Mobile App OSINT

39.1 Verified Tools

Tool	URL	Function
MobSF	https://github.com/MobSF/Mobile-Security-Framework-MobSF	Automated static/dynamic analysis framework
jadx	https://github.com/skylot/jadx	Java decompiler for APKs
apktool	https://ibotpeaches.github.io/Apktool/	APK resource decoder
dex2jar	https://github.com/pxb1988/dex2jar	.dex → .jar converter
APKPure	https://apkpure.com	Alternative APK source to Google Play
APKMirror	https://www.apkmirror.com	Historical APK archive

39.2 Mobile App OSINT Workflow — 6 Steps

1. Download APK from APKPure, APKMirror or Google Play (with apkeep or gplaycli).
2. Load into MobSF for an automatic report: permissions, components, hardcoded secrets, URLs in code.
3. Decompile with jadx for manual inspection: search for api_key|secret|token|password|AWS_|STRIPE_ with grep.
4. Audit AndroidManifest.xml for excessive permissions (location + contacts + SMS in an app that doesn't need them).
5. Identify third-party SDKs (analytics, ads, trackers): Facebook SDK, Google Analytics, Firebase, AppsFlyer, Adjust.
6. Document findings with code captures + file names + line numbers.

39.3 Use Cases

• Government / banking apps: audit permissions and SDKs to see what data they collect.
• Competitor apps: identify internal APIs (hardcoded URLs) for competitive intelligence.
• Dating / social apps: find undocumented endpoints (useful for safety investigations).
• Tracking apps: verify what data from minors educational apps collect.

39.4 Ethical Considerations

• Static analysis is legitimate. The APK is distributable and public.
• Dynamic analysis on your own device is legitimate.
• Publicly sharing decompiled code may violate copyright and Terms of Service.
• Do not use discovered internal APIs for mass scraping or abuse.

---