/testing-mobile-applications

name: testing-mobile-applications
description: Pentest Android and iOS mobile applications including APK analysis, dynamic analysis, SSL pinning bypass, root/jailbreak detection bypass, and mobile-specific vulnerabilities. Use when testing mobile app security or performing mobile pentesting.
verified: 2026-07-27

Testing Mobile Applications

When to Use

• Android APK analysis and exploitation
• iOS application pentesting
• Mobile app security assessment
• Bypassing security controls (SSL pinning, root detection)
• Testing mobile-specific vulnerabilities

When NOT to Use

• **Backend API testing** — use `testing-apis`
• **Deep native binary reversing** — use `analyzing-binaries`
• **Analyzing a malicious app** — use `analyzing-malware`
• **Source code is available** — use `auditing-code-for-vulnerabilities`

Check the Framework Before Anything Else

`jadx` returning almost nothing does not mean the app is obfuscated — it usually means the logic is not in the dex at all. Run this first; it decides which skill you should be in.

unzip -l target.apk | rg 'libflutter|libapp\.so|index\.android\.bundle|libhermes|global-metadata|libil2cpp|Assembly-CSharp'

| Marker | Framework | Skill | | --- | --- | --- | | `libflutter.so`, `libapp.so`, `flutter_assets/` | Flutter / Dart | `reversing-flutter-apps` | | `index.android.bundle`, `libhermes.so`, `main.jsbundle` | React Native | `reversing-react-native-apps` | | `global-metadata.dat`, `libil2cpp.so`, `Assembly-CSharp.dll` | Unity | `reversing-unity-il2cpp` | | `libmonodroid.so`, `assemblies.blob`, `libxamarin-app.so` | Xamarin / .NET MAUI | `reversing-xamarin-maui` | | `classes*.dex` with real application packages | Native Android | continue here |

Two framework symptoms are worth naming, because they waste the most time when misread: a Flutter app shows **no traffic at all** in your proxy (it ignores the system proxy and CA store), and a React Native or Unity app shows a **near-empty dex** with all the logic in `assets/`.

Three more procedure skills split out of this one, because each needs far more detail than a general assessment can carry:

| Situation | Skill | | --- | --- | | App exits on a rooted device, or dies when Frida attaches | `bypassing-root-jailbreak-detection` | | iOS binary work: FairPlay decryption, Mach-O, class-dump, entitlements | `analyzing-ios-binaries` | | Exported components, deep links, URL schemes, content providers | `testing-mobile-ipc` |

If the proxy fails for any other reason — a TLS handshake alert, or an app that reports a network error with the proxy on — go to `bypassing-mobile-pinning` before assuming certificate pinning. On Android 7+ the most common cause is that your CA is installed as a user certificate, which apps do not trust by default, and no pinning bypass fixes that.

Android Pentesting

APK Analysis Tools

# Decompile APK
apktool d app.apk -o app_decompiled

# Convert DEX to JAR
d2j-dex2jar app.apk

# View JAR with JD-GUI
jd-gui app-dex2jar.jar

# Automated analysis
mobsf  # Mobile Security Framework
jadx app.apk  # APK to Java decompiler

ADB (Android Debug Bridge)

# List devices
adb devices

# Connect over network
adb connect 192.168.1.100:5555

# Install APK
adb install app.apk

# Uninstall
adb uninstall com.package.name

# List packages
adb shell pm list packages
adb shell pm list packages | grep -i "keyword"

# Get APK path
adb shell pm path com.package.name

# Pull APK from device
adb pull /data/app/com.package.name-xxx/base.apk

# Start activity
adb shell am start -n com.package.name/.MainActivity

# View logs
adb logcat

# Shell access
adb shell

Static Analysis

**Search for Sensitive Data:**

# Extract strings
strings app.apk | grep -i password
strings app.apk | grep -i api
strings app.apk | grep -i token
strings app.apk | grep -i key

# Search in decompiled code
grep -r "password" app_decompiled/
grep -r "http://" app_decompiled/
grep -r "api_key" app_decompiled/

**Check AndroidManifest.xml:**

# Decompile and view
apktool d app.apk
cat app_decompiled/AndroidManifest.xml

# Look for:
# - android:debuggable="true"
# - android:allowBackup="true"
# - Exported activities/services
# - Custom permissions
# - URL schemes

Dynamic Analysis

**Frida (Runtime Instrumentation):**

# List running apps
frida-ps -U

# Attach to app
frida -U -n "App Name"
frida -U -f com.package.name

# Load script
frida -U -f com.package.name -l script.js

# Common scripts
# - Bypass SSL pinning
# - Bypass root detection
# - Hook functions
# - Dump memory

**SSL Pinning Bypass:**

// Frida script - Universal SSL pinning bypass
Java.perform(function() {
    var TrustManager = Java.use('javax.net.ssl.X509TrustManager');
    TrustManager.checkServerTrusted.implementation = function() {};

    var SSLContext = Java.use('javax.net.ssl.SSLContext');
    SSLContext.init.overload('[Ljavax.net.ssl.KeyManager;', '[Ljavax.net.ssl.TrustManager;', 'java.security.SecureRandom').implementation = function(a,b,c) {
        this.init.overload('[Ljavax.net.ssl.KeyManager;', '[Ljavax.net.ssl.TrustManager;', 'java.security.SecureRandom').call(this, a, null, c);
    };
});

**Root Detection Bypass:**

// Frida - Bypass root detection
Java.perform(function() {
    var RootClass = Java.use('com.package.name.RootDetection');
    RootClass.isRooted.implementation = function() {
        return false;
    };
});

Intercepting Traffic

**Burp Suite Setup:**

# 1. Install Burp CA certificate
# Download from http://burp:8080 on device
# Install in Settings -> Security -> Install from storage

# 2. Configure proxy
adb shell settings put global http_proxy 192.168.1.100:8080

# 3. For apps with SSL pinning, use Frida bypass

# 4. Clear proxy when done
adb shell settings put global http_proxy :0

**mitmproxy:**

# Start mitmproxy
mitmproxy --listen-port 8080

# Install certificate on device