1
# System apps are located in
2
/system/app
3

4
# User installed apps are located in (here you can find app.apk)
5
/data/app/
6

7
# Data of apps
8
/data/data/
9

10
## Shared preferences (if an app use a insecure data storage)
11
/data/data/app/shared_prefs/
12

13
# It may contains a embebed strings with
14
app/res/values/strings.xml

1
# Decompile the app
2
apktool d app.apk
3

4
# The code smali can be modificated
5
http://pallergabor.uw.hu/androidblog/dalvik_opcodes.html
6

7
# Doing a patched app
8
apktool b folder -o patched_app.apk
9

10
# Sing the new app
11
## Check for "Firmar aplicaciones"

1
# Generate a key to firm the app
2
keytool -genkey -v -keystore my-release-key.keystore -alias alias_name -keyalg RSA -keysize 2048 -validity 10000
3

4
# Sing the app
5
jarsigner -verbose -sigalg SHA1withRSA -digestalg SHA1 -keystore my-release-key.keystore your_app.apk alias_name
6
  # Install
7
  # sudo apt install default-jdk-headless

1
# Decompile
2
jadx -d new_folder app.apk
3

4
# If the apk is obfuscated
5
## It's better than MobSF to decompile obfuscated code
6
jadx -d new_folder app.apk --deobf

1
# Iniciando el Servidor
2
adb forward tcp:31415 tcp:31415
3

4
# Start the app in cellphone
5

6
# Connect to drozer
7
drozer console connect
8

9
# List apps and filtrate
10
run app.package.list -f <name>
11

12
# Get info app
13
run app.package.info -a <name>
14

15
# View attack surface
16
run app.package.attacksurface <name>
17

18
# List activities
19
run app.activity.info -a <name>
20

21
# Start activities
22
run app.activity.start --component <app_name> <activity_name>
23

24
# Scan provider URLs
25
run scanner.provider.finduris -a <app_name>
26

27
## Inside of a shell adb shell
28
content query --uri "content://jakhar.aseem.diva.provider.notesprovider/notes"
29

30
## Filter by a title of element
31
content query --uri "content://jakhar.aseem.diva.provider.notesprovider/notes" --projection title
32

33
## using sql (manual)
34
content query --uri "content://jakhar.aseem.diva.provider.notesprovider/notes" --projection "* FROM sqlite_master; --"
35

36
# provider query
37
run app.provider.query "content://jakhar.aseem.diva.provider.notesprovider/notes" --projection "* FROM sqlite_master; --"
38

39
# Automated scan
40
run scanner.provider.injection -a <app_name>
41

42
# Automated show tables
43
run scanner.provider.sqltables -a <app_name>
44

45
## Inside of a shell adb shell
46
## Get a verion of sqlite
47
content query --uri "content://jakhar.aseem.diva.provider.notesprovider/notes" --projection "sqlite_version() --"
48

49
# List broadcast recivers
50
run app.broadcast.info -a <package_name> -i
51

52
# Send broadcast recivers
53
run app.broadcast.send --action <name> --extra string <var_name> <value> --extra string <var_name> <value>

1
# To run for first time
2
sudo docker run -it --name mobsf -p 8000:8000 opensecurity/mobile-security-framework-mobsf:latest
3

4
# Visit your localhost or IP on 8000 port
5
localhost:8000
6
## Default user and password
7
mobsf:mobsf
8

9
# To stop container
10
sudo docker stop mobsf
11

12
# To start again the container
13
sudo docker start mobsf
14

15
# More info
16

17
## To lists all containers
18
sudo docker ps -a
19

20
## To lists active containers
21
sudo docker ps
22

23
## To remove container
24
docker rm <id_contenedor>
25

26
## To remove container image
27
sudo docker rmi <id_imagen>

1
sqlite3 <db>
2

3
# List tables
4
.tables
5

6

7
# Select
8
SELECT * FROM <table>

1
# Instalar pipx
2
sudo apt install pipx
3

4
# Instalar frida-tools
5
pipx install frida-tools
6

7
# Instalar una versión en especifica
8
pipx install frida-tools==16.7.13
9

10
# Solamente si no lo detecta el PATH
11
pipx ensurepath
12
  # Note: '/home/user/.local/bin' is not on your PATH environment variable. These apps will not be globally accessible until your PATH is updated. Run `pipx ensurepath` to automatically add it, or manually
13

14
# Obtener la versión de Frida
15
 frida --version
16
  # 16.7.13
17

18
# Actualizar Frida
19
pipx upgrade frida-tools
20
  # 17.2.11
21

22
# Quitar Frida
23
pipx uninstall frida-tools

1
# Descomprimir frida server
2
xz -d frida-server-16.7.13-android-arm64.xz
3

4
# Cambiar el nombre
5
mv frida-server-16.7.13-android-arm64 frida-server
6

7
# Subir frida-server al celular
8
adb push frida-server /data/local/tmp
9

10
# Inicializar frida-server
11
adb shell
12
su
13
cd /data/local/tmp/
14
chmod +x frida-server
15
./frida-server &
16

17
# Verificar que frida-server este corriendo
18
ps | grep frida
19
  # root          8828 15283   49124  22764 poll_schedule_timeout 0 S frida-server

1
# Instalar pipx
2
sudo apt install pipx
3

4
# Instalar Objection
5
pipx install objection
6

7
# Probar Objection
8
objection --gadget "com.android.settings" device-type
9
  # Using USB device `moto g 7  play`
10
  # Agent injected and responds ok!
11
  # Connection: USB
12
  # Name: com.android.settings
13
  # System: channel
14
  # Model: motorola
15
  # Version: 10
16
  # Asking jobs to stop...
17
  # Unloading objection agent...

1
frida --codeshare sowdust/universal-android-ssl-pinning-bypass-2 -U -f YOUR_BINARY
2
# No funcionó
3
frida --codeshare pcipolloni/universal-android-ssl-pinning-bypass-with-frida -U -f YOUR_BINARY
4
# No funcionó
5
frida --codeshare sowdust/universal-android-ssl-pinning-bypass-2 -U -f YOUR_BINARY
6
# No funcionó
7
frida --codeshare Q0120S/bypass-ssl-pinning -U -f YOUR_BINARY
8
# No funcionó, pero avanza más
9
frida --codeshare hyugogirubato/android-ssl-pinning -U -f YOUR_BINARY
10
# No funcionó, pero avanza más
11

12
# IOS
13
# frida --codeshare federicodotta/ios13-pinning-bypass -U -f YOUR_BINARY
14
# frida --codeshare federicodotta/ios13-pinning-bypass -U -f YOUR_BINARY

1
# Obtener nombre de la aplicación
2
frida-ps -Uia | grep app_name
3
  # 29233  My app  com.app.name
4

5
# Inicializar la app
6
objection --gadget "com.app.name" explore
7

8
# Deshabilitar ssl pinning
9
android sslpinning disable