← All cheat sheets

🌶 MOBILE-PENTESTING

Authorized use only. Offensive reference for systems you own or are explicitly permitted to test. You are responsible for staying within the law.

Comprehensive guide to mobile application security testing
covering both Android and iOS platforms.

Android Lab:
  Emulators:
    - Android Studio AVD (official)
    - Genymotion (fast, rooted by default)
    - Corellium (cloud-based, ARM)

  Physical device:
    - Rooted Android device recommended
    - Magisk for systemless root
    - Developer Options > USB Debugging enabled

  Key tools:
    pip install frida-tools objection
    apt install adb apktool jadx dex2jar

  Proxy setup (Burp Suite):
    1. Set Burp proxy to listen on all interfaces
    2. Device WiFi > Proxy > Manual > host_IP:8080
    3. Visit http://burp/ on device to install CA cert
    4. For Android 7+: need to install as system cert

iOS Lab:
  Requirements:
    - macOS with Xcode
    - Jailbroken iOS device (checkra1n, unc0ver, palera1n)
    - Corellium (cloud-based alternative)

  Key tools:
    brew install libimobiledevice ideviceinstaller
    pip install frida-tools objection
    # On jailbroken device: install Cydia/Sileo packages

  Proxy setup:
    1. Install Burp CA cert via Safari
    2. Settings > General > About > Certificate Trust Settings
    3. Enable full trust for Burp cert
    4. WiFi settings > HTTP Proxy > Manual

# Device management
adb devices                              # list connected devices
adb connect <IP>:5555                    # connect wirelessly
adb shell                                # interactive shell
adb root                                 # restart adb as root

# Package management
adb shell pm list packages               # list all packages
adb shell pm list packages -3            # third-party apps only
adb shell pm list packages | grep <app>  # find specific app
adb shell pm path <package>              # get APK path
adb shell dumpsys package <package>      # detailed package info

# File operations
adb pull <remote> <local>                # download file
adb push <local> <remote>               # upload file
adb shell ls /data/data/<package>/       # app data directory

# App management
adb install app.apk                      # install APK
adb install -r app.apk                   # reinstall keeping data
adb uninstall <package>                  # uninstall
adb shell am start -n <package>/<activity>  # launch activity
adb shell am start -a android.intent.action.VIEW -d "http://evil.com"

# Logging
adb logcat                               # view all logs
adb logcat | grep <package>              # filter by app
adb logcat -c                            # clear log buffer
adb logcat *:E                           # errors only

# Screenshots and recording
adb shell screencap /sdcard/screen.png
adb shell screenrecord /sdcard/video.mp4

# Database access
adb shell run-as <package> sqlite3 databases/app.db ".tables"
adb shell run-as <package> sqlite3 databases/app.db "SELECT * FROM users;"

# Pull APK from device
adb shell pm path com.example.app
adb pull /data/app/com.example.app-1/base.apk ./app.apk

# Or use apk-extractor apps on device

Apktool (smali disassembly + resources):
  apktool d app.apk -o app_decoded/       # decode APK
  apktool b app_decoded/ -o modified.apk  # rebuild APK

  # Directory structure after decode:
  #   AndroidManifest.xml    - permissions, components, intent filters
  #   smali/                 - Dalvik bytecode (smali format)
  #   res/                   - resources (layouts, strings, drawables)
  #   assets/                - raw assets
  #   lib/                   - native libraries (.so files)

JADX (Java decompilation):
  jadx app.apk -d app_java/               # decompile to Java source
  jadx-gui app.apk                        # GUI decompiler

  # Search decompiled code for:
  grep -r "api_key\|apikey\|API_KEY" app_java/
  grep -r "password\|secret\|token" app_java/
  grep -r "http://\|https://" app_java/
  grep -r "MODE_WORLD_READABLE\|MODE_WORLD_WRITABLE" app_java/
  grep -r "SharedPreferences" app_java/
  grep -r "SQLiteDatabase" app_java/
  grep -r "Log\.\|System\.out" app_java/

dex2jar + JD-GUI:
  d2j-dex2jar app.apk -o app.jar          # convert to JAR
  jd-gui app.jar                           # view in JD-GUI

