Apk Sherlock

Category: Penetration Testing

  • Attacking Android Widgets

    Alongside Activities, Services, Broadcast Receivers, and Content Providers, Android Widgets also serve as entry points to Android apps, broadening the app’s attack surface even more. The concept of Widgets began with Android 2 and has not significantly evolved since. At their core, Widgets are essentially Broadcast Receivers utilizing RemoteViews. To users, a Widget appears as

    Read article →

  • Android apps as reconnaissance tools.

    When targeting[1] a web surface—whether it’s a web application or a web server API—gathering intelligence and information is a crucial step before constructing payloads for any identified vulnerability. If the reconnaissance phase is executed correctly, the likelihood of errors during stages of the attack is significantly reduced. Tools like Burp Suite, OWASP ZAP, and others

    Read article →

  • Arbitrary function invocation on Android WebViews

    The WebView is one of the riskiest parts of an Android app if not set up correctly. It can cause many problems, like letting attackers change URLs or even execute code remotely. Unlike typical Android components, WebView can execute web content, making it more prone to attacks from different actors, including JavaScript injection and insecure

    Read article →

  • Security implications of Android implicit intents

    Android inter-process communication (IPC) is built on a fundamental interface called Binder. Through this very basic interface, which operates at the Linux kernel level, apps, services, and broadcasts can communicate with each other. To simplify development, Android also provides higher-level APIs to help developers avoid shooting themselves in the foot when building apps. Android intents

    Read article →

  • Common Android Vulnerabilities

    Nowadays, Android is everywhere—not just on our smartphones. More manufacturers are finding ways to integrate Android into everything from automotive infotainment systems to smart TVs and home security devices. There are good reasons for this trend. First, since Android is built on the Linux kernel, developers can easily transfer their skills and knowledge. Plus, Android

    Read article →