Define the assessment scope

Before touching any tools, clarify with the client:

• What is in scope: Which app versions, which environments (production vs staging), which API endpoints
• What is out of scope: Third-party SSO providers, shared backend infrastructure, payment processors
• Testing credentials: Test accounts for different privilege levels (free user, premium, admin if applicable)
• Source code: White-box (with source), grey-box (with partial source or build artifacts), or black-box

Scope ambiguity is the most common cause of engagement disputes. Get it in writing.

Initial reconnaissance

Before running any tools, do passive reconnaissance:

• Review the app on the Play Store: description, permissions requested, developer info
• Check for previous vulnerability disclosures related to this developer or similar apps
• Identify the technology stack from the app description and screenshots
• Download the APK and note the version and target SDK level

# Extract basic APK metadata
aapt dump badging target.apk | grep -E "package:|uses-permission:|target|min"
# Or use jadx:
jadx -d decoded/ target.apk
cat decoded/resources/AndroidManifest.xml | grep -E "permission|uses-sdk"

APK decompilation and source review

Decompile the APK with JADX and systematically review the source for:

• Hardcoded secrets: API keys, passwords, cryptographic keys, private URLs
• Exported components: Activities, services, content providers, and broadcast receivers with exported=true or no explicit intent filters
• Insecure data storage: SharedPreferences usage, SQLite database operations, file creation with world-readable permissions
• Cryptographic mistakes: Static IVs, ECB mode, MD5 for security purposes, custom crypto implementations
• Deep links: URL scheme handlers that take parameters without validation
• WebView configuration: setJavaScriptEnabled(true), addJavascriptInterface(), setAllowFileAccess(true)

# High-value search patterns in decompiled source
grep -r "api_key\|apikey\|secret\|password\|token" decoded/sources/
grep -r "getSharedPreferences\|openFileOutput\|SQLiteDatabase" decoded/sources/
grep -r "addJavascriptInterface\|setAllowFile\|setJavaScriptEnabled" decoded/sources/
grep -r "exported=\"true\"\|android:exported" decoded/resources/

Native library analysis

Extract and examine .so files from the APK. This is where serious vulnerabilities often hide:

unzip target.apk -d extracted/
ls extracted/lib/arm64-v8a/
# Load in Ghidra and look for:
# - JNI functions (exported as Java_*)
# - Input parsing code (image, video, audio parsers)
# - Cryptographic operations
# - Memory management patterns

Environment preparation

Set up a rooted Android device or emulator with:

• Magisk or SuperSU for root access
• Frida server matching the target device architecture and Android version
• Burp Suite proxy certificate installed as system CA (requires root on Android 7+)
• Network configured to route traffic through Burp

# Install Frida server
adb push frida-server-16.x.x-android-arm64 /data/local/tmp/frida-server
adb shell chmod +x /data/local/tmp/frida-server
adb shell su -c "/data/local/tmp/frida-server &"

# Verify Frida connection
frida-ps -U | grep target_package

Certificate pinning bypass

Most production apps implement certificate pinning. Common bypass approaches:

• Objection (fastest): android sslpinning disable
• Custom Frida script: Hook OkHttp, TrustManager, or the specific pinning library the app uses
• APK patching: Modify the network security config in AndroidManifest.xml to trust user CAs, repackage and resign
• Xposed/LSPosed modules: TrustMeAlready, JustTrustMe for persistent bypass across app restarts

Authentication and session management

• Test all authentication flows: login, registration, password reset, 2FA
• Inspect JWT tokens: check for weak algorithms, missing signature verification, sensitive data in payload
• Test session fixation, session invalidation on logout, and token expiration
• Test for account enumeration via differential responses
• Verify OAuth implementations: redirect_uri validation, PKCE implementation, state parameter

Data storage assessment

# Check SharedPreferences for sensitive data
adb shell su -c "cat /data/data/com.target.app/shared_prefs/*.xml"

# Check SQLite databases
adb shell su -c "sqlite3 /data/data/com.target.app/databases/app.db .tables"
adb shell su -c "sqlite3 /data/data/com.target.app/databases/app.db 'SELECT * FROM users'"

# Check files written by the app
adb shell su -c "ls -la /data/data/com.target.app/"
adb shell su -c "find /sdcard/ -name '*.log' -newer /tmp/marker"

IPC and intent testing

Test exported components for unauthorized access and intent injection:

# List exported components
adb shell dumpsys package com.target.app | grep -A1 "Activity\|Service\|Provider\|Receiver"

# Try to start an exported activity without authentication
adb shell am start -n com.target.app/.AdminActivity

# Test exported content providers
adb shell content query --uri content://com.target.app.provider/users

# Send a broadcast to an exported receiver
adb shell am broadcast -a com.target.app.ACTION_RESET -p com.target.app