Android App Penetration Testing 101

### Overview In this presentation, Jeff (Yoda66) and Derek Banks from Black Hills Information Security deliver an introductory overview of Android mobile application penetration testing. The speakers discuss the Android security model, market share landscape, key architectural components, required tooling, and practical testing methodologies. The session culminates in a technical explanation and live demonstration showing how to disassemble, modify, back-door, recompile, and sign a legitimate Android application with an embedded Metasploit Meterpreter payload.

### Key Topics - **Android Market Share and Risk Landscape**: Android commands over 80% worldwide market share, featuring an open ecosystem where users frequently run older operating system versions (such as Lollipop, Marshmallow, or Nougat). Risks include enterprise data stored in applications, insecure dependencies, cleartext credential storage, and malicious or modified side-loaded apps. - **Testing Environment and Tooling**: Setting up a dedicated mobile testing workbench requires tools like Android Studio (with AVD), Genymotion (x86-based emulator with VirtualBox), real rooted hardware devices (such as Google/Motorola Nexus devices), Jadx/Jadx-GUI for decompilation, Drozer for inter-process communication assessments, apktool for smali disassembly, and Mobile Security Framework (MobSF) for automated static and dynamic analysis. - **Testing Methodology**: Pen testing mobile apps encompasses reconnaissance, filesystem analysis, network communication interception, and code review. Common methodology references include the OWASP Mobile Top 10 and Josh Wright's mobile device report cards. - **Inter-Process Communication and Intents**: Android apps communicate via intents and broadcast receivers. Improperly filtered intents or vulnerable upstream libraries can expose internal functionality—such as accidentally exposing debug logging containing sensitive session cookies to the system log (logcat).

### Technical Details - **Filesystem and Storage Analysis**: Android applications install by default into `/data/data/<app-package-name>/`. Testers can use `adb pull` before and after authenticating or interacting with an app, then run a diff to identify insecure data storage, including cleartext credentials and session tokens. - **Network Traffic Interception**: Web traffic can be proxied using Burp Suite by generating its CA certificate, pushing it via `adb` (e.g., to `/sdcard/Download`), and installing it into the device's trusted credentials. Full packet capture can also be conducted using a software AP combined with Wireshark, tcpdump, or Bro. - **Intent Exploitation with Drozer**: By port-forwarding TCP port 31415 using `adb forward tcp:31415 tcp:31415`, testers connect a host Drozer console to an on-device Drozer agent to stimulate exported activities, broadcast receivers, and services. - **Backdooring APKs**: Disassembling an APK with `apktool` produces smali assembly files and extracts the binary `AndroidManifest.xml`. Meterpreter stagers generated by Metasploit can be disassembled into smali, copied into the target app's package structure, and called inside `onCreate` in the main activity file. Jeff demonstrated his Python automation script (`Android_EmbedIT` on GitHub) which decompiles both APKs, parses the XML to find the main activity entry point, injects the stager call, randomizes directory paths to evade simple detection, merges permissions, reassembles the app, and signs it with a newly generated keystore before launching a live reverse TCP Meterpreter handler.

### Takeaways Android's openness and decoupled components provide substantial attack surface, especially when apps accept uncontrolled intents or rely on third-party libraries. Manual checks via ADB, decompilers like Jadx, and tools like MobSF and Drozer allow testers to rapidly locate serious flaws such as cleartext storage, leaky log files, and tampering opportunities. Organizations and users must exercise caution with side-loading APKs outside official app stores, and developers should use practice targets like DIVA (Damn Insecure Vulnerable App) to learn secure coding and validation practices.