svc-mobile-android

Android APK Static Analysis — Full Methodology

Load this skill when the target is an Android APK (decompiled or not). This covers SAST — for dynamic testing (Frida, MITM), combine with playbook-webapp.

Task Decomposition — MANDATORY

An APK audit is NOT one grep job. Decompose into these independent tasks (run in parallel):

1. API Security Audit — read ALL Retrofit/API interface files, find sensitive data in URLs
2. Transport Security — network_security_config, certificate pinning, cleartext
3. Auth Flow Analysis — full auth chain, session management, token handling
4. Component Security — exported activities/receivers/providers/services, intent filters, deep links
5. Build Hygiene — debug flags, dev tools in production, staging endpoints, logging
6. Secrets & Crypto — hardcoded keys (but FILTER non-issues — see Known Non-Vulns below)
7. Data Storage — SharedPreferences, Room/SQLite, file storage, backup flags
8. Root/Tamper Detection — what's present AND what's MISSING

How to Read Decompiled Code

Smali basics (you'll see this from apktool/baksmali)

.method public someMethod(Ljava/lang/String;)V   # method signature
invoke-virtual {v0}, Lcom/example/Foo;->bar()V    # method call
const-string v1, "hardcoded_value"                # string constant
sget-object v0, Lcom/example/Config;->API_KEY:Ljava/lang/String;  # static field

Retrofit annotations in smali (THE most important pattern)

# @GET("endpoint") — HTTP method + path
.annotation runtime Lretrofit2/http/GET;
    value = "auth/password"
.end annotation

# @Query("password") — parameter goes in URL query string!
.annotation runtime Lretrofit2/http/Query;
    value = "password"
.end annotation

# @QueryMap — ALL params go in URL query string!
.annotation runtime Lretrofit2/http/QueryMap;
.end annotation

# @Body — parameter goes in request body (SAFE)
.annotation runtime Lretrofit2/http/Body;
.end annotation

# @Field — parameter goes in form body (SAFE)
.annotation runtime Lretrofit2/http/Field;
    value = "password"
.end annotation

# @Header — parameter sent as HTTP header
.annotation runtime Lretrofit2/http/Header;
    value = "Authorization"
.end annotation