* [ ] Check for the use of [obfuscation](android-checklist.md#some-obfuscation-deobfuscation-information), checks for noting if the mobile was rooted, if an emulator is being used and anti-tampering checks. [Read this for more info](android-app-pentesting/#other-checks).
* [ ] Sensitive applications \(like bank apps\) should check if the mobile is rooted and should actuate in consequence.
* [ ] Search for [interesting strings](android-app-pentesting/#looking-for-interesting-info) \(passwords, URLs, API, encryption, backdoors, tokens, Bluetooth uuids...\).
* [ ] Special attention to [firebase ](android-app-pentesting/#firebase)APIs.
* [ ] [Read the manifest:](android-app-pentesting/#basic-understanding-of-the-application-manifest-xml)
* [ ] Check if the application is in debug mode and try to "exploit" it
* [ ] Check if the APK allows backups
* [ ] Exported Activities
* [ ] Content Providers
* [ ] Exposed services
* [ ] Broadcast Receivers
* [ ] URL Schemes
* [ ] Is the application s[aving data insecurely internally or externally](android-app-pentesting/#insecure-data-storage)?
* [ ] Is there any [password hard coded or saved in disk](android-app-pentesting/#poorkeymanagementprocesses)? Is the app [using insecurely crypto algorithms](android-app-pentesting/#useofinsecureandordeprecatedalgorithms)?
* [ ] All the libraries compiled using the PIE flag?
* [ ] Don't forget that there is a bunch of[ static Android Analyzers](android-app-pentesting/#automatic-analysis) that can help you a lot during this phase.
* [ ] Prepare the environment \([online](android-app-pentesting/#online-dynamic-analysis), [local VM or physical](android-app-pentesting/#local-dynamic-analysis)\)
* [ ] Is there any [unintended data leakage](android-app-pentesting/#unintended-data-leakage) \(logging, copy/paste, crash logs\)?
* [ ] [Confidential information being saved in SQLite dbs](android-app-pentesting/#sqlite-dbs)?
* [ ] Is the application [transmitting information in clear text/using weak algorithms](android-app-pentesting/#insufficient-transport-layer-protection)? is a MitM possible?
* [ ] This one is really important, because if you can capture the HTTP traffic you can search for common Web vulnerabilities \(Hacktricks has a lot of information about Web vulns\).
* [ ] Check for possible [Android Client Side Injections](android-app-pentesting/#android-client-side-injections-and-others) \(probably some static code analysis will help here\)
* [ ] [Frida](android-app-pentesting/#frida): Just Frida, use it to obtain interesting dynamic data from the application \(maybe some passwords...\)
If you want to **know** about my **latest modifications**/**additions** or you have **any suggestion for HackTricks or PEASS**, ****join the [💬](https://emojipedia.org/speech-balloon/) ****[**PEASS & HackTricks telegram group here**](https://t.me/peass), or **follow me on Twitter** [🐦](https://emojipedia.org/bird/)[**@carlospolopm**](https://twitter.com/carlospolopm)**.**
If you want to **share some tricks with the community** you can also submit **pull requests** to ****[**https://github.com/carlospolop/hacktricks**](https://github.com/carlospolop/hacktricks) ****that will be reflected in this book.
Don't forget to **give ⭐ on the github** to motivate me to continue developing this book.
