# On your laptop:
# Burp -> Proxy -> Options -> Add listener on 0.0.0.0:8080
 
# On device:
# WiFi -> Proxy -> Manual -> your laptop IP, port 8080
# Install Burp CA cert (browse to http://burpsuite)
 
# Android 7+ system CA trust workaround (without root):
# Use a patched APK that sets network_security_config.xml to trust user certs
# apktool d target.apk, add res/xml/network_security_config.xml:
cat <<'EOF'
<?xml version="1.0" encoding="utf-8"?>
<network-security-config>
    <base-config>
        <trust-anchors>
            <certificates src="system"/>
            <certificates src="user"/>
        </trust-anchors>
    </base-config>
</network-security-config>
EOF
# Then rebuild: apktool b ./apktool-out/ -o patched.apk && sign it

1. Auth tokens - format, algorithm, expiry
2. Internal API hostnames - may differ from the web API
3. Endpoints not in the web app - export, admin, bulk, internal
4. API versioning - mobile app may use v1 while web uses v2 (or vice versa)
5. Custom headers - X-App-Version, X-Device-ID, X-Platform - bypass these by adding to your requests
6. Fields in responses that the UI doesn't render - look at raw JSON

# Export Burp proxy history as XML, then parse
# Or use Burp's built-in "crawl and audit" after capturing manual traffic
 
# Extract unique API paths from Burp history with python
# (or just eyeball the Site Map)

Methodology:
1. Capture web app traffic for the same feature set
2. Capture mobile app traffic
3. Diff the endpoint lists
4. Endpoints that exist only in mobile traffic are your targets
5. Try calling mobile-only endpoints from a web session (no mobile headers) - if they work, test harder

1. App handles: target://oauth/callback?code=X
2. Attacker's malicious app also registers target:// scheme
3. On older Android, the OS shows a chooser - user might pick the wrong app
4. On newer Android, ambiguous intent resolution could default to attacker app
5. Attacker receives the OAuth code, exchanges it for a token

# App opens password reset screen pre-filled from deep link
target://reset-password?token=ABC123&email=victim@example.com
 
# Test:
# 1. Can you reuse a consumed token?
# 2. Does the email parameter actually bind to the token's account, or can you swap it?
# 3. Can you trigger the reset with no token at all? (token= empty/missing)

# If email change confirmation comes via deep link:
target://verify-email?token=ABC123
 
# Test: does confirming YOUR email change token also work when called with a different account's email already-set token?
# Try: intercept your own email change link, modify email= param before the app processes it

# Social login deep links
target://oauth/google?code=X&state=Y
 
# state parameter CSRF check: is the state validated against session?
# If state is predictable or missing, trigger social account linking to attacker-controlled Google account

# 1. Register your device token to another user's account
POST /api/push/register
{"device_token": "your_apns_token", "user_id": "victim_id"}
# If no auth check on user_id, you receive victim's push notifications
 
# 2. Deregister another user's device (DoS on notifications)
DELETE /api/push/register
{"device_token": "victim_device_token"}
 
# 3. Push notification content exposure
# Some apps include sensitive data in push notification payloads
# Visible on lock screen, logged by analytics SDKs, readable by other apps in some configs
# (iOS: check if app sets notification content to include tokens/PII)

# Android: Firebase Cloud Messaging token
# In Burp, look for requests to /api/push/register or similar after first app launch
# Also in SharedPreferences: grep for "fcm_token", "push_token", "device_token"
 
# iOS: APNs token comes from application:didRegisterForRemoteNotificationsWithDeviceToken:
# Hook it with Frida to capture it:
frida -U -f com.target.app -l - <<'EOF'
ObjC.implement(ObjC.classes.AppDelegate["- application:didRegisterForRemoteNotificationsWithDeviceToken:"], function(handle, selector, app, tokenData) {
    var token = ObjC.Object(tokenData).description().toString();
    console.log("APNs token: " + token);
    return this.application_didRegisterForRemoteNotificationsWithDeviceToken_(app, tokenData);
});
EOF

# Download current version and previous version
# Decompile both, then diff
diff -r ./decompiled-v1/ ./decompiled-v2/ > version-diff.txt
grep -A5 "api\|secret\|key\|token\|endpoint" version-diff.txt