# Re-sign modified APK
keytool -genkey -v -keystore test.keystore -alias test -keyalg RSA -keysize 2048
apksigner sign --ks test.keystore modified.apk
# or
jarsigner -verbose -sigalg SHA1withRSA -digestalg SHA1 -keystore test.keystore modified.apk test

# Install Frida server on device
adb push frida-server-<version>-android-arm64 /data/local/tmp/
adb shell chmod 755 /data/local/tmp/frida-server
adb shell /data/local/tmp/frida-server &

# List running processes
frida-ps -U                              # USB-connected device
frida-ps -Ua                             # running apps only
frida-ps -Uai                            # installed apps

# Attach to running process
frida -U -n "App Name"
frida -U -f com.example.app              # spawn and attach

# Run a script
frida -U -f com.example.app -l hook.js

# Basic Java hook script (hook.js):
Java.perform(function() {
    var Activity = Java.use("com.example.app.LoginActivity");
    Activity.checkPassword.implementation = function(password) {
        console.log("Password: " + password);
        return true;  // bypass check
    };
});

# Hook all overloads of a method:
Java.perform(function() {
    var cls = Java.use("com.example.app.Crypto");
    cls.encrypt.overloads.forEach(function(overload) {
        overload.implementation = function() {
            console.log("encrypt called with: " + JSON.stringify(arguments));
            return overload.apply(this, arguments);
        };
    });
});

Method 1: Frida script
  # Universal SSL pinning bypass (Android)
  frida -U -f com.example.app -l ssl_pinning_bypass.js

  # Popular scripts:
  # - https://codeshare.frida.re/@pcipolloni/universal-android-ssl-pinning-bypass/
  # - https://codeshare.frida.re/@akabe1/frida-multiple-unpinning/

Method 2: Objection
  objection -g com.example.app explore
  android sslpinning disable

Method 3: Magisk module
  - Install MagiskTrustUserCerts module
  - Moves user CA certs to system trust store

Method 4: Apktool modification
  1. Decompile: apktool d app.apk
  2. Edit res/xml/network_security_config.xml:
     <network-security-config>
       <base-config>
         <trust-anchors>
           <certificates src="user" />
           <certificates src="system" />
         </trust-anchors>
       </base-config>
     </network-security-config>
  3. Rebuild and re-sign

Method 5: Android proxy with iptables (rooted)
  iptables -t nat -A OUTPUT -p tcp --dport 443 -j DNAT --to-destination <proxy_ip>:<proxy_port>

Jailbreak tools:
  - checkra1n: A5-A11 (hardware exploit, semi-tethered)
  - palera1n: A8-A11, iOS 15-17 (checkm8-based)
  - Dopamine: A12+ iOS 15 (KFD + kopen based)

Post-jailbreak setup:
  1. Install Cydia/Sileo package manager
  2. Install OpenSSH
  3. Install Frida from repo
  4. Change default passwords (root:alpine, mobile:alpine)

File system analysis:
  ssh root@<device_ip>
  # App sandbox: /var/mobile/Containers/Data/Application/<UUID>/
  # App binary:  /var/containers/Bundle/Application/<UUID>/
  # Keychain:    /var/Keychains/keychain-2.db

  # Find app directories
  find /var/mobile/Containers -name "*.plist" | grep <app>

  # Check for sensitive data in:
  #   Documents/    - user files
  #   Library/      - preferences, caches, cookies
  #   tmp/          - temporary files
  #   Library/Preferences/*.plist   - NSUserDefaults

  # Keychain dumper
  keychain-dumper                        # dump all keychain items

# Start Objection
objection -g <package_or_bundleid> explore

# Android commands
android sslpinning disable              # disable SSL pinning
android root disable                    # bypass root detection
android hooking list activities          # list activities
android hooking list services            # list services
android hooking list receivers           # list receivers
android hooking search classes <query>   # search classes
android hooking watch class <class>      # monitor all methods
android hooking watch class_method <method> --dump-args --dump-return
android clipboard monitor               # monitor clipboard
android intent launch_activity <activity>

