I Reverse Engineered an Android App With Permission. Here's What I Learned.
A while back I got permission to test a consumer Android app and its backend. The app talked to a REST API and paired with a Bluetooth device. I tested against my own account and hardware I was allowed to touch, and every state-changing action sat behind an explicit confirmation prompt. This post is the sanitized version of that engagement: what I did, what broke, and what I would do differently.…
A consumer Android app and its backend were tested with permission. The app utilized a REST API and paired with a Bluetooth device. The author focused on authorization and scope before conducting any tests, ensuring not to touch other users' data or production data. The APK was pulled from a non-rooted phone using ADB, revealing it was a release build with debugging disabled.
The author noted that the native library contained most of the interesting logic and not the Java layer. The login process utilized one-time codes and a third-party sign-in flow, with the author successfully logging in using their own account. The API revealed various endpoints, including session, list, detail, and write endpoints.
The mobile UI and server had differing rules regarding data visibility, presenting a gap between user experience and server-side authorization. The Bluetooth protocol was also investigated, with the author decoding the payloads and understanding the trust boundary between the backend and the BLE device. Finally, a separate harness was built to exercise the API, keeping the original app untouched and minimizing the risk of destructive actions.
Written by urgent.news from Dev.to's reporting — not their text. Machine-written — may contain errors; check the original before relying on it.
