Notes

Static Analysis Android JADX-GUI https://github.com/skylot/jadx Produces java source code from Android Dex and APK files for static analysis. In Kali, sudo apt-get install default-jdk jadx Android Manifest minSDKVersion Permissions what data and hardware components the app needs (or have) access to full list: https://developer.android.com/reference/android/Manifest.permission Activities UI elements / different “screens” in the application protected activities performed through intent-filters exported="True" activity can be accessed from outside the application Content Providers serve data to other applications, e....

1. Define the Scope Understand the Application: Identify the platform (iOS, Android, or both). Determine the app’s purpose and functionality. Clarify if backend services (APIs, databases, etc.) are included in the scope. Obtain Permission: Ensure explicit authorization from the client or app owner. Identify Testing Environment: Specify if testing will be done on a live app, a staging environment, or a development build. 2. Gather Information (Reconnaissance) Analyze the App: Download the app (from app stores or provided APK/IPA file)....

MobSF (Mobile Security Framework) performs static analysis to evaluate the security of mobile applications without executing them. Static analysis in MobSF entails examining the app’s source code, decompiled code, or binary for security vulnerabilities, privacy issues, and best practices violations. Below are the types of testing it covers during static analysis: 1. Code Review and Analysis Source Code Analysis: If source code is available, MobSF inspects it for insecure coding practices, such as: Hardcoded credentials or sensitive data....