Every Android assessment starts with reconnaissance. Before touching a request, establish what the application contains, what it exposes and how its components communicate with the backend.

01 — Package reconnaissance

Start with the package name, version, SDK levels, permissions and exported components. aapt dump badging app.apk provides a fast overview, while the manifest reveals potential attack surface such as exported activities, providers and receivers.

02 — Static analysis

Use apktool for resources and smali, and jadx for a readable representation of DEX bytecode. Running both gives you speed when understanding logic and control when patching or tracing behaviour.

• Hardcoded API keys, tokens and endpoints
• Custom cryptographic implementations
• WebView JavaScript and interface configuration
• Root and debugger detection

03 — Dynamic analysis

Frida lets you validate assumptions at runtime by instrumenting authentication, cryptography and certificate-validation paths. For network visibility, combine a proxy with appropriate client-side instrumentation when testing certificate pinning.

frida -U -f com.target.app -l hooks.js --no-pause

04 — Correlate the evidence

Static analysis tells you where to look. Dynamic analysis tells you what actually happens. The useful findings often appear where application code, OS behaviour, network communication and user-controlled input intersect.