Android App Penetration Testing

Introduction

• Pentesting Android apps
• What you should know
• Overview of Android

1. Android Application Components

• Activity and services
• Content providers and receivers

2. Aspects of Android Security

• Web vs. Android security
• Domains of Android security
• Common terminologies
• Lab setup

3. Static Application Testing

• Introduction to MobSF
• Setting up MobSF
• Scanning target applications
• Manifest analysis
• Code analysis

4. Dynamic Application Testing, Part 1

• Introduction to Burp Suite
• Burp Suite setup on workstation
• Burp Suite setup on test device
• Application testing: Brute force
• Application testing: Password change

5. Platform Interaction Testing

• Introduction to Android Debug Bridge
• Basic adb commands
• Testing platform: Insecure logging
• Testing platform: Insecure data storage

6. Dynamic Application Testing, Part 2

• Introduction to drozer
• drozer architecture
• drozer setup
• Sieve application overview
• Basic commands
• Activity testing
• Content provider testing
• Content provider testing: SQL injection

Conclusion

• Mobile OWASP Top 10
• Next steps