Before You Hack: Android Edition

Before You Start Android App Hacking: What Should You Learn First?

.بسم الله والصلاة والسلام على أشرف خلق الله سيدنا محمد ﷺ وعلى آله وصحبه أجمعين

So you want to get into mobile pentesting? That’s great. But if you jump straight into tools and attacks, you’ll probably feel confused very fast.

I’ve been there, and that’s why I wrote this roadmap. It shows you what to learn first, in a clear order, and why each step matters.

You don’t need to know everything in each phase. Just learn enough to understand what’s going on. Ready?

Phase 1: Programming and Code Reading Basics

Good news first: you don’t need to be an Android developer. But you do need to read code and understand what it does. Without that, you’ll be stuck the first time you open a decompiled app.

What to learn:

• Java/Kotlin fundamentals
• OOP basics (classes, objects, inheritance)
• Basic XML and JSON
• JavaScript basics “you’ll need it for WebViews”
• Introductory Smali and native code reading, depending on the app type

Phase 2: Linux and Command Line Basics

Here’s a fun fact: Android is built on Linux. So when you get a shell on a device, you’ll be using Linux commands all the time. If the terminal feels strange to you now, this phase will fix that.

What to learn:

• Navigating the file system
• File permissions and users
• Basic shell commands

Phase 3: Networking and Web Security Basics

Most mobile apps talk to a backend server. That means many bugs you’ll find are not inside the app itself, but in the APIs behind it. So you need to understand how the traffic moves.

What to learn:

• HTTP/HTTPS
• Requests and responses
• REST APIs and JSON
• Authentication, sessions, and tokens
• TLS/SSL and certificates
• Proxy concepts and Burp Suite basics

Phase 4: Android Fundamentals

Before you test something, you should know what it is. In this phase, you’ll learn what Android really is and how it’s organized. It’s the big picture that makes everything else easier.

What to learn:

• Hardware
• Android Operating System
• Android Shell
• Important Directories (like /data/data and /data/app)

Phase 5: Android Internals

Now let’s look under the hood. Android is built in layers, and each layer has a job. When you know these layers, you’ll understand where things run and where problems can happen.

What to learn:

• Android Software Stack
• Linux Kernel
• Hardware Abstraction Layer (HAL)
• Android Runtime (ART)
• Native C/C++ Libraries
• Java API Framework
• System Apps

Phase 6: Android Security Model

This one is very important. As a pentester, your job is to test security, so you first need to know how Android protects apps. Then you can understand what’s normal, and what’s a weakness.

What to learn:

• Android Security Features
• Application Sandbox
• Android Security Protections (DAC, SELinux, seccomp-bpf, and more)
• Application Signing
• Verified Boot

Wow wow wow, click on it! Trust me.

Okay, come on, let’s continue! Next up: APK Structure.

Phase 7: APK Structure

An APK is the file that holds an Android app. The first thing you’ll do in most tests is open it and look inside. So it helps a lot to know what each file is for.

Get Veen0o21’s stories in your inbox

Join Medium for free to get updates from this writer.

Remember me for faster sign in

What to learn:

• What an APK is “a signed archive of the app’s code, resources, and metadata”
• AndroidManifest.xml (permissions, components, SDK versions)
• classes.dex (compiled Java/Kotlin code, executed by ART)
• resources.arsc and res/ (compiled resources, layouts, strings, images)
• assets/ (raw bundled files such as JSON, databases, configs)
• lib/ (native .so libraries)
• META-INF/ (signing metadata)

Phase 8: Types of Applications and How They’re Built

Not all apps are built the same way, and that changes how you test them. A native app, a hybrid app, and a Flutter app all need slightly different approaches.

What to learn:

• Types of Applications: Native, Web, and Hybrid
• Native Apps
• Native Code (JNI and the NDK)
• JavaScript and WebViews
• Application Frameworks: Flutter, Xamarin, and React Native

Phase 9: App Components

Here’s where it gets exciting. Android apps are made of four main building blocks, and each one can become an entry point for an attacker. Learn them well, because you’ll use this knowledge in almost every test.

Activities

• Activity Lifecycle
• Launching an Activity
• Activity Back Stack
• Returning a result from an Activity

Services

• Types of Services
• Service Lifecycle

Broadcast Receivers

• Sending Broadcasts
• Declaring Broadcast Receivers
• Security relevance

Content Providers

• ContentResolver
• CursorLoader
• Content Provider Interaction Flow

Phase 10: Inter-Process Communication (IPC)

Components need to talk to each other, and sometimes apps need to talk to other apps too. This communication is where many real bugs hide, so this phase is a big deal for pentesters.

Intents

• Common Uses of Intents
• Explicit vs. Implicit Intents
• Passing Data with Intents
• Intent Resolution Flow

Binders

• Binder as Android’s main IPC mechanism
• AIDL (Android Interface Definition Language)

Deep Links

• Standard Deep Links
• Android App Links

So, What’s the Best Order?

Here’s a simple way to follow this roadmap:

1. Phases 1 to 3 are your prerequisites. Take your time here.
2. Phases 4 to 8 build your understanding of Android and the APK.
3. Phases 9 and 10 matter the most for pentesting, because most of the attack surface comes from exported components, Intents, and Deep Links.

BTW, did you click the link I randomly dropped in the middle?
If not, scroll up and do it or just click here.
It’s my Notion notes, where I explain everything we talked about above. They’re waiting for you.

See you in the next Edition, Insha’Allah.