Android app assessment

When it applies

You have an APK (or a device/emulator running the app) and program scope covers the mobile client + its backend. Most impactful mobile bugs are really API bugs the app exposes, plus local data/secret leaks.

Why it works

Client apps ship their logic and often their secrets. Decompilation reveals endpoints, keys, and auth flows; exported components and WebViews expose attack surface; and the app trusts its own device, so runtime instrumentation removes checks the server assumed were enforced.

Method

1. Unpack & triage: apktool d app.apk (resources/manifest) and jadx-gui app.apk (readable Java). Read AndroidManifest.xml for exported=true activities/services/ receivers/providers, android:debuggable, custom URL schemes, and usesCleartextTraffic.
2. Hunt secrets & endpoints: grep decompiled code + res/ + strings.xml for API keys, base URLs, firebase configs, tokens (grep -rniE "api[_-]?key|secret|https?://").
3. Local storage review: after use, pull /data/data/<pkg>/ (shared_prefs, sqlite, files) for tokens/PII stored in cleartext.
4. Dynamic: run under Frida/objection — objection -g <pkg> explore to dump keystore, bypass root/emulator checks, and hook methods. Proxy traffic (Burp) to test the backend.
5. Exported components: invoke exported activities/providers via adb shell am start/ content query to reach functionality without auth.

Gotchas

• Cleartext-secret finding needs impact — a key with no privilege is informational; tie it to an action.
• Cert pinning blocks proxying → see mobile-cert-pinning-bypass before concluding "no traffic".
• The real bugs are usually server-side (BOLA/mass-assignment) reached via the app — proxy and test the API.

Verify success

A concrete impact: leaked working credential/endpoint, unauthenticated reach into an exported component, or a backend bug proven through the app's traffic.

References

OWASP MASVS/MASTG; OWASP Mobile Top 10 (2024); jadx/objection docs.