eMAPT Exam Review
First, let’s go over some public information about the exam (and others like it) and why you might want to take it. When choosing to take a mobile …
Android - WebViews & CustomTabs
We know that android applications can interact with websites by using an intent with ACTION.VIEW and a URL which will start a browser and load a …
Android - Storage
We will look at how android applications store files and further have access to the file system of the device. We will focus mostly around the …
Android - Services
A service is defined as an application component that can perform long-running operations in the background, not providing a user interface. They are …
Android - Permissions
So far we have only examined whether or not apps are exported. For example, non-exported activities can’t be started and are used by the app …
Android - Broadcast Receivers
Android applications can send and receive broadcast messages from both the operating system and other android applications. For example, the system …
Android - Content and File Providers
A Content Provider presents data to external applications as one or more tables - where a row represents an instance of some type of data that the …
Android - Intent Attack Surface
Similar to the last few android pentesting blog posts - this is heavily based off of the Hextree.io course on the topic. I am documenting this simply …
Android - Dynamic Instrumentation
The more straight forward approach of understanding these android applications is by decompiling them and examining the code - after all the apk is …
Android - Intercepting Network Communications
We need a bit more than just a proxy and a neat interception tool like Burp Suite in order to inspect the traffic of some android applications. Let’s …
Mobile Application Security Considerations
I think that because mobile application testing is somewhat of a niche, the security considerations for mobile devices are also less understood. Not …