Hey There, Back again! 😄

Free Link

If you’ve read my first post on Android Pentesting Fundamentals, welcome back! And if you aree new here, no worries feel free to start from here and hop back later.

Covered topics in the post — what is static analysis, multiple methods to extract an apk file, reverse engineering of an apk, what to check in manifest file, how to get smali file, what to check in strings.xml and smali file, jdax-gui, automating static analysis using mobsf.

This post is all about Static Analysis, reversing APKs, decompiling code, and finding vulnerabilities without running the app..

Just like before, these are my learning notes. If you are someone trying to make sense of Android pentesting, I hope this helps you too …😄

It’s all about checking an app’s code without running it on a device. We extract the Android APK and examine files like Smali code, native libraries, configuration files like Android Manifest, decompiled Java code, and more to find vulnerabilities or bad coding practices. For example — Insecure storage, Hardcoded sensitive information, Insecure permissions and more.

APK Extraction

Most android apps are installed via play stores which handles everything automatically but for static analysis will require the raw APK…