# Android Checklist

## How to approach a target ?

When performing Android penetration testing we first need to split the test into two phases

* Client Side Pentest (Mobile)
* Server Side Pentest (API / Web)

*The client side part is for mobile APK, in this phase you should perform a static/dynamic code analysis. Reversing the application in order to look for code quality, bypass root detection if exist. Looking for insecure data logging, etc...*

*The server side part is about API/Web pentesting, in this phase you should be able to test for web vulnerabilities like IDOR, SQL, SSRF, Command injection and any server side vulnerability that affect web application.*

### Client Side Vulnerabilities

#### Memory/Storage Analysis

* Sensitive information disclosed in storage of the mobile device 
* Sensitive information found in logs 
* Sensitive information found in cache
* Sensitive information found in installed application folder
* Sensitive information stored in SQLite database in cleartext
* Check if sensitive information remains there even after log out
* Sensitive information stored in shared preference files Code level vulnerabilities
* Source code obfuscation not found
* Sensitive information disclosed in application error message
* Binary reverse engineering

#### **Transport layer security**

* Older version of SSL used
* SSL pinning bypass
* Weak ssl ciphers and other SSL related vulnerabilities (sslscan, sslyze, osaft etc.)

### **Server side Vulnerabilities**

#### **Business Logic Check**

* User account compromise of other user
* Admin account compromise from user account
* Bruteforce authentication/otp/other services
* Check for server side validation
* Check for root detection method / bypass it
* Check for vulnerable android components

#### Server Side Check

* Check for SQL injection
* CAPTCHA implementation flaws & bypass
* Check for all HTTP methods (PUT, DELETE etc. Use burp intruder using HTTP verb tampering)
* Check for client side injection (XSS)
* Username enumeration
* Other user's sensitive details enumeration
* User detail's enumeration using IDOR
* Malicious file upload
* Server side flaws (IIS, APACHE, TOMCAT etc.)
* Run nikto, dirb on web content URL
* Check for session management (cookie flaws, session overriding, session fixation etc.)