exe reboot   #Wait for this to complete - the emulator will look frozen
19
.\adb.exe root
20
.\adb.exe remount

1
# First on the machine running Burp
2
# 1. Proxy tab --> Options --> Import/export CA certificate --> Certificate in DER format --> save as burp.der
3
openssl x509 -inform DER -in burp.der -out burp.pem
4
openssl x509 -inform PEM -subject_hash_old -in burp.pem | head -1
5
mv burp.pem 9a5ba575.0
6

7
# Copy 9a5ba575.0 to the machine running the emulator
8

9
# On the emulator machine
10
.\adb.exe push C:\Users\user\Downloads\9a5ba575.0 /sdcard/
11
.\adb.exe shell
12
mv /sdcard/9a5ba575.0 /system/etc/security/cacerts/
13
chmod 644 /system/etc/security/cacerts/9a5ba575.0
14

15
# Run the AVD with the internal laptop webcam enabled
16
cd C:\Users\user\AppData\Local\Android\Sdk\emulator
17
.\emulator.exe -writable-system -no-snapshot-load -camera-front webcam0 -avd Example -gpu host

1
adb devices

1
adb install
2
adb install 'C:\path\to\example.apk'

1
adb install-multiple 'C:\path\to\com.example.app-base.apk' 'C:\path\to\com.example.app-split_config.en.apk' 'C:\path\to\com.example.app-split_config.x86.apk' 'C:\path\to\com.example.app-split_config.xxhdpi.apk'

1
adb shell
2
getprop ro.product.cpu.abi

1
# In Burp
2
# Proxy tab --> Options --> Import/export CA certificate --> Certificate in DER format --> save as burp.der
3

4
# On the machine with Burp
5
openssl x509 -inform DER -in burp.der -out burp.pem
6
openssl x509 -inform PEM -subject_hash_old -in burp.pem | head -1
7

8
# 9a5ba575
9
mv burp.pem 9a5ba575.0
10

11
# On Windows
12
adb push 9a5ba575.0 /sdcard/
13
adb shell
14
mv /sdcard/9a5ba575.0 /system/etc/security/cacerts/
15
chmod 644 /system/etc/security/cacerts/9a5ba575.0
16

17
# If you get a "system is read-only" error use:
18
adb shell
19
mount -o rw,remount /system
20

21
# If still not working, use the below first
22
mount -o rw,remount /
23

24
# Once done
25
mount -o ro,remount /

1
# On the emulated device
2
# Drag and drop the .cer file to the SD card
3
# Go to Settings --> Security & Location --> Encryption & credentials --> Install from SD card --> /sdcard/Download

1
https://github.com/MobSF/Mobile-Security-Framework-MobSF
2

3
# Install MobSF
4
cd C:\path\to\Mobile-Security-Framework-MobSF
5
.\setup.bat
6

7
# Run MobSF
8
cd C:\path\to\Mobile-Security-Framework-MobSF
9
.\run.bat 127.0.0.1:8000

1
# If you get a "system is read-only" error use:
2
adb shell
3
mount -o rw,remount /system
4

5
# If still not working, use the below first
6
mount -o rw,remount /
7
# Once done
8
mount -o ro,remount /

1
# If you get connection issues, restore internet access with:
2
adb shell
3
settings put global http_proxy :0

1
# Upload files to the SD card
2
adb push C:\path\to\example_resigned.apk /sdcard

1
# Tools
2
# APKTool
3
# Dex2Jar  (built into Kali)            # d2j-dex2jar app-release.apk
4
# JD-GUI
5
# SQLite DB Browser
6
# Keytool  (comes with Java)

1
# https://ibotpeaches.github.io/Apktool/install/
2
apktool d C:\path\to\example.apk
3

4
.\apktool.bat -r d .\example\app.apk -o .\example\temp
5

6
# Searching for strings in the decompiled app
7
findstr /SIN "firebase" 'C:\path\to\example\*'       # Apply the same logic for keys and passwords
8
findstr /SIN "API_KEY" *
9
findstr /SIN "secret" *
10
findstr /SIN firebase secret api_key password *

1
# Dex2Jar (built into Kali, or Windows https://github.com/pxb1988/dex2jar)
2
d2j-dex2jar example.apk
3

4
.\d2j-dex2jar.bat C:\path\to\example.apk
5

6
# Open the resulting .jar with JD-GUI - http://java-decompiler.github.io/

1
keytool -printcert -file "C:\path\to\example\original\META-INF\CERT.RSA"

1
https://github.com/vincentcox/StaCoAn
2

3
# StaCoAn looks for interesting lines in the code which can contain:
4
# - Hardcoded credentials
5
# - API keys
6
# - URLs of APIs
7
# - Decryption keys
8
# - Major coding mistakes
9
# Requires 64-bit Java.

