📑
Security Notes
  • Readme
  • Resources
    • Useful sites
    • Metasploit
      • Searchsploit
      • Msfvenom
      • Meterpreter
    • Shells
    • Linux
      • Cron
      • Connection
      • Compilers
    • Windows
      • Kernel exploits table
    • Bruteforce
      • Checklist
      • John the Ripper
      • Hashcat
    • BOF
      • Assembly
    • Gaining access checklist
  • Cloud - AWS
    • Enumeration
    • References
    • Bucket S3
      • Public Bucket
      • AMI Files
      • File upload to RCE
    • EC2
      • cloud-init Exploits
      • SSRF To AWS Role compromise
      • Unencrypted EBS
    • IAM
      • Account Disclosure by resource policy
    • Lambda Function
      • Code Injection
      • Attacking APIs
    • VPC
      • Expose Resources
  • Networking
    • Nmap
      • Scan types
    • TCPDump
    • Port forwarding
    • Ports
      • 21 - FTP
      • 22 - SSH
      • 25 465 587 - SMTP
      • 53 - DNS
      • 110 995 - POP3
      • 111 - NFS
      • 113 - Ident
      • 123 - NTP
      • 135 137 139 - RPC
      • 143 993 - IMAP
      • 161 - SNMP
      • 389 - LDAP
      • 139 445 - SMB
      • 873 - Rsync
      • 6379 - Redis
      • 6667 - IRC
  • Linux PrivEsc
    • Checklist
    • Enumeration
      • Important files
      • Memory Dump
    • Privileges Exploitation
    • Wildcard Exploits
    • Sudo Exploits
    • Docker Container
    • Docker Groups
    • Common Exploits
  • Windows PrivEsc
    • Checklist
    • Enumeration
      • Important Files
    • Antivirus evasion tools
    • Unquoted paths
    • Always install elevated
    • Vulnerable services
    • Client side
    • Exploitable privileges
      • Juicy Potato
    • UAC bypass
    • Common Exploits
  • Active Directory
    • Introduction
    • Checklist
    • Enumeration
    • Enable RDP
    • Kerberos
    • Rubeus
    • Credentials harvesting
      • Domain Controller specific
    • Connection
    • Pass The Hash
    • Kerberoast
    • ASREProast
    • Tickets
  • Web Attacks
    • Checklist
    • Enumeration
      • URL bruteforcing
    • APIs and Fields
    • Authentication
    • Filter Evasion
      • Fuzzying and encoding
    • File Vulnerabilities
      • LFI List
      • PHP shells
    • RCE
    • Code Injection
    • Dependency Injection
    • Joomla
    • Wordpress
    • WebDAV
    • HTTP
    • XSS
      • DOM Based
      • Reflected
      • Filter Evasion
    • SSI
    • SSTI
    • RCE
    • CSRF
    • SQL injection
      • sqlmap
      • PostgreSQL
      • Oracle
      • MSSQL
      • MySQL
      • Login
    • XPath injection
    • XXE
    • CORS
  • MOBILE PENTESTING
    • Static Code Analysis
    • Dynamic Code Analysis
    • Network Traffic Analysis
Powered by GitBook
On this page
  • Reverse Engineering
  • Code Analysis
  • Hardcoded values
  • Unsafe Intent declaration
  • AIDL analysis
  • Direct Binder class invocation
  • Permissions and Protection Levels
  • WebViews
  • Applications with shared UID
  • Certificates management
  1. MOBILE PENTESTING

Static Code Analysis

PreviousCORSNextDynamic Code Analysis

Last updated 2 years ago

Reverse Engineering

Decode APK packages using . The result will be a folder mirroring the structure of the original package containing all source files, configuration files and resources

java -jar apktools d <apk archive>
java -jar apktools d <apk archive> -s #do not disassemble .DEX files

Decode DEX packages using to convert them into JAR archives and then use any Java decompiler such as to analyze the code

d2j-dex2jar.sh <dex file or apk archive> -o <output jar filename>

To retrieve the smali code from a DEX file use the java application provided .

java -jar baksmali-<ver> <dex file>

Code Analysis

Hardcoded values

The Java code might include hardcoded credentials or values that can be exploited to bypass logins or modify the app behavior in unexpected ways

Unsafe Intent declaration

text

AIDL analysis

Describes an API offered by a service to an external application by defining the primitives expected by the server during an Inter-Process Communication (IPC).

Direct Binder class invocation

text

Permissions and Protection Levels

text

WebViews

WebViews are used to display applications designed with web technologies as opposed to native Java apps. These applications are vulnerable to the same exploits and misconfigurations that target standard web applications such as XSS, SQLi, File Inclusion and RCE.

  • WebViewClient is used to display simple HTML code

  • In WebViewClient popups will not work as such, XSS test payloads such as alert(1); will not be triggered

  • The class maintains its own cookie jar completely separated from the parent's cookie jar

  • Creating a WebViewClient requires to provide an URL to load using one of these methods loadUrl, loadData or loadDataWithBaseURL. Testers should ensure that the values provided to these methods are not provided by unsanitized user data

  • Verify that Javascript is enabled by searching for the method setJavaScriptEnabled(true)

  • WebViews can access content providers by requiring an URL crafted as follows content://<URL>. To verifiy if this option is enabled look for the method setAllowContentAccess(true)

  • WebView can access local files by navigating to file://<PATH>. To verify if this option is enabled look for the method setAllowFileAccess(true). If this option is set to false the WebView is restricted to access only file:///android_asset and file:///android_res

  • If the option setAllowUniversalAccessFromFileURLs is set to true (default in Adroid <= 4.0.3) then an attacker who controls a file inside the WebView is able to access any content in any other loaded domain

Applications with shared UID

Applications signed with the same UID can share the same resources. Applications that share UIDs have the following line in their manifest file: android.sharedUserId=<id>. Applications that share the same resources such as files and services can lead to security vulnerabilities when the access permissions are not correctly configured and enforced.

Certificates management

apktools
dex2jar
JD-Gui
here