Mobile Android Assessment

---
name: mobile-android-assessment
description: >
  Assess an Android app (static + dynamic). Load when the target is an APK/AAB, a mobile
  bug-bounty scope, or "test the android app". Signals: .apk file, Java/Kotlin/Smali,
  AndroidManifest.xml, exported components, WebViews, hardcoded secrets, Frida/objection.
domain: mobile
type: technique
stability: learning
modes: [pentest, bugbounty]
severity: high
owasp: [M1:2024-Improper-Credential-Usage, M8:2024-Security-Misconfiguration]
cwe: [CWE-919]
tools: [jadx, apktool, frida, objection, mobsf, adb]
schema_version: 1
---

# Android app assessment

## When it applies
You have an APK (or a device/emulator running the app) and program scope covers the mobile
client + its backend. Most impactful mobile bugs are really API bugs the app exposes, plus
local data/secret leaks.

## Why it works
Client apps ship their logic and often their secrets. Decompilation reveals endpoints, keys,
and auth flows; exported components and WebViews expose attack surface; and the app trusts its
own device, so runtime instrumentation removes checks the server assumed were enforced.

## Method
1. **Unpack & triage**: `apktool d app.apk` (resources/manifest) and `jadx-gui app.apk`
   (readable Java). Read `AndroidManifest.xml` for `exported=true` activities/services/
   receivers/providers, `android:debuggable`, custom URL schemes, and `usesCleartextTraffic`.
2. **Hunt secrets & endpoints**: grep decompiled code + `res/` + `strings.xml` for API keys,
   base URLs, firebase configs, tokens (`grep -rniE "api[_-]?key|secret|https?://"`).
3. **Local storage review**: after use, pull `/data/data/<pkg>/` (shared_prefs, sqlite, files)
   for tokens/PII stored in cleartext.
4. **Dynamic**: run under Frida/objection — `objection -g <pkg> explore` to dump keystore,
   bypass root/emulator checks, and hook methods. Proxy traffic (Burp) to test the backend.
5. **Exported components**: invoke exported activities/providers via `adb shell am start`/
   `content query` to reach functionality without auth.

## Gotchas
- Cleartext-secret finding needs impact — a key with no privilege is informational; tie it to an action.
- Cert pinning blocks proxying → see `mobile-cert-pinning-bypass` before concluding "no traffic".
- The real bugs are usually server-side (BOLA/mass-assignment) reached via the app — proxy and test the API.

## Verify success
A concrete impact: leaked working credential/endpoint, unauthenticated reach into an exported
component, or a backend bug proven through the app's traffic.

## References
OWASP MASVS/MASTG; OWASP Mobile Top 10 (2024); jadx/objection docs.