# Android Penetration Testing Cheat Sheet **URL:** \ **Category:** Tools & Scripts\ **Tags:** tools, hacking\ **Created:** [August 15, 2024, 7:52pm UTC](https://onehack.st/t/android-penetration-testing-cheat-sheet/289082 "2024-08-15T19:52:35Z")\ **Posts on this page:** 1\ **Page:** 1
**Author:** ![Prometheus](https://onehack.st/user_avatar/onehack.st/prometheus/32/34950_2.png) [@Prometheus](https://onehack.st/u/Prometheus)\ **Post date:** [August 15, 2024, 7:52pm UTC](https://onehack.st/t/android-penetration-testing-cheat-sheet/289082/1 "2024-08-15T19:52:35Z")
# Android Penetration Testing Cheat Sheet This is more of a checklist for myself. May contain useful tips and tricks. **Still need to add a lot of things.** Everything was tested on Kali Linux v2023.1 (64-bit) and Samsung A5 (2017) with Android OS v8.0 (Oreo) and Magisk root v25.2. Check [Magisk](https://topjohnwu.github.io/Magisk) if you wish to root your Android device. I have no [liability](https://github.com/ivan-sincek/android-penetration-testing-cheat-sheet/blob/main/LICENSE) over your actions. For help with any of the tools type ` [-h | -hh | --help]` or `man `. If you didn’t already, read [OWAS MASTG](https://mas.owasp.org/MASTG/) ([GitHub](https://github.com/OWASP/owasp-mastg)) and [OWASP MASVS](https://mas.owasp.org/MASVS/) ([GitHub](https://github.com/OWASP/owasp-masvs)). You can download OWASP MASTG checklist from [here](https://github.com/OWASP/owasp-mastg/releases). I also recommend reading [HackTricks - Android Applications Pentesting](https://book.hacktricks.xyz/mobile-pentesting/android-app-pentesting). **In most cases, to be eligible for a bug bounty reward, you need to exploit a vulnerability with non-root priviledges, possibly building your own “malicious” PoC app.** Find out more about my “malicious” PoC app from my other [project](https://github.com/ivan-sincek/malware-apk). Websites that you should use while writing the report: - [cwe.mitre.org/data](https://cwe.mitre.org/data) - [owasp.org/projects](https://owasp.org/projects) - [owasp.org/www-project-mobile-top-10](https://owasp.org/www-project-mobile-top-10) - [cheatsheetseries.owasp.org](https://cheatsheetseries.owasp.org/Glossary.html) - [first.org/cvss/calculator/4.0](https://www.first.org/cvss/calculator/4.0) - [nvd.nist.gov/vuln-metrics/cvss/v3-calculator](https://nvd.nist.gov/vuln-metrics/cvss/v3-calculator) - [nvd.nist.gov/ncp/repository](https://nvd.nist.gov/ncp/repository) - [attack.mitre.org](https://attack.mitre.org/) My other cheat sheets: - [iOS Testing Cheat Sheet](https://github.com/ivan-sincek/ios-penetration-testing-cheat-sheet) - [Penetration Testing Cheat Sheet](https://github.com/ivan-sincek/penetration-testing-cheat-sheet) - [WiFi Penetration Testing Cheat Sheet](https://github.com/ivan-sincek/wifi-penetration-testing-cheat-sheet) Future plans: - modify `networkSecurityConfig` to add custom root CA certificates, - test widgets, push notifications, and Firebase, - SMALI code injection, - Flutter attacks, - create more Frida scripts. ## Table of Contents **0. [Install Tools](https://github.com/ivan-sincek/android-penetration-testing-cheat-sheet#0-install-tools)** - [WiFi ADB - Debug Over Air](https://github.com/ivan-sincek/android-penetration-testing-cheat-sheet#wifi-adb---debug-over-air) - [Magisk Frida](https://github.com/ivan-sincek/android-penetration-testing-cheat-sheet#magisk-frida) - [Magisk SQLite 3](https://github.com/ivan-sincek/android-penetration-testing-cheat-sheet#magisk-sqlite-3) - [BusyBox](https://github.com/ivan-sincek/android-penetration-testing-cheat-sheet#busybox) - [Kali Linux Tools](https://github.com/ivan-sincek/android-penetration-testing-cheat-sheet#kali-linux-tools) - [Java](https://github.com/ivan-sincek/android-penetration-testing-cheat-sheet#java) - [Apktool](https://github.com/ivan-sincek/android-penetration-testing-cheat-sheet#apktool) - [Mobile Security Framework (MobSF)](https://github.com/ivan-sincek/android-penetration-testing-cheat-sheet#mobile-security-framework-mobsf) - [Drozer](https://github.com/ivan-sincek/android-penetration-testing-cheat-sheet#drozer) - [Install Web Proxy Certificates](https://github.com/ivan-sincek/android-penetration-testing-cheat-sheet#install-web-proxy-certificates) **1. [Basics](https://github.com/ivan-sincek/android-penetration-testing-cheat-sheet#1-basics)** - [Android Debug Bridge (ADB)](https://github.com/ivan-sincek/android-penetration-testing-cheat-sheet#android-debug-bridge-adb) - [Install/Uninstall an APK](https://github.com/ivan-sincek/android-penetration-testing-cheat-sheet#installuninstall-an-apk) - [Download/Upload Files and Directories](https://github.com/ivan-sincek/android-penetration-testing-cheat-sheet#downloadupload-files-and-directories) - [Bypassing