1
# Decompile, modify Smali, recompile and sign an APK
2
https://www.hebunilhanli.com/wonderland/mobile-security/decompile-modify-smali-recompile-and-sign-apk/
3
https://book.hacktricks.xyz/mobile-apps-pentesting/android-app-pentesting/smali-changes
4
https://github.com/skylot/jadx

1
# Decompile the APK
2
# https://ibotpeaches.github.io/Apktool/install/
3
.\apktool.bat -r d '.\example.apk' -o .\example
4

5
# Extract the index.android.bundle file from the /assets folder
6

7
# Decompile index.android.bundle (may not work if built with webpack v5 etc.)
8
https://github.com/numandev1/react-native-decompiler
9
sudo apt install npm
10
npm install -g react-native-decompiler
11
npx react-native-decompiler -i ~/clients/example/index.android.bundle -o ~/clients/example/output
12

13
# Decompile index.android.bundle if based on the Hermes engine
14
https://github.com/bongtrop/hbctool
15
git clone https://github.com/bongtrop/hbctool.git
16
cd hbctool
17
poetry build
18
pip install --force-reinstall dist/hbctool-0.1.5-py3-none-any.whl
19

20
hbctool disasm index.android.bundle example_hasm
21

22
# Decompile index.android.bundle if based on the Hermes engine (option 2)
23
https://github.com/P1sec/hermes-dec
24
git clone https://github.com/P1sec/hermes-dec.git
25
cd hermes-dec
26
hbc-disassembler ~/clients/example/index.android.bundle ~/clients/example/example_hermes.hasm
27
hbc-decompiler ~/clients/example/index.android.bundle ~/clients/example/example_hermes.js

1
# Find security vulnerabilities in Xamarin.Android apps
2
https://github.com/wesleydekraker/xamarin-security-scanner
3
https://dotnet.microsoft.com/download/dotnet-core/thank-you/sdk-3.1.401-windows-x64-installer
4

5
"C:\path\to\xamarin-security-scanner" dotnet run --project ./XamarinSecurityScanner\XamarinSecurityScanner.App --path C:\path\to\example\
6

7
# The tool reports issues such as:
8
# - Certificate validation overwritten
9
# - Permissions may not be enforced
10
# - Unsafe cipher mode used
11
# - External storage is used
12
# - Hardcoded HTTP URL found
13
# - JavaScript enabled in WebView
14
# - JavascriptInterface added to a WebView
15
# - Logging was found
16
# - Access to phone number
17
# - WorldReadable file found
18
# - Backups are enabled
19
# - App has debugging enabled
20
# - App supports an outdated Android version
21
# - App contains a private key
22

23
# Xamarin apps store DLLs in /unknown/assemblies
24
# Use https://www.jetbrains.com/decompiler/ to view the DLL source for DB credentials, encryption keys etc.

1
# Install Frida (Windows)
2
pip install frida-tools
3

4
# Install Objection (Windows)
5
pip install objection
6

7
# Add the above tools to the Windows PATH
8
pip show frida-tools      # Note the location
9
pip show objection        # Note the location
10
# The above shows ...\site-packages. Add the directory one level up, e.g.
11
# ...\AppData\Local\Programs\Python\Python311\Scripts, to the PATH
12

13
# Test
14
frida ps
15
objection

1
# Get the device architecture
2
adb shell
3
getprop ro.product.cpu.abi      # For example x86_64
4

5
# Download the matching Frida server version
6
https://github.com/frida/frida/releases
7
# Usually https://github.com/frida/frida/releases/download/16.1.4/frida-server-16.1.4-android-x86_64.xz
8

