/android-pentest

Android Application Security Testing Checklist

Comprehensive checklist for Android penetration testing engagements.

Pre-Assessment

• Obtain proper authorization and scope documentation
• Set up testing environment (rooted device, emulator, proxy)
• Install required tools (Frida, objection, jadx, apktool)
• Verify ADB connectivity and root access
• Document target application version and metadata

Information Gathering

Application Metadata

• Extract APK from device
• Document package name and version
• Identify target/min SDK versions
• Extract signing certificate info
• Check if app is debuggable
• List requested permissions
• Identify third-party libraries/SDKs

AndroidManifest.xml Analysis

• Check android:debuggable flag
• Check android:allowBackup flag
• Check android:usesCleartextTraffic setting
• Identify exported activities
• Identify exported services
• Identify exported broadcast receivers
• Identify exported content providers
• Review custom permissions
• Analyze intent filters and deep links
• Check for network security config reference

Static Analysis

Source Code Review

• Decompile APK (jadx/apktool)
• Search for hardcoded credentials/secrets
• Identify API keys (AWS, Google, Firebase)
• Check for hardcoded URLs/endpoints
• Review authentication logic
• Review authorization checks
• Identify cryptographic implementations
• Check for weak crypto algorithms
• Review logging statements
• Check for SQL query construction
• Review WebView implementations
• Identify native library usage
• Check for root detection logic
• Check for emulator detection
• Check for tamper detection

Network Security Config

• Review certificate pinning configuration
• Check for cleartext traffic exceptions
• Verify trust anchor configuration
• Check debug-overrides section

Native Libraries

• Extract .so files
• Check for exported symbols
• Identify dangerous functions (system, exec)
• Review string references in binaries

Dynamic Analysis

Runtime Behavior

• Monitor application logs (logcat)
• Trace file system access
• Monitor network connections
• Track IPC communications
• Observe clipboard usage

Traffic Analysis

• Configure proxy (Burp/mitmproxy)
• Install CA certificate on device
• Bypass SSL pinning if present
• Capture and analyze HTTP(S) traffic
• Identify API endpoints
• Check for sensitive data in transit
• Test for certificate validation
• Check for proper TLS configuration

Frida/Objection Testing

• Bypass root detection
• Bypass SSL pinning
• Hook authentication methods
• Dump encryption keys
• Monitor crypto operations
• Trace sensitive method calls
• Modify return values
• Dump memory for secrets

Data Storage Security

Shared Preferences

• List all SharedPreferences files
• Check for sensitive data storage
• Verify encryption of sensitive values
• Check file permissions

SQLite Databases

• List all database files
• Check for unencrypted databases
• Search for sensitive data in tables
• Test for SQL injection via content providers
• Check file permissions

Files and Cache

• Review internal storage files
• Check cache directory contents
• Review external storage usage
• Check for world-readable files
• Search for sensitive file types

Android Keystore

• Identify keystore usage
• Check key generation parameters
• Verify biometric protection
• Test key extraction possibilities

Component Security

Activities

• Test exported activity access
• Attempt to bypass authentication screens
• Test deep link handling
• Check for intent injection
• Test with malformed intents

Content Providers

• Enumerate content provider URIs
• Test query operations
• Test insert/update/delete operations
• Check for SQL injection
• Test path traversal
• Verify permission enforcement

Broadcast Receivers

• Identify registered receivers
• Test exported receivers
• Send crafted broadcasts
• Check for sensitive data exposure

Services

• Identify bound/started services
• Test exported service access
• Check for sensitive operations

Authentication & Session Management

• Test authentication bypass
• Check password policy enforcement
• Test brute force protection
• Verify session token randomness
• Check session timeout
• Test session invalidation on logout
• Check for session fixation
• Test biometric authentication bypass
• Check for credential caching

Cryptography

• Identify crypto algorithms used
• Check for weak algorithms (MD5, SHA1, DES, RC4)
• Verify proper key lengths
• Check IV randomness
• Verify secure key storage
• Check for ECB mode usage
• Review PRNG usage
• Test for crypto bypass possibilities

Security Controls

Root Detection

• Identify root detection mechanism
• Test bypass with Magisk Hide
• Test bypass with Frida
• Document bypass method

Emulator Detection

• Identify emulator detection
• Test bypass techniques
• Document findings

Tamper Detection

• Identify integrity checks
• Test signature verification bypass
• Attempt APK modification and reinstall

Code Obfuscation

• Evaluate obfuscation level
• Check string encryption
• Review control flow obfuscation

API Security

• Test API authentication
• Check for IDOR vulnerabilities
• Test parameter tampering
• Check rate limiting
• Test input validation
• Check for mass assignment
• Review API versioning
• Test for information disclosure

WebView Security

• Check JavaScript enabled setting
• Test addJavascriptInterface usage
• Check file access settings
• Test for XSS vulnerabilities
• Check for insecure deeplink handling
• Test SSL error handling

Reporting

• Document all findings with evidence
• Classify findings by OWASP Mobile Top 10
• Assign severity ratings (CVSS)
• Provide reproduction steps
• Include remediation recommendations
• Create executive summary

Post-Assessment

• Clean up test data from device
• Remove proxy certificates
• Securely delete extracted APKs/data
• Archive engagement artifacts