# iOS commands
ios sslpinning disable                   # disable SSL pinning
ios jailbreak disable                    # bypass jailbreak detection
ios hooking list classes                 # list classes
ios hooking search classes <query>
ios hooking watch method "<class> <method>" --dump-args
ios keychain dump                        # dump keychain
ios plist cat <path>                     # read plist files
ios cookies get                          # get cookies
ios nsurlcredentialstorage dump          # stored credentials

# Cross-platform
env                                      # environment info
file download <remote> <local>           # download file
file upload <local> <remote>             # upload file
sqlite connect <db_path>                 # connect to SQLite DB
memory dump all <output_file>            # dump process memory
import <frida_script.js>                 # load custom Frida script

# Install and run
docker pull opensecurity/mobile-security-framework-mobsf
docker run -it --rm -p 8000:8000 opensecurity/mobile-security-framework-mobsf

# Access at http://localhost:8000
# Upload APK/IPA for automated analysis
# Results include:
#   - Manifest analysis (permissions, exported components)
#   - Code analysis (hardcoded secrets, insecure APIs)
#   - Binary analysis (PIE, stack canary, ARC)
#   - Network security configuration
#   - Certificate analysis
#   - Malware indicators

Burp Suite setup:
  1. Configure proxy listener (all interfaces, port 8080)
  2. Install CA cert on device
  3. Configure device proxy settings
  4. For HTTPS: bypass certificate pinning (see above)
  5. Scope: target only the app's domains

mitmproxy (CLI alternative):
  mitmproxy -p 8080                      # interactive mode
  mitmdump -p 8080 -w traffic.flow       # save traffic
  mitmweb -p 8080                        # web interface

  # Inline script to log requests
  mitmdump -s script.py

Key things to intercept:
  - Authentication tokens and session management
  - API endpoints and parameters
  - Hardcoded credentials in requests
  - Sensitive data in plaintext
  - Insecure HTTP connections
  - Certificate validation issues

1. Insecure data storage
   - SharedPreferences/NSUserDefaults with sensitive data
   - SQLite databases with plaintext credentials
   - Hardcoded API keys in source code
   - Sensitive data in application logs
   - Cache and clipboard data leakage

2. Insecure communication
   - Missing certificate pinning
   - HTTP used for sensitive data
   - Weak TLS configuration
   - Ignoring certificate errors

3. Authentication/Authorization
   - Weak password policies
   - Missing session timeout
   - Client-side authentication logic
   - Insecure token storage

4. Code tampering
   - No integrity checks
   - No obfuscation
   - Debug mode enabled in production
   - Missing root/jailbreak detection

5. Reverse engineering
   - Hardcoded secrets
   - Exposed API keys
   - Business logic in client code
   - No code obfuscation (ProGuard/R8)

[ ] Review AndroidManifest.xml for over-privileged permissions
[ ] Check for exported activities/services/receivers/providers
[ ] Test deep links and intent handling
[ ] Check WebView settings (JavaScript enabled, file access)
[ ] Verify backup flag (android:allowBackup="false")
[ ] Check for debuggable flag in production
[ ] Test content provider SQL injection
[ ] Check for tapjacking (filterTouchesWhenObscured)

[ ] Check ATS (App Transport Security) exceptions
[ ] Verify binary protections (PIE, stack canary, ARC)
[ ] Test URL scheme handling
[ ] Check for sensitive data in keychain (accessibility flags)
[ ] Verify snapshot/screenshot protection
[ ] Test pasteboard/clipboard data leakage
[ ] Check for third-party keyboard data
[ ] Review entitlements file

- OWASP Mobile Testing Guide (MASTG): https://mas.owasp.org/MASTG/
- OWASP Mobile Application Security: https://mas.owasp.org/
- Frida Documentation: https://frida.re/docs/
- Objection: https://github.com/sensepost/objection
- MobSF: https://github.com/MobSF/Mobile-Security-Framework-MobSF