9
# Extract and push the server to /data/local/tmp
10
adb push .\Downloads\frida\frida-server-16.1.4-android-x86_64 /data/local/tmp
11
adb shell
12
cd /data/local/tmp
13
chmod 777 frida-server-16.1.4-android-x86_64
14
./frida-server-16.1.4-android-x86_64
15

16
# List apps installed, using Frida
17
frida-ps -Uai

1
# Perform runtime changes using Objection on one of the apps listed above
2
https://book.hacktricks.xyz/mobile-pentesting/android-app-pentesting/frida-tutorial/objection-tutorial
3
objection -g com.example.app explore

1
# https://book.hacktricks.xyz/pentesting/pentesting-web/buckets/firebase-database
2

3
# 1. Get the APK of the app (any method to pull the APK from the device works)
4

5
# 2. Decompile the APK with apktool
6
.\apktool.bat d C:\path\to\example.apk
7

8
# 3. In res/values/strings.xml search for the "firebase" keyword. You may find a URL
9
#    such as https://xyz.firebaseio.com/
10
Get-ChildItem -Path .\example\ -Recurse | Select-String -Pattern "firebase"
11
findstr.exe /SIN "firebaseio" .\app-release\*
12

13
# 4. Navigate to the found URL with .json appended: https://xyz.firebaseio.com/.json
14

15
# 5. Two responses can appear:
16
#    "Permission Denied"          -> it is well configured
17
#    "null" or a block of JSON    -> the database is public and you have at least read access
18

19
# 6. If readable, check for write privileges using:
20
#    https://github.com/MuhammadKhizerJaved/Insecure-Firebase-Exploit

1
https://github.com/RhinoSecurityLabs/GCPBucketBrute
2

3
# Brute forcing bucket names
4
cd ~/tools/GCPBucketBrute
5
sudo python3 gcpbucketbrute.py -k example -u
6

7
# URL format for buckets
8
# www.googleapis.com/storage/v1/b/<BUCKET NAME>/o
9
# error 404   -> does not exist
10
# error 401   -> exists but configured properly
11
# a list of files -> the bucket is vulnerable and misconfigured
12

13
# Get the bucket policy
14
https://www.googleapis.com/storage/v1/b/<BUCKET NAME>/iam
15
https://www.googleapis.com/storage/v1/b/example-app-production.appspot.com/iam
16

17
# Check strings in the decompiled APK for a storage bucket reference
18
Get-ChildItem -Path .\app\ -Recurse | Select-String -Pattern "google_storage_bucket"
19
# "google_storage_bucket" : "example-app-production.appspot.com"

1
# gsutil
2
https://cloud.google.com/storage/docs/gsutil_install
3

4
# List the contents of a bucket (needs auth, but use it to check if anonymous access is allowed)
5
gsutil ls gs://example-app-production.appspot.com

1
# Enter an ADB shell
2
adb shell
3
cd /data/data
4
cd com.android.providers.telephony
5
cd databases
6

7
# In a new terminal, pull the databases
8
.\adb.exe pull /data/data/com.android.providers.telephony/databases
9

10
# Open the .db files with DB Browser for SQLite
11
# https://sqlitebrowser.org/dl/
12

13
# App-specific data is stored in:
14
# /data/data/****
15
# Apps can also store data in external storage:
16
# /mnt/sdcard

1
# Testing SSL pinning
2
https://medium.com/globant/testing-ssl-pinning-in-a-mobile-application-44e0175f9244
3
https://medium.com/@evilprince007/ssl-pinning-bypass-simplified-48c0d5294a6c

1
# Insecure data storage
2
adb shell
3
cd /data/data
4
cd mnt
5
cd /mnt/sdcard
6

7
# Check for insecure user data storage in:
8
# 1. Shared Preferences
9
/data/data/com.example.app/shared_prefs/UserInfo.xml
10
# 2. Databases
11
# 3. Temporary files

1
# Use JD-GUI to view .jar source code for hardcoded API keys etc.

