Android Penetration Testing Cheat Sheet

Tools & Scripts
, , , ,
1

Android Penetration Testing Cheat Sheet

This is more of a checklist for myself. May contain useful tips and tricks. Still need to add a lot of things.

Everything was tested on Kali Linux v2023.1 (64-bit) and Samsung A5 (2017) with Android OS v8.0 (Oreo) and Magisk root v25.2.

Check Magisk if you wish to root your Android device. I have no liability over your actions.

For help with any of the tools type <tool_name> [-h | -hh | --help] or man <tool_name>.

If you didn’t already, read OWAS MASTG (GitHub) and OWASP MASVS (GitHub). You can download OWASP MASTG checklist from here.

I also recommend reading HackTricks - Android Applications Pentesting.

In most cases, to be eligible for a bug bounty reward, you need to exploit a vulnerability with non-root priviledges, possibly building your own “malicious” PoC app.

Find out more about my “malicious” PoC app from my other project.

Websites that you should use while writing the report:

My other cheat sheets:

Future plans:

  • modify networkSecurityConfig to add custom root CA certificates,
  • test widgets, push notifications, and Firebase,
  • SMALI code injection,
  • Flutter attacks,
  • create more Frida scripts.

Table of Contents

0. Install Tools

1. Basics

2. Inspect an APK

3. Search for Files and Directories

4. Inspect Files

5. SpotBugs

6. Deep Links

7. WebViews

8. Frida

9. Objection

10. Drozer

11. Intent Injections

12. Taskjacking

13. Tapjacking

14. Decompile an APK

15. Repackage an APK

16. Miscellaneous

17. Tips and Security Best Practices

18. Useful Websites and Tools

19. Vulnerable Apps

GitHub:

3 Likes