Android Application Exploitation: Structured Assessment Methodologies
Kyle Benac presents a structured methodology for auditing Android applications, analyzing hybrid frameworks, IPC intent vulnerabilities, and insecure storage.
Summary
The Expanding Mobile Attack Surface
Modern Android applications frequently handle sensitive user authentication tokens, financial data, and enterprise APIs across hybrid and native codebases.
Identifying Mobile Frameworks and Architectures
Kyle Benac explains how to quickly identify whether an application is built with native Java/Kotlin, Flutter, React Native, or Xamarin to focus vulnerability analysis.
Auditing Inter-Process Communication and Exported Components
The author demonstrates inspecting AndroidManifest.xml for exported activities, broadcast receivers, and content providers vulnerable to intent injection and data leakage.
Practical Mobile Assessment Tooling and Remediation
The presentation outlines streamlined workflows using tools like jadx, Frida, and objection to accelerate mobile penetration testing.
Related talks
Red Team Village·22 min
Kürşat Akıncı · Mert Can Coşkuner
Kürşat Akıncı and Mert Can Coşkuner analyze modern Android malware techniques, from multi-stage droppers bypassing Google Play Protect to dynamic evasion.
Red Team Village·15 min
Ibad Shah
Ibad Shah shares the journey of discovering critical flaws in a million-user Android app, navigating vendor communication, and executing coordinated vulnerability disclosure.
Main Stage·47 min
Hugo Gonzalez · Caleb Howell
Deconstructs the anti-cheat and runtime integrity mechanisms in Pokemon Go, demonstrating mobile reverse engineering and integrity bypass tradecraft.