Android Pentesting

# Download APK from device
adb shell pm list packages | grep target
adb shell pm path com.target.app
adb pull /data/app/com.target.app-1/base.apk

# APK extraction and decompilation
apktool d app.apk -o app_decoded
jadx app.apk -d app_source

# Search for sensitive data
grep -r "api_key|password|secret|token" app_source/
grep -r "http://" app_source/  # Insecure connections

# Find hardcoded URLs
grep -rE "https?://[a-zA-Z0-9.-]+" app_source/

# Check for insecure storage
grep -r "MODE_WORLD_READABLE|MODE_WORLD_WRITEABLE" app_source/
grep -r "getSharedPreferences|openFileOutput" app_source/

# Install Frida
pip install frida-tools

# Push Frida server to device
adb push frida-server /data/local/tmp/
adb shell chmod 755 /data/local/tmp/frida-server
adb shell /data/local/tmp/frida-server &

# List running processes
frida-ps -U

# Attach to app
frida -U -f com.target.app

Java.perform(function() {
    var RootCheck = Java.use("com.target.app.security.RootCheck");
    RootCheck.isRooted.implementation = function() {
        console.log("Root check bypassed!");
        return false;
    };
});

frida -U -f com.target.app -l bypass_root.js

# SSL Pinning bypass (using objection)
pip install objection
objection -g com.target.app explore

# Inside objection:
# android sslpinning disable

# Dump application memory
# memory dump all memory_dump/