Static Analysis

Static analysis reads the app without running it — and because you already hold the whole APK, the first hour of any assessment is just reading it well. MobSF automates that first pass: it decompiles, scores the manifest, flags exported components, and greps for secrets in minutes. This covers the MobSF pipeline, how to read an AndroidManifest for the real attack surface, and how to hunt hardcoded secrets without drowning in false positives.