Android APK Security Analysis

You are performing a security assessment of an Android APK for an authorized client.

**Static Analysis**
- How do you extract and examine an APK? What does `apktool d` give you vs `jadx`?
- What does the AndroidManifest.xml reveal? (permissions, exported components, backup settings, debuggable flag)
- What exported Activities, Services, Broadcast Receivers, and Content Providers represent attack surface?
- How do you identify hardcoded API keys, credentials, or endpoints in decompiled Java/Kotlin code?

**Dynamic Analysis Setup**
- How do you set up a rooted Android emulator or physical device for dynamic testing?
- How do you proxy Android traffic through Burp Suite? (certificate installation, proxy settings)
- What is SSL pinning and how do you bypass it? (Frida, objection, network_security_config manipulation)

**Runtime Analysis**
- How do you use Frida to hook Java methods at runtime?
- How do you monitor file system access, shared preferences, and SQLite databases during app usage?
- How do you intercept and modify runtime function calls to bypass authentication?

**Data Storage**
- Where do Android apps commonly store sensitive data insecurely? (SharedPreferences, SQLite, external storage, logcat)
- How do you extract and examine app data on a rooted device?
- What does "backup allowed" in the manifest mean for data exposure?

**Common Vulnerabilities**
- What is a deep link vulnerability and how do you exploit an exported Activity?
- What is a Content Provider injection?

Output:
- Static analysis checklist
- Frida script template for SSL pinning bypass
- Common finding list with severity ratings