Lesson 2.35: Secrets hidden in the app
Developers sometimes put API keys, passwords or encryption keys into an app, assuming compiled code hides them. It doesn't: a decompiler turns the app back into readable Java, and even without one, the strings in the code and native libraries can be read directly. In the lab you decompile Northwind Shop with jadx, search the sources for keys and plain-HTTP addresses, show that the same secret is readable straight from classes.dex, find a hard-coded encryption key in a native library, and tell real secrets from identifiers that are meant to be public.
17 min
You will learn to
- Decompile an APK with jadx
- Search sources for secrets and insecure URLs
- Read strings from dex and native libraries
- Tell secrets from public identifiers
- Plan the response to a leaked key
Key terms
- Decompiler
- A tool that turns compiled code back into readable source.
- Hard-coded secret
- A password, key or token written into the code or resources.
- Publishable vs secret key
- A publishable key identifies the app and is meant to be public; a secret key authorises actions and belongs on a server only.
- Obfuscation
- Renaming classes and methods to make code harder to read (e.g. R8).
- Android Keystore
- System service that creates and uses keys inside protected hardware without exposing them to the app.
← Links and lookalike domains · All lessons · IPv4 addresses, binary and the subnet mask →