Mobile App OSINT Workflow

1. 1. Download APK from APKPure, APKMirror or Google Play (with apkeep or gplaycli).

   + Add note

2. 2. Load into MobSF for an automatic report: permissions, components, hardcoded secrets, URLs in code.

   + Add note

3. 3. Decompile with jadx for manual inspection: search for api_key|secret|token|password|AWS_|STRIPE_ with grep.

   + Add note

4. 4. Audit AndroidManifest.xml for excessive permissions (location + contacts + SMS in an app that doesn't need them).

   + Add note

5. 5. Identify third-party SDKs (analytics, ads, trackers): Facebook SDK, Google Analytics, Firebase, AppsFlyer, Adjust.

   + Add note

6. 6. Document findings with code captures + file names + line numbers.

   + Add note

🔒 Your progress and notes are saved only in this browser.