Android App - Hacking

Android app comes in APK format, which is really a ZIP file, Inside it you will find the signature, the applicaiton code, and all its resources.

This can be unzipped with any standard archive tool if you rename it to .zip, however apktool will automatically unpack it to deeper level

• APK = ZIP archive

• Contains:

  • Code (DEX)
  • Manifest (permissions)
  • Resources (layouts, strings, images)

Dex files contain the compiled java/kotlin code for an android application. In the case of an native android app, this will be all of the code it could be disassembled by apktool and decompiled with the likes of dex2jar

The AndroidManifest.xml contains key information regarding the name and version of app, its requested permissions, activities, intents, and more. Much of this is useful during application testing, and apktool decodes this to a readable format

An android app contains tons of resources like images and strings to XML files which describes UI layouts.

These are worth searching through, if only to find unused layouts(e.g. debug interfaces) and strings which may point to bugs elsewhere.

Tools

Android App Decompilation

This is the process where we take the compiled code, and then try to get the source code. we can never get the exact same code after decompilation but it is generally equivalent in functioning

To decompile the code, we need to convert the .apk into a format readable by java decompiler

dex2jar -f app.apk

Here we would now have a standard java jar file, Open the resulting JAR in JD-GUI to get the source code

• Save .java files using “Save All Sources”
• Open in your favorite IDE for inspection

Setting Up Burp Proxy with Android

Set listener to all interfaces

For Android Emulator this settings are located on the settings section of the “Extended Controller” screen. This can be set to localhost and port the burp is listnening on

For Physical Devices, the Proxy settings can be found in WiFi settings, long press the WiFI name and then click “Modify network” then the proxy setting will be on that dialogue

Install Burp Certificate

For the device to trust Burp for SSL, we need to install The CA cert. Once the proxy is enabled go to http://burp/ and download the certificate from top right corner.

• Install via Android settings:
  • Security → Encryption & Credentials → Install from SD

⚠️ Watch Out!

• Some apps make direct network request
• Others use certificate pinning

🔧 Solutions:

For direct network request - it is possible to make use of VPN functionality in android to connect to your computer and proxy that way.

For Certificate pinning use Frida or custom patches to disable cert pinning

Rooting (Optional)

• Gives superuser access to system files
• Helps in testing deeper app behavior

⚠️ Never Root your Primary Device, as a rooted mobile device is at an increased risk of getting compromised

🛠️ Common Android Vulnerabilities

Acitvities are single focused things for users to do. If you’re thinkning in terms of MVC, Activity is a controller it sets up views, handles incoming intents, communincates with outside world etc.

Everything you see in an android app is driven by activity, for example an login form, data field, camera interface etc.`

In order to be used in most circumstances each activity need to be published in the applications manifest file.

Intents are one of the main ways that activities get started, It send messages to services, typically an intent will be sent to one specific target, but they can also bebroadcast widely.

Intent Filters are added to Manifest file, This let an activity recieve intents matching certain critirea, like a URI with a aspecific protocol scheme.

• Activities = Screens/controllers
• Intents = Messages that launch activities

<activity android:name="com.example.app.MyActivity"
          android:label="@string/title_my_activity">
</activity>

Intent call = new Intent(Intent.ACTION_DIAL);
call.setData(Uri.parse("tel:2125554240"));
startActivity(call);

• Intents can be broadcasted or redirected
• Misconfigured activities can be hijacked

Cross-App Scripting (XAS)

It is just like cross site scripting in a traditional web app, where input ends up in a WebView

Depending on what a WebView can access this lead to compromise of private data.

WebViews are extremely common in android apps, it is the promary entrypoint for serving sub sections, if we want the webview to go somewhere we can use the loadURL method or evaluatejavascript function if either of these two comes from untrusted sources and arent whitelisted or very well sanitized, then these are candidates for cross app scripting

Finding the loadUrl and evaluatejavascript method, then tracing them backwards from these call to determine if the parameters come from insecure source.

✅ Pro Tips

• Use adb logcat to view real-time debug logs
• Search through decoded resources for hidden views or keys
• Monitor file reads/writes with Frida

Mobile app testing might seem tough at first—but most issues are well-known web vulnerabilities repackaged for mobile. With the right tools, a good methodology, and a curious mindset, you’ll uncover plenty of bugs that others miss.

Happy hacking! 🔍📱💥