Python-Mindmap

Android App Penetration Testing Mind Map

This is a comprehensive mind map covering various aspects of Android app penetration testing. The categories are structured to provide an in-depth look into the tools, methodologies, and best practices.

1. Prerequisites

• Linux Basics
• Programming Basics (Java Recommended)
• Virtualization Basics
• Optional: App Dev Background (Not required, but good to have)

2. Architecture

• Application
• Application Framework
• Libraries & ART
• Linux Kernel

3. Inside of an APK

• AndroidManifest.XML
• classes.dex
• res
• META-INF
  • Manifest.mf
  • cert.sf
  • cert.rsa

4. Lab Setup

• Kali/Parrot VM (Attacker)
• Genymotion / Android Studio AVD (Attacker)

5. Terminologies

• Activity
• Content Provider
• Content Resolver
• Broadcast Receiver
• Intent
  • Explicit
  • Implicit
• Intent Filter
• Intent Resolution
• Services

6. Tools Setup

• adb
• MOB-SF
• apktool
• jadx / jadx-gui
• zipalign
• Optional (but good to know):
  • frida
  • objection
  • qark
  • drozer

7. Pentest Methodology

• Recon
• Static Analysis
• Dynamic Analysis
• Reporting

8. OWASP Top 10

• M1: Weak Server Side Controls
• M2: Insecure Data Storage
• M3: Insufficient Transport Layer
• M4: Unintended Data Leakage
• M5: Poor Authorization & Authentication
• M6: Broken Cryptography
• M7: Client Side Injection
• M8: Security Decision via Untrusted Input
• M9: Improper Session Handling
• M10: Lack of Binary Protection

9. Practice Range

• DIVA
• Insecure Bank v2
• Injured Android

---

How to Use

This mind map provides a structured approach for performing Android app penetration testing. Follow the steps from setting up your environment to understanding OWASP vulnerabilities and practicing with real-world labs.