Part-1 : Cheat Sheet for Android App Penetration Test


In this blog, presenting an Android application penetration testing setup cheat sheet which will consist a list of tools where we will be using in upcoming blogs, we will discuss the usage of each tool in the corresponding blogs. This setup cheats sheet provides a collection of high-value information on specific Android application penetration testing on various aspects as below:
  • Android Testing Distributions
  • Reverse Engineering and Static Analysis
  • Dynamic and Runtime Analysis
  • Network Analysis and Server Side Testing
  • Android Vulnerable Apps

Android Testing Distributions

  • Android Tamer - Android Tamer is a Virtual / Live Platform for Android Security professionals.
  • Vezir-Project - Linux Virtual Machine for Mobile Application Pentesting and Mobile Malware Analysis.

Reverse Engineering and Static Analysis

  • APKInspector - APKinspector is a powerful GUI tool for analysts to analyze the Android applications.
  • APKTool - A tool for reverse engineering 3rd party, closed, binary Android apps. It can decode resources to nearly original form and rebuild them after making some modifications.
  • Dex2jar - A tool for converting .dex file to .class files (zipped as jar).
  • JD-Gui - A tool for decompiling and analyzing Java code.
  • Qark - This tool is designed to look for different security related Android application vulnerabilities, either in source code or packaged APKs.
  • AndroBugs - AndroBugs Framework is an efficient Android vulnerability scanner that helps developers or hackers find potential security vulnerabilities in Android applications. No need to install on Windows.

Dynamic and Runtime Analysis

  • Introspy-Android - Blackbox tool to help understand what an Android application is doing at runtime and assist in the identification of potential security issues.
  • Cydia Substrate - Cydia Substrate for Android enables developers to make changes to existing software with Substrate extensions that are injected into the target process's memory.
  • Xposed Framework - Xposed framework enables you to modify the system or application aspect and behavior at runtime, without modifying any Android application package(APK) or re-flashing.
  • Drozer - Drozer allows you to search for security vulnerabilities in apps and devices by assuming the role of an app and interacting with the Dalvik VM, other apps' IPC endpoints and the underlying OS.

Network Analysis and Server Side Testing

  • Tcpdump - A command-line packet capture utility.
  • Burp Suite - Burp Suite is an integrated platform for performing security testing of applications.

Android Vulnerable Apps

  • Damn Vulnerable Android App - DIVA (Damn insecure and vulnerable App) is an App intentionally designed to be insecure.
  • Owasp Goatdroid Project OWASP GoatDroid is a fully functional and self-contained training environment for educating developers and testers on Android security.
  • Sieve - is a password manager app, riddled with security vulnerabilities.
So finally, we hope this Application Penetration Testing setup Cheat Sheet will helpful to familiar with the android Pentest tools. In upcoming blogs, we will be using the above-mentioned tools

Comments

Post a Comment