# Mobile Android Assessment

> Assess an Android app (static + dynamic). Load when the target is an APK/AAB, a mobile bug-bounty scope, or "test the android app". Signals: .apk file, Java/Kotlin/Smali, AndroidManifest.xml, exported components, WebViews, hardcoded secrets, Frida/objection.

- Skill: `noorqureshi/mobile-android-assessment` (Agent Skill)
- Install (CLI): `npx skillmds@latest add noorqureshi/mobile-android-assessment`
- Raw SKILL.md: https://api.skillmd.com/api/skills/noorqureshi/mobile-android-assessment/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: Coding & Dev Tools
- Author: NoorQureshi (https://skillmd.com/u/noorqureshi)
- Updated: 2026-09-17
- Page: https://skillmd.com/skills/noorqureshi/mobile-android-assessment

---


# Android app assessment

## When it applies
You have an APK (or a device/emulator running the app) and program scope covers the mobile
client + its backend. Most impactful mobile bugs are really API bugs the app exposes, plus
local data/secret leaks.

## Why it works
Client apps ship their logic and often their secrets. Decompilation reveals endpoints, keys,
and auth flows; exported components and WebViews expose attack surface; and the app trusts its
own device, so runtime instrumentation removes checks the server assumed were enforced.

## Method
1. **Unpack & triage**: `apktool d app.apk` (resources/manifest) and `jadx-gui app.apk`
   (readable Java). Read `AndroidManifest.xml` for `exported=true` activities/services/
   receivers/providers, `android:debuggable`, custom URL schemes, and `usesCleartextTraffic`.
2. **Hunt secrets & endpoints**: grep decompiled code + `res/` + `strings.xml` for API keys,
   base URLs, firebase configs, tokens (`grep -rniE "api[_-]?key|secret|https?://"`).
3. **Local storage review**: after use, pull `/data/data/<pkg>/` (shared_prefs, sqlite, files)
   for tokens/PII stored in cleartext.
4. **Dynamic**: run under Frida/objection — `objection -g <pkg> explore` to dump keystore,
   bypass root/emulator checks, and hook methods. Proxy traffic (Burp) to test the backend.
5. **Exported components**: invoke exported activities/providers via `adb shell am start`/
   `content query` to reach functionality without auth.

## Gotchas
- Cleartext-secret finding needs impact — a key with no privilege is informational; tie it to an action.
- Cert pinning blocks proxying → see `mobile-cert-pinning-bypass` before concluding "no traffic".
- The real bugs are usually server-side (BOLA/mass-assignment) reached via the app — proxy and test the API.

## Verify success
A concrete impact: leaked working credential/endpoint, unauthenticated reach into an exported
component, or a backend bug proven through the app's traffic.

## References
OWASP MASVS/MASTG; OWASP Mobile Top 10 (2024); jadx/objection docs.