Checklist

Step 1 – Device Connection (Every Session Start)

• Restart and Verify ADB Connection
  • adb kill-server
  • adb start-server
  • adb devices -l
• Confirm Device Information
  • adb shell getprop ro.product.model
  • adb shell getprop ro.build.version.release
• Confirm Root Access (If Required)
  • adb shell
  • su -c id

Step 2 – Confirm Target Application

• Identify Installed Package
  • adb shell pm list packages | grep example
• Launch Target App Manually
• Get Running Process ID
  • adb shell pidof com.example.target
  • adb shell ps -A | grep example
• Monitor Runtime Logs (Optional)
  • adb logcat --pid=$(adb shell pidof com.example.target)

Step 3 – APK Extraction (Static Analysis)

• Get APK Path
  • adb shell pm path com.example.target
• Pull APK from Device
  • adb pull $(adb shell pm path com.example.target | sed 's/package://') ./target.apk
• Decompile APK
  • jadx -d jadx-output target.apk
  • apktool d -f -o apktool-output target.apk
• Extract Metadata
  • aapt dump badging target.apk | head -n 20
  • aapt dump xmltree target.apk AndroidManifest.xml | head -n 50
• Search for Secrets and Network Code
  • rg -n "Authorization|token|api_key" jadx-output
  • rg -n "network_security_config|CertificatePinner|TrustManager" jadx-output

Step 4 – Network Interception Setup

• Check Current Proxy Setting
  • adb shell settings get global http_proxy
• Set Proxy via ADB
  • adb reverse tcp:8080 tcp:8080
  • adb shell settings put global http_proxy 127.0.0.1:8080
• Configure WiFi Proxy (If Using Network Mode)
  • Manual proxy: host=ATTACKER_IP port=8080
• Install CA Certificate (If Required)
• Confirm Traffic Appears in Intercepting Proxy

Step 5 – Certificate Pinning Checks

• Static Search for Pinning Logic
  • rg -n "CertificatePinner|TrustManager|HostnameVerifier" jadx-output
• Monitor TLS Errors at Runtime
  • adb logcat | grep -i "ssl\|tls\|pinning\|certificate"

Step 6 – Application Data Extraction (Root Required)

• Dump Application Data
  • adb shell su -c "cp -r /data/data/com.example.target /sdcard/target-data"
  • adb pull /sdcard/target-data ./data
• Inspect Shared Preferences
  • adb shell su -c "cat /data/data/com.example.target/shared_prefs/*.xml"
• Pull SQLite Databases
  • adb shell su -c "cp /data/data/com.example.target/databases/*.db /sdcard/"
  • adb pull /sdcard/*.db ./databases/
  • sqlite3 database.db ".tables"

Step 7 – Native Library Inspection

• List Native Libraries
  • unzip -l target.apk | grep ".so"
• Inspect Native Strings
  • strings lib/arm64-v8a/*.so | grep "http"

Step 8 – Cleanup

• Remove Proxy
  • adb shell settings put global http_proxy :0
• Flush IPTables (If Used)
  • adb shell su -c "iptables -t nat -F"
• Remove Temporary Files
  • adb shell su -c "rm -rf /sdcard/target-data"

Rapid Engagement Workflow

• Quick Command
  • adb devices -l && adb shell su -c id && adb shell pidof com.example.target