android:allowBackup
the default value of this attribute is true
adb backup -f backup.ab app.package.name
Use Android backup extractor (abe) to extract and repack android backups.
abe unpack backup.ab backup.tar
Download the .apk through the Inspeckage.Download -> APK
Use Google Enjarify tool for translating Dalvik bytecode to equivalent Java bytecode.
enjarify yourapp.apk -o yourapp.jar
Use JD-GUI to decompile and analyze Java bytecode.
java -jar jd-gui.jar
With monkeyrunner, you can write a Python program that run an automated start-to-finish test of an Android application. You provide input values with keystrokes or touch events, and view the results as screenshots.
Exemplo: Go to android-sdk-path/tools/
where the monkeyrunner
program there is and save in a file startfox.py:
from com.android.monkeyrunner import MonkeyRunner, MonkeyDevice
import commands
import sys
# starting script
print "start"
# connection to the current device
device = MonkeyRunner.waitForConnection()
print "launching firefox: Package=org.mozilla.firefox and Main Activity=org.mozilla.gecko.BrowserApp"
device.startActivity(component='org.mozilla.firefox/org.mozilla.gecko.BrowserApp')
#wait
MonkeyRunner.sleep(3)
print "end of script"
Now, run: monkeyrunner startfox.py
and the firefox is launched.
1 - Connect both your device and your computer to the same wireless network;
2 - Choose your favorite http proxy tool and set up a new proxy listenner -- eg. listener address: 192.168.25.22 (computer ip) and port: 8001 (port number that is not currently in use);
3 - Go to Inspeckage (Settings -> Add Proxy
) and set up the same address (192.168.25.22) and port (8001) of your proxy tool;
4 - Now, open the app (in a feature that makes http request) and the request should be intercepted in your proxy tool.
OWASP ZAPIf the app use HTTPS, you need install the proxy tool certificate in your device.
https://developer.android.com/training/articles/security-ssl.htmlIf the app use HTTPS and certificate pinning, you need install the proxy tool certificate in your device and bypass the pinning.
The Inspeckage can disable pinning for some libraries. Settings->SSL uncheck [ON]