maride/hacktricks
1
0
Fork 0
mirror of https://github.com/HackTricks-wiki/hacktricks.git synced 2025-10-10 18:36:50 +00:00
Code Issues Packages Projects Releases Wiki Activity

Add content from: Research Update: Enhanced src/mobile-pentesting/android-chec...

Browse Source
This commit is contained in:
HackTricks News Bot 2025-08-06 16:29:50 +00:00
parent 0f0e4e0900
commit 0f5849369b
1 changed files with 29 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

32
src/mobile-pentesting/android-checklist.md
View File

@ -38,6 +38,18 @@
- [ ] All the libraries compiled using the PIE flag?
- [ ] Don't forget that there is a bunch of[ static Android Analyzers](android-app-pentesting/index.html#automatic-analysis) that can help you a lot during this phase.
#### 2023-2025 specific checks
- [ ] `android:exported` **mandatory on Android 12+** – misconfigured exported components can lead to external intent invocation.
- [ ] Review **Network Security Config** (`networkSecurityConfig` XML) for `cleartextTrafficPermitted="true"` or domain-specific overrides.
- [ ] Look for calls to **Play Integrity / SafetyNet / DeviceCheck** – determine whether custom attestation can be hooked/bypassed.
- [ ] Inspect **App Links / Deep Links** (`android:autoVerify`) for intent-redirection or open-redirect issues.
- [ ] Identify usage of **WebView.addJavascriptInterface** or `loadData*()` that may lead to RCE / XSS inside the app.
- [ ] Analyse cross-platform bundles (Flutter `libapp.so`, React-Native JS bundles, Capacitor/Ionic assets). Dedicated tooling:
- `flutter-packer`, `fluttersign`, `rn-differ`
- [ ] Scan third-party native libraries for known CVEs (e.g., **libwebp CVE-2023-4863**, **libpng**, etc.).
- [ ] Evaluate **SEMgrep Mobile rules**, **Pithus** and the latest **MobSF ≥ 3.9** AI-assisted scan results for additional findings.
### [Dynamic Analysis](android-app-pentesting/index.html#dynamic-analysis)
- [ ] Prepare the environment ([online](android-app-pentesting/index.html#online-dynamic-analysis), [local VM or physical](android-app-pentesting/index.html#local-dynamic-analysis))
@ -53,12 +65,26 @@
- [ ] Check for possible [Android Client Side Injections](android-app-pentesting/index.html#android-client-side-injections-and-others) (probably some static code analysis will help here)
- [ ] [Frida](android-app-pentesting/index.html#frida): Just Frida, use it to obtain interesting dynamic data from the application (maybe some passwords...)
#### 2023-2025 attack surface additions
- [ ] Test for **Tapjacking / Animation-driven attacks (TapTrap 2025)** even on Android 15+ (no overlay permission required).
- [ ] Attempt **overlay / SYSTEM_ALERT_WINDOW clickjacking** and **Accessibility Service abuse** for privilege escalation.
- [ ] Check if `adb backup` / `bmgr backupnow` can still dump app data (apps that forgot to disable `allowBackup`).
- [ ] Probe for **Binder-level LPEs** (e.g., **CVE-2023-20963, CVE-2023-20928**); use kernel fuzzers or PoCs if permitted.
- [ ] If Play Integrity / SafetyNet is enforced, try runtime hooks (`Frida Gadget`, `MagiskIntegrityFix`, `Integrity-faker`) or network-level replay.
- [ ] Instrument with modern tooling:
- **Objection > 2.0**, **Frida 17+**, **NowSecure-Tracer (2024)**
- Dynamic system-wide tracing with `perfetto` / `simpleperf`.
### Some obfuscation/Deobfuscation information
- [ ] [Read here](android-app-pentesting/index.html#obfuscating-deobfuscating-code)
## References
- [TapTrap: Animation-Driven Tapjacking on Android – USENIX Security 2025](https://www.usenix.org/conference/usenixsecurity25/presentation/beer)
- [NVD: CVE-2023-20963 – Android WorkSource parcel mismatch local privilege escalation](https://nvd.nist.gov/vuln/detail/CVE-2023-20963)
{{#include ../banners/hacktricks-training.md}}