Permission Denied](https://github.com/ivan-sincek/android-penetration-testing-cheat-sheet#bypassing-permission-denied) **2. [Inspect an APK](https://github.com/ivan-sincek/android-penetration-testing-cheat-sheet#2-inspect-an-apk)** - [Pull an APK (base.apk)](https://github.com/ivan-sincek/android-penetration-testing-cheat-sheet#pull-an-apk-baseapk) - [AndroidManifest.xml](https://github.com/ivan-sincek/android-penetration-testing-cheat-sheet#androidmanifestxml) - [strings.xml](https://github.com/ivan-sincek/android-penetration-testing-cheat-sheet#stringsxml) **3. [Search for Files and Directories](https://github.com/ivan-sincek/android-penetration-testing-cheat-sheet#3-search-for-files-and-directories)** - [SharedPreferences](https://github.com/ivan-sincek/android-penetration-testing-cheat-sheet#sharedpreferences) **4. [Inspect Files](https://github.com/ivan-sincek/android-penetration-testing-cheat-sheet#4-inspect-files)** - [Single File](https://github.com/ivan-sincek/android-penetration-testing-cheat-sheet#single-file) - [Multiple Files](https://github.com/ivan-sincek/android-penetration-testing-cheat-sheet#multiple-files) - [File Scraper](https://github.com/ivan-sincek/android-penetration-testing-cheat-sheet#file-scraper) - [SQLite 3](https://github.com/ivan-sincek/android-penetration-testing-cheat-sheet#sqlite-3) - [Nuclei](https://github.com/ivan-sincek/android-penetration-testing-cheat-sheet#nuclei) - [Backups](https://github.com/ivan-sincek/android-penetration-testing-cheat-sheet#backups) **5. [SpotBugs](https://github.com/ivan-sincek/android-penetration-testing-cheat-sheet#5-SpotBugs)** **6. [Deep Links](https://github.com/ivan-sincek/android-penetration-testing-cheat-sheet#6-deep-links)** - [Android App Link Verification Tester](https://github.com/ivan-sincek/android-penetration-testing-cheat-sheet#android-app-link-verification-tester) - [Deep Link Hijacking](https://github.com/ivan-sincek/android-penetration-testing-cheat-sheet#deep-link-hijacking) **7. [WebViews](https://github.com/ivan-sincek/android-penetration-testing-cheat-sheet#7-webviews)** **8. [Frida](https://github.com/ivan-sincek/android-penetration-testing-cheat-sheet#8-frida)** - [Frida Scripts](https://github.com/ivan-sincek/android-penetration-testing-cheat-sheet#frida-scripts) **9. [Objection](https://github.com/ivan-sincek/android-penetration-testing-cheat-sheet#9-objection)** - [Bypasses](https://github.com/ivan-sincek/android-penetration-testing-cheat-sheet#bypasses) **10. [Drozer](https://github.com/ivan-sincek/android-penetration-testing-cheat-sheet#10-drozer)** - [Intents](https://github.com/ivan-sincek/android-penetration-testing-cheat-sheet#intents) - [Content Providers](https://github.com/ivan-sincek/android-penetration-testing-cheat-sheet#content-providers) - [Broadcast Receivers](https://github.com/ivan-sincek/android-penetration-testing-cheat-sheet#broadcast-receivers) **11. [Intent Injections](https://github.com/ivan-sincek/android-penetration-testing-cheat-sheet#11-intent-injections)** **12. [Taskjacking](https://github.com/ivan-sincek/android-penetration-testing-cheat-sheet#12-taskjacking)** **13. [Tapjacking](https://github.com/ivan-sincek/android-penetration-testing-cheat-sheet#13-tapjacking)** **14. [Decompile an APK](https://github.com/ivan-sincek/android-penetration-testing-cheat-sheet#14-decompile-an-apk)** **15. [Repackage an APK](https://github.com/ivan-sincek/android-penetration-testing-cheat-sheet#15-repackage-an-apk)** - [Decode](https://github.com/ivan-sincek/android-penetration-testing-cheat-sheet#decode) - [Repackage](https://github.com/ivan-sincek/android-penetration-testing-cheat-sheet#repackage) - [Code Sign](https://github.com/ivan-sincek/android-penetration-testing-cheat-sheet#code-sign) **16. [Miscellaneous](https://github.com/ivan-sincek/android-penetration-testing-cheat-sheet#16-miscellaneous)** - [Monitor the System Log](https://github.com/ivan-sincek/android-penetration-testing-cheat-sheet#monitor-the-system-log) - [Monitor File Changes](https://github.com/ivan-sincek/android-penetration-testing-cheat-sheet#monitor-file-changes) **17. [Tips and Security Best Practices](https://github.com/ivan-sincek/android-penetration-testing-cheat-sheet#17-tips-and-security-best-practices)** **18. [Useful Websites and Tools](https://github.com/ivan-sincek/android-penetration-testing-cheat-sheet#18-useful-websites-and-tools)** **19. [Vulnerable Apps](https://github.com/ivan-sincek/android-penetration-testing-cheat-sheet#19-vulnerable-apps)** ## GitHub: [https://github.com/ivan-sincek/android-penetration-testing-cheat-sheet](https://github.com/ivan-sincek/android-penetration-testing-cheat-sheet)