Back to home
Mobile Hacking

Mobile Hacking Methodology

Android and iOS application security testing — static analysis, dynamic instrumentation, traffic interception, and OWASP Mobile Top 10.

🤖

Android

## Static Analysis

A1

APK Unpacking & Reverse Engineering

  • › Pull APK: adb shell pm path <pkg> + adb pull <path>
  • › Decompile with jadx-gui — read Java/Kotlin source
  • › Smali analysis for obfuscated code with apktool
  • › Strings & secrets: grep -r 'API\|key\|token\|pass' decomp/
  • › Check AndroidManifest.xml — exported activities, permissions, backup flag
A2

Sensitive Data & Hardcoded Secrets

  • › Hardcoded API keys, tokens, credentials in source/resources
  • › Insecure SharedPreferences — world-readable data
  • › SQLite databases on device: /data/data/<pkg>/databases/
  • › Unprotected log statements exposing PII or tokens
  • › Firebase / S3 bucket misconfigurations in config files

## Dynamic Analysis

A3

Runtime Instrumentation with Frida

  • › Bypass root detection: frida -U -l bypass-root.js -f <pkg>
  • › Bypass SSL pinning: objection -g <pkg> explore → android sslpinning disable
  • › Hook sensitive methods: crypto, auth, network calls
  • › Enumerate classes and methods at runtime
  • › Modify return values to bypass license / auth checks
A4

Traffic Interception

  • › Proxy via Burp: adb connect + proxy settings + install CA cert
  • › Certificate pinning bypass: objection / Frida scripts / apk-patch
  • › Analyze WebSocket, gRPC, and binary protocol traffic
  • › Test API endpoints discovered from traffic: IDOR, auth, input validation
  • › Re-sign patched APK: apksigner / uber-apk-signer
A5

Intent & Component Attacks

  • › Exported activities: adb shell am start -n <pkg>/<activity>
  • › Exported content providers: adb shell content query --uri content://<auth>
  • › Broadcast receivers — injection via intent extras
  • › Deep link abuse — parameter injection via custom URI scheme
  • › Task hijacking / StrandHogg attacks
🍎

iOS

## Static Analysis

I1

IPA Extraction & Binary Analysis

  • › Decrypt binary on jailbroken device: frida-ios-dump / bfdecrypt
  • › Binary analysis: class-dump for headers, strings, symbols
  • › Decompile with Ghidra / Hopper / IDA Pro
  • › Info.plist review — URL schemes, permissions, ATS exceptions
  • › Entitlements check: codesign -d --entitlements - <binary>
I2

Sensitive Data Storage

  • › Keychain enumeration on jailbroken: keychain-dumper
  • › NSUserDefaults / plist files in app sandbox
  • › Insecure CoreData / SQLite storage
  • › Log files, caches, screenshots in app container
  • › Clipboard exposure of sensitive data

## Dynamic Analysis

I3

Frida on iOS

  • › Install frida-server on jailbroken device via Cydia / Sileo
  • › SSL pinning bypass: objection -g <pkg> explore → ios sslpinning disable
  • › Frida CodeShare scripts for common bypasses (root, jail, pin)
  • › Hook ObjC methods: ObjC.classes[ClassName]['- methodName'].implementation
  • › Monitor sensitive API calls: keychain, NSURLSession, crypto
I4

Traffic Interception

  • › Proxy: install Burp CA via OTA profile or Settings → General → Profile
  • › Check NSAppTransportSecurity / NSAllowsArbitraryLoads in plist
  • › Bypass certificate pinning with SSL Kill Switch 2 (tweak)
  • › Analyze traffic for insecure endpoints, token exposure
  • › Test for authentication bypass in API endpoints

## OWASP Mobile Top 10 Reference

M1Improper Credential Usage
M2Inadequate Supply Chain Security
M3Insecure Authentication / Authorization
M4Insufficient Input/Output Validation
M5Insecure Communication
M6Inadequate Privacy Controls
M7Insufficient Binary Protections
M8Security Misconfiguration
M9Insecure Data Storage
M10Insufficient Cryptography

## Tools Reference

// android

jadx-guiapktoolobjectionfridaadbBurp SuiteapksignerdrozerMobSF

// iOS

fridaobjectionBurp SuiteGhidraHopperclass-dumpCycriptSSL Kill Switch 2MobSF

## Key Resources