To do this we need to enable the Developer options.

This is so we can communicate to it using the Android SDK tools. The first thing we need to do is make sure our Android device has USB debugging enabled. The instruction below walks through how to get your device ready for testing. I recommend that all the tools are added to your path environment variable so they can be easily accessed.įor those of you who want to use the APK I am using in this blog, you can download it here:Ĭom. Setting up the Device The device I am using is a stock Nexus 4 running Android 4.4.4. IDE (Eclipse, IntelliJ IDEA, Android Studio)įor this blog I will be using Windows 8, Android Studio, and IntelliJ IDEA.Dumping the APK and Decompiling to Sourceīelow is a list of requirements for performing the attacks covered in this blog.Modifying the AndroidManifest.xml to Enable Debugging.This blog should be interesting to mobile penetration testers and developers who are trying to gain a better understanding of possible attacks on the Android platform. Some examples include intercepting traffic before it is encrypted, obtaining encryption keys when they are being used, and obtaining passwords and other sensitive data when they don’t touch the disk. The best part is, root privilege is not required. This can come in handy during mobile application penetration tests because we can step into an application while it’s running and potentially obtain and write information that we normally wouldn’t have access to. In this blog, I am going to walk through how we can attach a debugger to an Android application and step through method calls by using information gained from first decompiling it.

How does android studio debugging work