Android

Mobile Hacking Exams in 2025 # First, let’s go over some public information about the exam (and others like it) and why you might want to take it.

What is a WebView? # We know that android applications can interact with websites by using an intent with ACTION.VIEW and a URL which will start a browser and load a website. Sometimes just opening a website isn’t enough though and android provides WebViews and CustomTabs to try and make more complex interaction possible. WebViews are generally used when a website is embedded into an application, especially when there is a lot of crossover between the website’s JavaScript and the Java app code. In fact, in the past this interface was regarded as so insecure that you could achieve full arbitrary Java code execution - but this has not been an issue in modern android for quite some time. For CustomTabs, the website is not embedded within the app itself and the app communicates with a browser app (usually chrome) and renders the site in a overlay over the app. CustomTabs are also much more limited in the types of interaction which of course helps minimize the attack surface.

We will look at how android applications store files and further have access to the file system of the device. We will focus mostly around the internal storage, external storage, and the keychain. Internal storage also contains things we are already familiar with like shared preferences, the cache files, and databases - some of the things discussed here will tie back to Content Providers, so keep that in mind as we continue.

What is a Service? # A service is defined as an application component that can perform long-running operations in the background, not providing a user interface. They are typically used when an application wants to perform some long-running operation where user interaction isn’t needed or to provide functionality to some other application.

Overview # So far we have only examined whether or not apps are exported. For example, non-exported activities can’t be started and are used by the app internally - so we generally ignore these unless there is some intent redirect or pending intent we can see. So as a developer a very potent way to reduce the attack surface is to export as few components as possible - if it doesn’t need to be exported, don’t export it. There are however other cases where an app wants to export some activity, but only to some select applications and that is where the android permissions system comes into play.

What is a Broadcast Receiver? # Android applications can send and receive broadcast messages from both the operating system and other android applications. For example, the system automatically sends broadcasts when certain system events occur, like switching in and out of airplane mode - where each app who is subscribed to that event (through the process of registering a receiver) will receive those broadcasts.

What is a Content Provider? # A Content Provider presents data to external applications as one or more tables - where a row represents an instance of some type of data that the provider collects and a column in the row represents an individual piece of data collected for a given instance. So content providers coordinate access to your application’s data storage layer for multiple APIs and components such as:

Preface # Similar to the last few android pentesting blog posts - this is heavily based off of the Hextree.io course on the topic. I am documenting this simply to help myself practice and try to understand the topics on a deeper level.

What is Dynamic Instrumentation? # The more straight forward approach of understanding these android applications is by decompiling them and examining the code - after all the apk is just an archive. The issue is that some of these applications can be too large to understand, obfuscated or packed, or full of useless logic.

The Flow Chart # We need a bit more than just a proxy and a neat interception tool like Burp Suite in order to inspect the traffic of some android applications. Let’s examine this flow chart from hextree.io: