android-apk-reverse-engineering

Name: android-apk-reverse-engineering
Author: ShulkwiSEC

18stars5forks

How to install android-apk-reverse-engineering?

shulkwisec/bb-huge/android-apk-reverse-engineering

$npx -y skills add ShulkwiSEC/bb-huge --skill android-apk-reverse-engineering

Installs into the current project.

Summary

Decompile, analyze, and reverse engineer Android applications (APKs). Utilize tools like JADX, Apktool, and dex2jar to extract source code (Java/Kotlin), analyze manifest configurations (Intents, Activities), and identify hardcoded secrets or insecure API endpoints.

Files · 1

View on GitHub

SKILL.md

1	# Android APK Reverse Engineering
2
3	## When to Use
4	- When initiating a mobile application penetration test (Black-box or Gray-box).
5	- To discover hidden API endpoints, pre-production authentication tokens, or AWS credentials accidentally compiled into the release application.
6	- To understand how the application handles cryptography, SSL pinning, or local data storage before attempting dynamic instrumentation (e.g., Frida).
7
8
9	## Prerequisites
10	- Authorized scope and rules of engagement for the target environment
11	- Appropriate tools installed on the attack/analysis platform
12	- Understanding of the target technology stack and architecture
13	- Documentation template ready for findings and evidence capture
14
15	## Workflow
16
17	### Phase 1: Obtaining the APK
18
19	```bash
20	# Concept: Unless the client provides the APK directly, you must pull it from a physical
21	# device or emulator, or download it from a third-party mirroring site (e.g., APKMirror).
22
23	# 1. Connect Android Device (via USB or Emulator)
24	adb devices
25
26	# 2. Locate the package name of the target app
27	adb shell pm list packages \| grep "targetbank"
28	# Output: `package:com.bank.targetapp`
29
30	# 3. Find the physical path to the APK on the device
31	adb shell pm path com.bank.targetapp
32	# Output: `package:/data/app/~~xxxxx==/com.bank.targetapp-yyyyy==/base.apk`
33
34	# 4. Pull the APK to your local machine
35	adb pull /data/app/~~xxxxx==/com.bank.targetapp-yyyyy==/base.apk targetapp.apk
36	```
37
38	### Phase 2: Static Reconnaissance (Apktool)
39
40	```bash
41	# Concept: An APK is fundamentally a ZIP archive containing compiled Dalvik Executables (.dex),
42	# resources, and XML manifests. Apktool specifically decodes the binary `AndroidManifest.xml`
43	# back to human-readable XML and decompiles the DEX into Smali (assembly-like code).
44
45	# 1. Decode the APK
46	apktool d targetapp.apk -o targetapp_source
47
48	# 2. Analyze the `AndroidManifest.xml`
49	# Specifically look for:
50	# - `android:allowBackup="true"` (Allows data extraction via adb backup)
51	# - `android:debuggable="true"` (Critical vulnerability allowing code injection)
52	# - Exported Activities: `<activity android:name=".HiddenAdminPanel" android:exported="true">`
53	# (Can be launched directly by other apps on the phone without logging in!)
54
55	# 3. Search for Hardcoded Secrets
56	grep -r "AKIA" targetapp_source/
57	grep -ir "password" targetapp_source/res/values/strings.xml
58	```
59
60	### Phase 3: Source Code Recovery (JADX)
61
62	```bash
63	# Concept: While Smali code (from Apktool) is useful for modifying the app, it is
64	# incredibly difficult to read. We use JADX to decompile the DEX files back into
65	# highly readable Java/Kotlin code.
66
67	# 1. Launch JADX GUI (or use the command line `jadx -d out targetapp.apk`)
68	jadx-gui targetapp.apk
69
70	# 2. Source Code Review Focus Areas:
71	# - Networking/API: Search for `Retrofit`, `OkHttp`, `baseUrl`.
72	# - Cryptography: Search for `Cipher.getInstance("AES/ECB`, `MessageDigest`. (ECB mode is insecure!)
73	# - SSL Pinning: Search for `TrustManager`, `checkServerTrusted`, or custom certificate validation logic.
74	# - Local Storage: Search for `SharedPreferences`, `SQLiteDatabase`, files written to `/sdcard`.
75
76	# 3. Understanding Control Flow:
77	# Trace how a user logs in. Right-click the `.login()` method and select "Find Usage" to
78	# trace the backend API execution path to discover hidden API parameters.
79	```
80
81	### Phase 4: Recompiling and Signing (Patching)
82
83	```bash
84	# Concept: If you discovered SSL Pinning preventing Burp Suite from intercepting traffic,
85	# you can modify the Smali code to bypass it, recompile the APK, and install the modified
86	# version onto your device.
87
88	# 1. Bypass the pinning script (e.g., delete the exception throw in Smali).
89
90	# 2. Rebuild the APK
91	apktool b targetapp_source -o targetapp_patched_unsigned.apk
92
93	# 3. Generate a fake Developer Key
94	keytool -genkey -v -keystore my-release-key.keystore -alias alias_name -keyalg RSA -keysize 2048 -validity 10000
95
96	# 4. Sign the Modified APK
97	apksigner sign --ks my-release-key.keystore --out targetapp_patched.apk targetapp_patched_unsigned.apk
98
99	# 5. Install the Patched App
100	adb install targetapp_patched.apk
101
102	# You can now intercept traffic in Burp Suite unimpeded.
103	```
104
105	#### Decision Point 🔀
106	```mermaid
107	flowchart TD
108	A[Obtain APK File] --> B[

People who liked this also viewed

6 picks

Type

android-apk-reverse-engineering

18stars5forks

View on GitHub

How to install android-apk-reverse-engineering?

shulkwisec/bb-huge/android-apk-reverse-engineering

$npx -y skills add ShulkwiSEC/bb-huge --skill android-apk-reverse-engineering

Installs into the current project.

