Auditing Your APKs Like a Black Hat Hacker
summary
Covers hands‑on APK auditing with concrete tools and examples: using apktool, dex2jar and JD-GUI to decode and read app code, running drozer to list exported components and scan for SQL injection, and intercepting traffic with Burp to catch plaintext web requests. Shows real incidents (WhatsApp, Samsung Kies, Duolingo) and explains fixes: least‑privilege permissions, content provider hardening, avoid external storage, remove hard‑coded keys, and basic tamper/obfuscation techniques.
AI-written summary · about
chapters (32)
- 0:00Introduction
- 2:00Disclaimer
- 2:46Agenda
- 3:44What is reverse engineering
- 4:22Why reverse engineering
- 5:37Tools
- 6:37Android SDK
- 6:54Creating an Emulator
- 8:35APKTool
- 9:34DextoJAR
- 10:14Tainted
- 11:50Common attack surfaces
- 12:47Permissions
- 14:36File permissions
- 15:54Checking the manifest
- 17:44Interprocess communications
- 20:26Sharing files using the content provider
- 22:47Useful drozer commands
- 24:44Sequel injection
- 25:30Samsung Kies
- 26:29insecure storage
- 28:22security tips
- 29:30Skype example
- 30:13WhatsApp example
- 31:02Burp Suite
- 33:17What do we do
- 34:42Realworld example
- 35:26Logging
- 36:05Logging Example
- 36:39Obfuscation
- 38:09Private Keys
- 39:05Tamper Detection
related talks
37mThe Art of Hiding Sensitive Info in Plain Sight
47mAttacking Android Applications
47mSecuring Android Applications
45mI just hacked your app!
58mAndroid Application Security Testing
43mAttacking Android Applications
49mAll Your Code Belongs To Us (Dismantling Android Secrets With CodeInspect)
42mAttack & Defend Mobile Apps