Tagged

#android

02 ENTRIES

• writeupSep 28, 20266 min read

  AndroGoat Static Analysis: Reading a Deliberately Vulnerable App with MobSF and JADX

  A static analysis pass over AndroGoat, an intentionally vulnerable Android app. MobSF surfaces a debug certificate, a v1 signature, and dangerous permissions, then JADX confirms the real bugs in code: a concatenated SQL query and a hardcoded promo code.

• writeupMar 7, 20263 min read

  Static Analysis of a Fake Pos Indonesia APK: an SMS-to-Telegram OTP Forwarding Trojan

  Static analysis of an Android APK impersonating PT Pos Indonesia. MobSF and JADX reveal an SMS interceptor that forwards incoming messages to a hardcoded Telegram bot, sends SMS on command, and stores data for retry, a classic OTP forwarding trojan.