Lion Cipher Lab
Analyze an Android APK with MobSF
- AppSec / DevSecOps
- Intermediate
- ~60 min
- Free · no account required
Why it matters
You carry dozens of mobile apps in your pocket, and each one is a bundle of code, permissions, and stored data that you normally cannot see into. For the people who BUILD and DEFEND those apps, that opacity is the problem: an app can quietly ship a hardcoded password, store your data in a file any other app can read, or expose an internal screen so a malicious app can trigger it -- and none of that is visible from the outside. Mobile appsec is the discipline of looking inside an app package (an APK on Android) and answering plain questions: what can this app do, what does it ask for, what…
What you'll learn
- understanding what an APK, static analysis, and a mobile app scanner actually are, from zero
- installing Docker and running MobSF (Mobile Security Framework) with a single command
- getting a SAFE, legal test APK (a deliberately-vulnerable teaching app, or an app you own)
- uploading an APK to MobSF and producing a full rendered static-analysis report
- reading the AndroidManifest.xml: package name, components, and the app's declared capabilities
- reading the permissions list and telling a normal permission from a dangerous one
- understanding what an exported component is and why an exposed one is a risk
- spotting hardcoded secrets (API keys, passwords) and insecure data storage in a report
- optionally opening the decompiled Java with jadx to confirm a finding in the actual code
- connecting each finding back to the OWASP mobile security standard (MASVS/MASTG) that names it
Steps in this lab
- What this lab is, and why it is legal and safe
- The words you need first: APK, manifest, permission, exported component, decompile (from zero)
- Install Docker on your machine
- Start MobSF with one command and open it in your browser
- Get a SAFE, legal test APK
- Upload the APK and run the static analysis scan
- Read the permissions and the manifest
- Find the hardcoded secrets and insecure storage findings
- Optional: confirm a finding in the real code with jadx
- Map what you found to the OWASP mobile standard, and where this goes next