Arthur - A Framework for Mobile Application Pentesting

Smartphones are becoming an integral part of our everyday lives; we take advantage of them right from setting up an alarm to controlling our home using various applications provided by third-party companies. So, the question that comes down here is, do these apps have a vulnerable code that can be exploited and do these apps do more than what they are intended for? This article presents a framework that can be used for penetration testing (Pentesting) on Android Mobile Applications. It’s designed and developed for Security Enthusiasts and Application Developers for real-time penetration testing and Automating Security Audits. This framework helps to extract Java source code from an APK (A file format for applications used on the Android operating systems), Converting a Bundle APK to Single APK by collecting required assets from all the Bundle APKs. The framework gives an option to resign APK after de-compilation with different APK Signature schemes. The framework has the capability of finding client-side vulnerabilities in Android applications by parsing through the source code and finding specific code patterns which are vulnerable. It also explains why the code block is vulnerable. Another main feature includes Malware analysis which is done for identifying whether if the app is behaving as expected or if it does more than what it's intended to do. The framework does this analysis in the background and provides a report for the same. The framework provides a consolidated report based on the findings after the detail scan is completed thereby reducing the effort and time which is taken through the manual process of auditing a mobile application.