Android Application Pentesting Part 1
What's an APK file?
Stands for Android package
It's an .exe quivalent of Android OS
It's a ZIP file
Contains source code and other important files that helps to run an app
Key components of an APK file are:
AndroidManifest.XML
Classes.dex
resources.arsc
res
META-INF
AndroidManifest.XML
Declares the Android API that the application is going to use
Permissions that an application needs
List all the Activities, Services, Broadcast Receivers and Content Providers etc.
Classes.dex
It contains Java bytecode in DEX (Dalvik Exchange) format
res
Contains device configuration, Bitmaps and Layouts
resources.arsc
Contains compiled resources in a binary format
May also include images, strings, or other data used by an app
META-INF
This folder contains the manifest information and other metadata about the java package carried by the jar file.
MANIFEST.MF: It contains various information used by the java run-time environment when loading the jar file, such as which is the main class to be run from the jar file, version of package, build number, creator of the package, security policies/permissions of java applets and the list of file names in the jar along with their SHA1 digests, etc.
CERT.SF: This contains the list of all files along with their SHA-1 digest.
CERT.RSA: This contains the signed contents of the CERT.SF file along with the certificate chain of the public key used for signing the contents.
Unzip an APK file
Last updated