svc-mobile-android

Files (1)

• SKILL.md

SKILL.md (first lines)

# Android APK Static Analysis — Full Methodology

Load this skill when the target is an Android APK (decompiled or not). This covers SAST — for dynamic testing (Frida, MITM), combine with `playbook-webapp`.

## Task Decomposition — MANDATORY

An APK audit is NOT one grep job. Decompose into these independent tasks (run in parallel):

1. **API Security Audit** — read ALL Retrofit/API interface files, find sensitive data in URLs
2. **Transport Security** — network_security_config, certificate pinning, cleartext
3. **Auth Flow Analysis** — full auth chain, session management, token handling
4. **Component Security** — exported activities/receivers/providers/services, intent filters, deep links
5. **Build Hygiene** — debug flags, dev tools in production, staging endpoints, logging
6. **Secrets & Crypto** — hardcoded keys (but FILTER non-issues — see Known Non-Vulns below)
7. **Data Storage** — SharedPreferences, Room/SQLite, file storage, backup flags
8. **Root/Tamper Detection** — what's present AND what's MISSING

## How to Read Decompiled Code

### Smali basics (you'll see this from apktool/baksmali)
```
.method public someMethod(Ljava/lang/String;)V   # method signature
invoke-virtual {v0}, Lcom/example/Foo;->bar()V    # method call
const-string v1, "hardcoded_value"                # string constant
sget-object v0, Lcom/example/Config;->API_KEY:Ljava/lang/String;  # static field
```

### Retrofit annotations in smali (THE most important pattern)
```smali
# @GET("endpoint") — HTTP method + path
.annotation runtime Lretrofit2/http/GET;
    value = "auth/password"
.end annotation

# @Query("password") — parameter goes in URL query string!
.annotation runtime Lretrofit2/http/Query;
    value = "password"
.end annotation

# @QueryMap — ALL params go in URL query string!
.annotation runtime Lretrofit2/http/QueryMap;
.end annotation

# @Body — parameter goes in request body (SAFE)
.annotation runtime Lretrofit2/http/Body;
.end annotation

# @Field — parameter goes in form body (SAFE)
.annotation runtime Lretrofit2/http/Field;
    value = "password"
.end annotation

# @Header — parameter sent as HTTP header
.annotation runtime Lretrofit2/http/Header;
    value = "Authorization"
.end annotation
```

**CRITICAL CHECK**: Any `@Query`/`@QueryMap` on a POST/PUT that carries sensitive data (password, PIN, OTP, token) = **CRITICAL** finding. Sensitive data in URL is logged everywhere (server access logs, proxies, CDNs, browser history, HTTP interceptors).

### Jadx output (Java-like, easier to read)
```java
@POST("auth/password")
Call<AuthResponse> login(@QueryMap Map<String, String> params);
// ^ This means login credentials go in URL query string = CRITICAL
```

## Checklist: OWASP Mobile Top 10

### M1: Improper Platform Usage
- [ ] Exported components without permission protection
- [ ] Deep links with sensitive actions (password reset, transfers)
- [ ] Content providers with `grant-uri-permissions` or no read/write permission
- [ ] Intent filters on activities that handle sensitive data
- [ ] `android:debuggable="true"` in manifest
- [ ] `android:allowBackup="true"` (data extractable via ADB)
- [ ] `android:usesCleartextTraffic="true"`
```bash
grep -r 'exported="true"' resources/AndroidManifest.xml
grep -r 'android:debuggable' resources/AndroidManifest.xml
grep -r 'allowBackup' resources/AndroidManifest.xml
```

### M2: Insecure Data Storage
- [ ] Sensitive data in SharedPreferences (tokens, passwords, PII)
- [ ] Unencrypted SQLite/Room databases with sensitive data
- [ ] Sensitive data in external storage
- [ ] Logging of sensitive data (Log.d/Log.i with tokens/credentials)
```bash
# SharedPreferences usage
grep -rn "SharedPreferences\|getSharedPreferences\|PreferenceManager" sources/
# Logging sensitive data
grep -rn "Log\.\(d\|i\|v\|w\|e\)" sources/ | grep -i "token\|password\|secret\|key\|auth"
# External storage
grep -rn "getExternalStorage\|EXTERNAL_STORAGE\|Environment.getExternalStorageDirectory" sources/
```

### M3: Insecure Communication
- [ ] **Certificate pinning** — check network_security_config.xml for `<pin-set>` elements
- [ ] **Cleartext traffic** — `cleartextTrafficPermitted` should be false
- [ ] **Custom TrustManager** — accepting all certs (X509TrustManager with empty checkServerTrusted)
- [ ] **HostnameVerifier** — custom verifier that always returns true
- [ ] **WebView** — `setMixedContentMode(MIXED_CONTENT_ALWAYS_ALLOW)`
```bash
# Certificate pinning
grep -r "pin-set\|CertificatePinner\|sha256/" resources/ sources/
# Trust all certs
grep -rn "X509TrustManager\|checkServerTrusted\|TrustAllCerts\|ALLOW_ALL" sources/
# Hostname verifier bypass
grep -rn "HostnameVerifier\|ALLOW_ALL_HOSTNAME_VERIFIER\|verify.*return true" sources/
```

### M4: Insecure Authentication
- [ ] Auth credentials in URL query params (`@Query`/`@QueryMap` on auth endpoints)
- [ ] Biometric auth without server-side validation (local-only bypass)
- [ ] Hardcoded credentials (admin/password patterns in code)
- [ ] Token storage (where is the auth token kept? SharedPrefs? Encrypted?)
- [ ] Session timeout — is there an expiry? Auto-logout?
- [ ] PIN/pattern stored locally (hash vs plaintext)

From s0ld13rr/pentestcode, MIT.

More from s0ld13rr/pentestcode