1
# Use logcat to view logs of app activity
2
adb logcat
3

4
.\adb.exe -s 192.168.1.100:5555 logcat | Select-String -Pattern com.example.app
5

6
# Look for cleartext logging of sensitive data, for example:
7
# - Credit card details
8
# - Login credentials

1
# Classic SQL injection
2
' OR '1'='1'--
3

4
# Check WebViews for possible input validation flaws
5
# Web addresses e.g. http://www.example.com
6
# Files e.g. file:///data/data/com.example.app/shared_prefs/UserInfo.xml
7

8
# Enter these in places like search fields

1
# Tools: jarsigner (comes with the JDK)
2
jarsigner -verify -verbose C:\path\to\example.apk

1
# Remove the existing certificate and signature
2
# 1. Unpack the apk with APKTool
3
# 2. Remove the META-INF folder
4
# Now you can re-sign the application
5

6
# Set up a keystore to hold the private key used to sign the application
7
keytool -genkey -v -keystore [name of keystore] -alias [your key alias] -keyalg RSA -keysize 2048 -validity [number of days]
8
keytool -genkey -v -keystore example-keystore -alias example -keyalg RSA -keysize 2048 -validity 10000

1
# Sign the application with jarsigner (admin cmd)
2
jarsigner -verbose -sigalg MD5withRSA -digestalg SHA1 -keystore [name of your keystore] [your .apk file] [your key alias]
3
jarsigner -verbose -sigalg MD5withRSA -digestalg SHA1 -keystore example-keystore C:\path\to\example_resigned.apk example

1
https://tools.androidtamer.com/Training/DIVA/10_Access_Control_Issues_P2/
2

3
# Activity manager
4
adb shell am start [action from intent filter]
5
adb shell am start -W -a android.intent.action.MAIN

1
https://resources.infosecinstitute.com/topic/android-hacking-security-part-15-hacking-android-apps-using-backup-techniques/
2
# Look for: allowBackup="true"

1
https://vishwarajbhattrai.wordpress.com/2017/07/17/finding-backup-vulnerabilities-in-android-apps/
2

3
adb backup -f C:\path\to\example.ab com.example.app
4

5
# Convert the .ab file into .tar using Android Backup Extractor
6
# https://github.com/nelenkov/android-backup-extractor/
7
# Get abe-all.jar from releases, rename it to abe and copy it to your working folder
8
cd C:\path\to\android-backup-extractor
9
abe.jar unpack example.ab example.tar
10

11
# Copy the tar file to Kali and extract it
12
tar xvf example.tar
13

14
# Explore the extracted files, including assets like .db and sharedprefs.xml, for sensitive
15
# information - developers sometimes leave secrets, passwords, or API auth tokens here.
16
# Use sqlite to view .db files.

1
https://aaptdownload.com/
2

3
# List all permissions for the APK
4
aapt d permissions 'C:\path\to\example.apk'

1
https://github.com/radareorg/radare2/
2

3
# Test a single native library
4
.\rabin2.exe -I 'C:\path\to\example\lib\x86_64\libexample.so' | Select-String "canary|pic"
5
# Repeat for all .so files in the \lib\x86_64\ folder
6

7
# In PowerShell ISE, run rabin2 across every file in the \lib\x86_64\ folder
8
$PrevErrorActionPreference = $ErrorActionPreference
9
$ErrorActionPreference = 'silentlycontinue'
10
Get-ChildItem -Path 'C:\path\to\example\lib\x86_64\' -Recurse | ForEach-Object {$_.FullName
11
C:\path\to\radare2\bin\rabin2.exe -I $_.Fullname | Select-String 'canary|pic'}
12
$ErrorActionPreference = $PrevErrorActionPreference

1
# Manual
2
# Check AndroidManifest.xml for the android:debuggable attribute and its value
3

4
# Using adb
5
adb shell dumpsys package com.example.app | Select-String "DEBUGGABLE"
6

7
# Using aapt (if the result is 1, the directive is present)
8
aapt d xmltree 'example.apk' AndroidManifest.xml | Select-String -Pattern 'android:debuggable\(0x[0-9a-f]+\)=\(type\s0x[0-9a-f]+\)0xffffffff'

1
# QARK    - https://github.com/linkedin/qark  (Quick Android Review Kit)
2
# Drozer  - https://labs.f-secure.com/tools/drozer
3
# PentDroid - https://github.com/vishwaraj101/PentDroid
4
# Mobile Nuclei templates - https://github.com/optiv/mobile-nuclei-templates
5

6
# Using the Android USB driver to extract data as a USB mass storage device
7
# https://seclists.org/fulldisclosure/2021/Jun/50
8

9
# General
10
# https://github.com/sensepost/objection