The Android platform can be attacked either by creating a simple APK file, or by injecting the payload into the existing APK. We will cover the first one. Let's get started by generating an APK file with msfvenom, as follows:
On producing the APK file, all we need to do is either convince the victim (perform social engineering) to install the APK, or physically gain access to the phone. Let's see what happens on the phone as soon as a victim downloads the malicious APK:
Once the download is complete, the user installs the file as follows:
Most people never notice what permissions an app asks for while installing a new application on the smartphone. So, an attacker gains complete access to the phone and steals personal data. The preceding screenshot lists the required permissions an application needs to operate correctly. Once the install...
