Android Vulnerability Assessment and Penetration Testing — Part 1

3 min readMay 12, 2021

Well above gif is only for entertainment purpose, this not actually happens in Android VAPT 😛

What Is Android?

Have you installed the software in windows with .exe and Linux with .deb? Android is also equivalent to windows with .exe and Linux with .deb, which uses .apk and installs the application in Android-based mobile phones.

What do we do in Android VAPT?

In Android VAPT we perform

Static Analysis
Dynamic Analysis

Tools Required

apktool
dex2jar
vscode
Train your brain to develop an interest in Android VAPT ****

Statis Analysis

First, we will check the structure inside the apk.

After Extracting the apk you will get the following structure mentioned below :
1. AndroidManifest.xml
2. Classes.dex
3. resource.arsc
4. res
5. META-INF

Let’s Jump to points one by one

AndroidManifest.xml

The AndroidManifest.xml file contains information on your package, including components of the application such as activities, services, broadcast receivers, content providers, etc.
It also protects the application to block the access permission of sensitive information or function.

Below are the points that are components of the AndroidManifest.xml file:-
(Try to define in a very simple manner)

Activities: Changing the UI experience from starting the application to login into the application this process is known as Activities.
Services: Remember task manager in Windows, consider services as same. It continuously runs required services in the background.
Broadcast Receivers: This component responsible for register the event that going to occur.
Content Providers: Basically it provides the local or remote storage of data through which our application plays with.
Intent: It’s a communication channel between two activities to the application.
a. Implicit:
If a media file is requesting to open in a third-party application then it considers being implicit.
b. Explicit:
If the media file is opening into the application itself then it considers being explicit.

Classes.dex

It is commonly known as Dalvik Exchange and this is nothing but a compiled version of the java class.
We need a dextojar tool to decompiled the classes.dex file to make the file human-readable format.

resources.arsc

This file contains some binary format files and also includes the media data that may be required by the application.

res

This folder contains the device configuration and layouts.

META-INF

This folder contains the manifest information such as the java runtime environment when loading the jar file, version package, build number creating, security policies, and permissions

Now, let’s do some practical stuff to know more about those files and folder

We are using apktool to extract the files from the apk

After Performing the above operations you’ll get the list of files and directory that we have mentioned at the top.