Summary

Files · 1

View on GitHub

SKILL.md

1	# Android APK Reverse Engineering
2
3	## When to Use
4	- When initiating a mobile application penetration test (Black-box or Gray-box).
5	- To discover hidden API endpoints, pre-production authentication tokens, or AWS credentials accidentally compiled into the release application.
6	- To understand how the application handles cryptography, SSL pinning, or local data storage before attempting dynamic instrumentation (e.g., Frida).
7
8
9	## Prerequisites
10	- Authorized scope and rules of engagement for the target environment
11	- Appropriate tools installed on the attack/analysis platform
12	- Understanding of the target technology stack and architecture
13	- Documentation template ready for findings and evidence capture
14
15	## Workflow
16
17	### Phase 1: Obtaining the APK
18
19	```bash
20	# Concept: Unless the client provides the APK directly, you must pull it from a physical
21	# device or emulator, or download it from a third-party mirroring site (e.g., APKMirror).
22
23	# 1. Connect Android Device (via USB or Emulator)
24	adb devices
25
26	# 2. Locate the package name of the target app
27	adb shell pm list packages \| grep "targetbank"
28	# Output: `package:com.bank.targetapp`
29
30	# 3. Find the physical path to the APK on the device
31	adb shell pm path com.bank.targetapp
32	# Output: `package:/data/app/~~xxxxx==/com.bank.targetapp-yyyyy==/base.apk`
33
34	# 4. Pull the APK to your local machine
35	adb pull /data/app/~~xxxxx==/com.bank.targetapp-yyyyy==/base.apk targetapp.apk
36	```
37
38	### Phase 2: Static Reconnaissance (Apktool)
39
40	```bash
41	# Concept: An APK is fundamentally a ZIP archive containing compiled Dalvik Executables (.dex),
42	# resources, and XML manifests. Apktool specifically decodes the binary `AndroidManifest.xml`
43	# back to human-readable XML and decompiles the DEX into Smali (assembly-like code).
44
45	# 1. Decode the APK
46	apktool d targetapp.apk -o targetapp_source
47
48	# 2. Analyze the `AndroidManifest.xml`
49	# Specifically look for:
50	# - `android:allowBackup="true"` (Allows data extraction via adb backup)
51	# - `android:debuggable="true"` (Critical vulnerability allowing code injection)
52	# - Exported Activities: `<activity android:name=".HiddenAdminPanel" android:exported="true">`
53	# (Can be launched directly by other apps on the phone without logging in!)
54
55	# 3. Search for Hardcoded Secrets
56	grep -r "AKIA" targetapp_source/
57	grep -ir "password" targetapp_source/res/values/strings.xml
58	```
59
60	### Phase 3: Source Code Recovery (JADX)
61
62	```bash
63	# Concept: While Smali code (from Apktool) is useful for modifying the app, it is
64	# incredibly difficult to read. We use JADX to decompile the DEX files back into
65	# highly readable Java/Kotlin code.
66
67	# 1. Launch JADX GUI (or use the command line `jadx -d out targetapp.apk`)
68	jadx-gui targetapp.apk
69
70	# 2. Source Code Review Focus Areas:
71	# - Networking/API: Search for `Retrofit`, `OkHttp`, `baseUrl`.
72	# - Cryptography: Search for `Cipher.getInstance("AES/ECB`, `MessageDigest`. (ECB mode is insecure!)
73	# - SSL Pinning: Search for `TrustManager`, `checkServerTrusted`, or custom certificate validation logic.
74	# - Local Storage: Search for `SharedPreferences`, `SQLiteDatabase`, files written to `/sdcard`.
75
76	# 3. Understanding Control Flow:
77	# Trace how a user logs in. Right-click the `.login()` method and select "Find Usage" to
78	# trace the backend API execution path to discover hidden API parameters.
79	```
80
81	### Phase 4: Recompiling and Signing (Patching)
82
83	```bash
84	# Concept: If you discovered SSL Pinning preventing Burp Suite from intercepting traffic,
85	# you can modify the Smali code to bypass it, recompile the APK, and install the modified
86	# version onto your device.
87
88	# 1. Bypass the pinning script (e.g., delete the exception throw in Smali).
89
90	# 2. Rebuild the APK
91	apktool b targetapp_source -o targetapp_patched_unsigned.apk
92
93	# 3. Generate a fake Developer Key
94	keytool -genkey -v -keystore my-release-key.keystore -alias alias_name -keyalg RSA -keysize 2048 -validity 10000
95
96	# 4. Sign the Modified APK
97	apksigner sign --ks my-release-key.keystore --out targetapp_patched.apk targetapp_patched_unsigned.apk
98
99	# 5. Install the Patched App
100	adb install targetapp_patched.apk
101
102	# You can now intercept traffic in Burp Suite unimpeded.
103	```
104
105	#### Decision Point 🔀
106	```mermaid
107	flowchart TD
108	A[Obtain APK File] --> B[

People who liked this also viewed

6 picks

Type