In a penetration test or red-team engagement that targets mobile devices, one of the first things an operator needs is command-and-control (C2): a channel through which you can issue instructions to an implant running on the target device and receive the results back. Geolocatio…
When analysing an Android application’s network traffic — whether for security auditing, API reverse engineering, or penetration testing — the first obstacle you will almost always face is SSL/TLS certificate pinning. Certificate pinning is a defence mechanism that tells t…
In our previous article we set up an Android development environment, suitable to create new applications and load them into an Android system (either physical or emulated). This time we will explore tools and techniques that will help us inspect and edi…
The process of reverse engineering an Android application (whether for malware analysis, testing purposes or development) requires a specific working environment. In this article we will set up an android RE environment that will help us analyse Android applications…