Day 7: Android Penetration Testing, Static Analysis with MobSF & JADX-GUI Decompilation

1. Mobile Pentest Foundations: Static vs Dynamic Analysis

On Day 7 of the BugXploit workshop, the curriculum transitioned from network daemons and web applications to Android Mobile Application Penetration Testing. Mobile applications represent a distinct attack surface because the client-side binary (the APK file) runs directly on user hardware outside the security perimeter of the corporate datacenter.

The instructors introduced the two fundamental methodologies governing mobile security assessments:

Our focus on Day 7 centered on Static Code Analysis and Reconnaissance: understanding how threat actors extract source code from compiled APKs, run automated vulnerability scanners, identify hardcoded secrets, and pinpoint logic flaws before touching a physical Android device.

2. Essential Tooling & Direct Downloads (JDK 26 & JADX-GUI)

To decompile, inspect, and analyze Android applications locally, security researchers require a properly configured Java runtime environment alongside specialized decompilers. Below are direct official download links configured for immediate access:

3. Target Profile: DivaApplication.apk Architecture

For our hands-on static analysis lab, we utilized DIVA (Damn Insecure and Vulnerable App), authored by Aseem Jakhar. DIVA is purposely engineered with intentional mobile vulnerabilities mirroring common flaws found in commercial Android apps.

4. Automated SAST with MobSF (Mobile Security Framework)

Mobile Security Framework (MobSF) is an automated, all-in-one mobile application (Android / iOS / Windows) penetration testing, malware analysis, and security assessment framework. It is capable of performing both static and dynamic analysis.

During the lab session, we uploaded DivaApplication.apk to the live hosted instance at mobsf.live (MobSF v4.5.2). Within seconds, MobSF unpacked the APK, decoded binary XML resources, disassembled DEX bytecode into Java, audited shared libraries, and calculated overall risk scores:

5. Signer Certificate & The Janus Vulnerability

MobSF immediately parsed the cryptographic signature of the APK file and flagged two critical vulnerabilities in the signing configuration:

6. Manifest Flaws: Debuggable Flag & Exported Components

The AndroidManifest.xml file is the root blueprint of an Android application. MobSF identified 6 critical issues across manifest configurations:

7. Uncovering Hardcoded Secrets: "notespin" Extraction

One of the primary goals of mobile application static code analysis is hunting for hardcoded credentials, secret keys, and configuration tokens. In production applications, developers frequently embed AWS secret keys, Firebase database credentials, Stripe tokens, and internal encryption passphrases directly in client-side code.

MobSF's automated secret scanner audited strings across the APK resources, bytecode, and compiled binaries, returning an immediate hit:

"pkey" : "notespin"

Furthermore, MobSF extracted backend communications indicating network activity to http://payatu.com inside APICreds2Activity.java.

8. Insecure Storage & SQLite Injection Vectors

MobSF flagged several high-risk code implementation patterns in the Java source:

9. Shared Library Binary Security (libdivajni.so)

Android applications frequently bundle compiled C/C++ native libraries via the Java Native Interface (JNI). MobSF performs binary analysis across all compiled .so shared objects (ARM, x86, MIPS) to verify whether compiler-level exploit mitigations were applied:

10. Manual Reverse Engineering with JADX-GUI

While automated scanners like MobSF provide rapid reconnaissance, an ethical hacker must perform manual source code verification using a decompiler to inspect program logic, understand call hierarchies, and confirm exploitability.

JADX-GUI is the premier open-source tool for decompiling Android DEX (Dalvik Executable) bytecode back into readable Java source code.

Step-by-Step JADX-GUI Code Auditing Workflow

1. Open the APK: Load DivaApplication.apk in JADX-GUI. JADX instantly decompiles classes.dex into high-level Java packages under Source code > jakhar.aseem.diva.
2. Global String Search (Ctrl + Shift + F): Search for keywords such as password, api_key, secret, token, http://, or DES.
3. Inspect HardcodeActivity.java: Directly view the raw Java source code where the hardcoded key is compared:

   public class HardcodeActivity extends AppCompatActivity {
       public void dj(View view) {
           EditText editText = (EditText) findViewById(R.id.hcKey);
           // Direct plaintext string comparison against hardcoded vendor secret!
           if (editText.getText().toString().equals("vendorsecretkey")) {
               Toast.makeText(this, "Access granted! See you on the other side!", Toast.LENGTH_SHORT).show();
           } else {
               Toast.makeText(this, "Access denied! See you in hell!", Toast.LENGTH_SHORT).show();
           }
       }
   }

4. Audit Exported Components: Inspect Resources > AndroidManifest.xml to identify exported activities and providers that can be invoked without authentication via the Android Debug Bridge (ADB).

11. Defensive Hardening: OWASP MASVS Compliance

Hardening Android applications against static analysis and reverse engineering requires adhering to the OWASP Mobile Application Security Verification Standard (MASVS):

• MASVS-STORAGE (Insecure Storage): Never store sensitive tokens or user credentials in plaintext in SharedPreferences, external storage, or SQLite. Use the Android EncryptedSharedPreferences API and SQLCipher for transparent 256-bit AES database encryption.
• MASVS-CRYPTO (Key Management): Eliminate hardcoded credentials entirely. Store cryptographic keys in the hardware-backed Android Keystore system, ensuring private keys cannot be extracted even from rooted devices.
• MASVS-RESILIENCE (Anti-Reversing): Enable code obfuscation, dead code elimination, and symbol stripping using R8 / ProGuard in build.gradle. Obfuscation transforms recognizable class and variable names into unreadable characters (a.b.c), drastically increasing reverse-engineering difficulty.
• Production Manifest Hardening: Ensure android:debuggable="false" and android:allowBackup="false" are strictly enforced on release builds. Explicitly mark all internal activities and content providers with android:exported="false".
• Sign with Modern Schemes: Build releases using APK Signature Scheme v2 and v3 to protect against binary modifications and the Janus vulnerability.

12. Day 7 Summary & Key Takeaways