Sign In Start Free Trial

Book Overview & Buying
Table Of Contents

Hacking Android

By : Mohammed A. Imran, Rao Kotipalli

4.4 (5)

Hacking Android

4.4 (5)

By: Mohammed A. Imran, Rao Kotipalli

Overview of this book

With the mass explosion of Android mobile phones in the world, mobile devices have become an integral part of our everyday lives. Security of Android devices is a broad subject that should be part of our everyday lives to defend against ever-growing smartphone attacks. Everyone, starting with end users all the way up to developers and security professionals should care about android security. Hacking Android is a step-by-step guide that will get you started with Android security. You’ll begin your journey at the absolute basics, and then will slowly gear up to the concepts of Android rooting, application security assessments, malware, infecting APK files, and fuzzing. On this journey you’ll get to grips with various tools and techniques that can be used in your everyday pentests. You’ll gain the skills necessary to perform Android application vulnerability assessment and penetration testing and will create an Android pentesting lab.

Preface

Preface

What this book covers

What you need for this book

Who this book is for

Conventions

Reader feedback

Customer support

Free Chapter

1. Setting Up the Lab

1. Setting Up the Lab

Installing the required tools

Android Studio

Setting up an AVD

Configuring the AVD

ADB Primer

Summary

2. Android Rooting

2. Android Rooting

What is rooting?

Locked and unlocked boot loaders

Stock recovery and Custom recovery

Rooting Process and Custom ROM installation

Rooting a Samsung Note 2

Flashing the Custom ROM to the phone

Summary

3. Fundamental Building Blocks of Android Apps

3. Fundamental Building Blocks of Android Apps

Basics of Android apps

Android app components

Building DEX files from the command line

What happens when an app is run?

Understanding app sandboxing

Summary

4. Overview of Attacking Android Apps

4. Overview of Attacking Android Apps

Introduction to Android apps

Understanding the app's attack surface

Threats at the client side

Threats at the backend

Guidelines for testing and securing mobile apps

Automated tools

Identifying the attack surface

QARK (Quick Android Review Kit)

Summary

5. Data Storage and Its Security

5. Data Storage and Its Security

What is data storage?

Shared preferences

SQLite databases

Internal storage

External storage

User dictionary cache

Insecure data storage – NoSQL database

Backup techniques

Being safe

Summary

6. Server-Side Attacks

6. Server-Side Attacks

Different types of mobile apps and their threat model

Mobile applications server-side attack surface

Strategies for testing mobile backend

Summary

7. Client-Side Attacks – Static Analysis Techniques

7. Client-Side Attacks – Static Analysis Techniques

Attacking application components

Static analysis using QARK:

Summary

8. Client-Side Attacks – Dynamic Analysis Techniques

8. Client-Side Attacks – Dynamic Analysis Techniques

Automated Android app assessments using Drozer

Introduction to Cydia Substrate

Runtime monitoring and analysis using Introspy

Hooking using Xposed framework

Dynamic instrumentation using Frida

Logging based vulnerabilities

WebView attacks

Summary

9. Android Malware

9. Android Malware

What do Android malwares do?

Writing Android malwares

Registering permissions

Malware analysis

Tools for automated analysis

Summary

10. Attacks on Android Devices

10. Attacks on Android Devices

MitM attacks

Dangers with apps that provide network level access

Using existing exploits

Malware

Bypassing screen locks

Pulling data from the sdcard

Summary

Index

Index

Conventions

In this book, you will find a number of text styles that distinguish between different kinds of information. Here are some examples of these styles and an explanation of their meaning.

Code words in text, database table names, folder names, filenames, file extensions, pathnames, dummy URLs, user input, and Twitter handles are shown as follows: "Let us first delete the test.txt file from the current directory."

A block of code is set as follows:

@Override         
public void onReceivedSslError(WebView view, SslErrorHandler handler,                 SslError error) 
{            
   handler.proceed();         
}

When we wish to draw your attention to a particular part of a code block, the relevant lines or items are set in bold:

if(!URL.startsWith("file:")) {

Any command-line input or output is written as follows:

$ adb forward tcp:27042 tcp:27042
$ adb forward tcp:27043 tcp:27043

New terms and important words are shown in bold. Words that you see on the screen, for example, in menus or dialog boxes, appear in the text like this: "Finally, give your AVD a name and click Finish."

Note

Warnings or important notes appear in a box like this.

Tip

Tips and tricks appear like this.

CONTINUE READING

83

Tech Concepts

36

Programming languages

73

Tech Tools

Unlimited access to the largest independent learning library in tech of over 8,000 expert-authored tech books and videos.

Innovative learning tools, including AI book assistants, code context explainers, and text-to-speech.

50+ new titles added per month and exclusive early access to books as they are being written.

Hacking Android

Search

Your notes and bookmarks