ANDROID, SECURITY

Android Application Hacking Resources

January 13, 2020

These are links that I found interesting as I was (and still am) learning about Android application security and I’m putting it here in case it can help someone else!

Last update: 2022-10-16

Aggregators, news feeds, twitter threads, etc.

Come back to those every now and then to see if they have new content!

• “android” HackerOne Hacktivity
• Twitter thread with tons of great links
• Android-Reports-and-Resources GitHub repository
• awesome-mobile-security GitHub repository
• Android_Security repository
• #AndroidHackingMonth (HackerOne’s Android Hacking Month in February 2020)
• AllThingsAndroid GitHub repository
• Android Partner Vulnerability Initiative bug tracker (details of bugs specific to the Android OEM code)
• Oversecured blog and HackerOne profile

Videos

• jiska - Finding and Backtracing Signal Messages on Android (Shows how to use frida-trace)
• Maddie Stone - Securing the System: A Deep Dive into Reversing Android Pre-Installed Apps
• Baptiste Robert aka fs0c131ty - L’histoire de la découverte d’une backdoor signée OnePlus (It’s in French)
• Ben Actis - Advanced Android Bug Bounty skills
• Yekaterina Tsipenyul O’Neil & Erika Chin - Seven Ways to Hang Yourself with Google Android (From 2011 but still interesting to this day)
• Dawn Isabel - Fun with Frida on Mobile (It’s for iOS but the same ideas can be used on Android)
• Sebastian Porst & Google Play - Overview of common Android app vulnerabilities
• Nikita Stupin - Vulnerabilities of mobile OAuth 2.0
• B3nac - Android Hacking
• B3nac - Android Application Exploitation
• B3nac - Exploiting Android deep links and exported components
• Maddie Stone - Android App Reverse Engineering Workshop (part 1, part 2)

Write-ups, guides and blog articles

• Proxying Android app traffic – Common issues / checklist
• Bug Bounty Hunting Tips #2 —Target their mobile apps (Android Edition)
• Quarkslab’s “diffing” blog posts (They have an unreleased android diffing engine, we can’t use it but the next best thing is reading about it!)
• Configuring Burp Suite With Android Nougat
• Universal XSS in Android WebView (CVE-2020-6506)
• Samsung Find My Mobile vulnerability
• OWASP Mobile Security Testing Guide
• r2-pay challenge write-up (part 1 (anti-debug, anti-root & anti-frida), part 2 (whitebox))
• Security of mobile OAuth 2.0
• Proxying Android app traffic – Common issues / checklist

Social media accounts

Telegram

• fs0c131y
• Android Security & Malware

Twitter

• maddiestone
• mobilesecurity_
• fs0c131y
• reyammer
• LibraAnalysis
• B3nac
• maldr0id
• _bagipro

Courses

• MOBISEC
• Android App Reverse Engineering 101 by Maddie Stone

Tools

• AERoot - AERoot is a command line tool that allows you to give the root privileges on-the-fly to any process running on the Android emulator with Google Play flavors AVDs
• Mobile Security Framework (MobSF)
• Frida
  • Bypass Certificate Pinning
  • Frida Cheatsheet and Code Snippets for Android
  • Intercepting traffic from Android Flutter applications
• Drozer
  • Getting started guide
• Jalangi2
• KeyHacks - Instructions to validate that leaked tokens are valid
• NotKeyHacks - List of tokens that aren’t sensitive even though they might appear to be