REA Mobile App Recovery & 5-Pillar Vulnerability Scanner (Android & iOS)

Scope & Authorization

Covers all first-party mobile application reverse engineering, lost source code reconstruction, and automated security vulnerability scanning for Android (.apk, .aab, .dex, .so) and iOS (.ipa, Mach-O) applications.

1. The 5-Pillar Mobile Vulnerability Scanner Checklist (PTKD & OWASP MASVS)

Whenever the user asks to scan, audit, or check weakpoints in their mobile app (or asks what vulnerabilities to look for), systematically inspect and report on these 5 pillars with exact file/line evidence and remediation code:

Pillar 1: In the Manifest (AndroidManifest.xml / Info.plist)

• Exported Components (android:exported="true"): Flag any Activity, Service, BroadcastReceiver, or ContentProvider with android:exported="true" (or implicit intent-filters) that lacks strict permission guards—which lets third-party apps launch private screens, steal data via ContentProviders, or trigger background actions.
• Deep Link & Intent Hijacking: Audit <data android:scheme="..." /> handlers for unvalidated URI parameters and intent redirection.
• Build & Backup Flags: Flag android:debuggable="true" and android:allowBackup="true" in production manifests.

Pillar 2: In Local Storage (/data/data/<package_name>/ & External Storage)

• Plaintext SharedPreferences & SQLite: Flag storing passwords, JWT/OAuth tokens, session cookies, or PII in unencrypted shared_prefs/*.xml or plaintext SQLite .db files (recommend migrating to EncryptedSharedPreferences / JetPack DataStore with Tink / SQLCipher / Android Keystore / iOS Keychain).
• External Storage (SD Card / Public Folders): Flag any use of getExternalStorageDirectory(), getExternalFilesDir(), or MODE_WORLD_READABLE / MODE_WORLD_WRITEABLE where any other app on the device can read or modify sensitive app files.