> For the complete documentation index, see [llms.txt](https://security.navidnaf.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://security.navidnaf.com/marauders-map/mobile-application-pentesting.md).

# Mobile Application Pentesting

Presented below is a carefully compiled checklist for conducting penetration testing on mobile applications. It is not an exhaustive inventory but instead an evolving one, with ongoing updates planned as I progress in this journey. This checklist can be an excellent initial reference for beginners.

## APK Information Gathering

Extracting insights from APK files is crucial for understanding permissions, embedded secrets, and third-party libraries. This process forms the foundation for identifying security vulnerabilities in mobile applications.

<table><thead><tr><th width="205">Process</th><th width="338">Description</th><th>Tools that can be used</th></tr></thead><tbody><tr><td><strong>APK File Gathering</strong></td><td>Obtaining the application from an Android device or the Play Store.</td><td>adb, apkpure, devices</td></tr><tr><td><strong>Check Application Ecosystem</strong></td><td>Attempt to grasp the fundamental components of the application, including its underlying technology.</td><td>apktool, jadx-gui, yazhini</td></tr><tr><td><strong>Installation (Device)</strong></td><td>Install the APK on an actual device</td><td>Physical Phones</td></tr><tr><td><strong>Installation (Emulator)</strong></td><td>Installing the APK on emulators</td><td>Genymotion, BlueStacks, Nox</td></tr><tr><td><strong>Installation (Root)</strong></td><td>Installing the APK on a rooted decice</td><td>Actual Phones</td></tr></tbody></table>

## Reverse Engineering & Analysis

Reverse Engineering in mobile app testing involves dissecting the app's code and logic to uncover hidden features, assess vulnerabilities, and understand its internal workings, providing crucial insights for security analysts.

<table><thead><tr><th width="205">Process</th><th width="338">Description</th><th>Tools that can be used</th></tr></thead><tbody><tr><td><strong>APK Analysis</strong></td><td>Analyze the APK package, inspecting its contents such as assets, resources, manifest files, and META-INF.</td><td>apktool, adb, dex2jar, JDGUI, IDA Pro</td></tr><tr><td><strong>Static Analysis</strong></td><td>Conduct static analysis to identify sensitive information, such as passwords or API keys.</td><td>MobSF, adb, apktool, dex2jar, JDGUI</td></tr><tr><td><strong>Debug Checking</strong></td><td>Check the <code>android:debuggable</code> attribute.</td><td>Any Editor</td></tr><tr><td><strong>Android Manifest</strong></td><td>Check the <code>AndroidManifest.xml</code> thoroughly.</td><td>Any Editor</td></tr></tbody></table>

## Dynamic Analysis

Dynamically assessing a mobile app's behavior during runtime reveals vulnerabilities, how the app handles sensitive data, and any potential malicious activities. This approach complements static analysis for a comprehensive security evaluation.

<table><thead><tr><th width="205">Process</th><th width="338">Description</th><th>Tools that can be used</th></tr></thead><tbody><tr><td><strong>Applog</strong></td><td>Review the application logs, examining entries related to processes from a particular application package.</td><td>pidcat, logcat</td></tr><tr><td><strong>Root Detection</strong></td><td>Examine the root detection mechanism and evaluate methods to bypass root detection.</td><td>Manual</td></tr><tr><td><strong>Shared Preference</strong></td><td>Upon initial login, the app requests the user's username and password. Subsequent logins do not require this information, as the app stores the login key in the shared preferences file "login_account.xml." Notably, this key can be extracted from one app and utilized by another.</td><td>Manual</td></tr><tr><td><strong>WebView Vulnerabilities</strong></td><td>Examine WebView settings for potential vulnerabilities.</td><td>MobSF, Manual</td></tr><tr><td><strong>Storage Issue</strong></td><td>Inspect the external storage of various data for security concerns.</td><td>Manual, sqlite</td></tr><tr><td>S<strong>ecrets</strong></td><td>Examine various locations for sensitive data such as keys and passwords.</td><td>Manual, grep</td></tr></tbody></table>