Lion Cipher Lab
Read an APK's manifest and permissions: surveillance, credential theft, or SMS abuse?
- Digital Forensics & IR (DFIR)
- Intermediate
- ~40 min
- Free · no account required
Why it matters
The single highest-signal thing you can read off an Android app in under a minute is its permission list held up against what the app claims to be. A calculator does not need to read your text messages; a flashlight does not need to be an accessibility service. That mismatch — over-permissioning relative to purpose — is where mobile-malware triage starts, and it is a skill any SOC analyst, incident responder, or mobile reviewer is expected to have. This drill hands you the static artifacts a reverse-engineer already pulled from a suspicious APK and teaches you to reason from them to a…
What you'll learn
- reading a decoded AndroidManifest.xml permission list
- spotting over-permissioning: permissions vs the app's stated purpose
- knowing what each dangerous Android permission actually enables
- reading declared components (receivers, services, accessibility services) as capability
- pivoting permissions -> components -> API strings -> network IOCs
- mapping mobile malware behavior to MITRE Mobile ATT&CK techniques
- judgment: when static manifest analysis characterizes intent vs when you must confirm dynamically
Steps in this lab
- The scenario, and what 'static analysis' means here
- Artifact 1 — the permission list (read it against the app's story)
- What each dangerous permission actually BUYS the attacker
- Artifact 2 — the declared components that WIRE the permissions up
- Artifact 3 — the strings: from capability to network IOCs
- Map the behavior to MITRE Mobile ATT&CK
- The third rule: WHEN static settles it, WHY over-permissioning is the tell, HOW a pro confirms
- Your verdict, and how you'd write it