Mobile applications rely on complex backends that introduce significant security risks, yet developers often lack the tools to assess these risks effectively. This paper presents AndroScanner, an automated pipeline for detecting vulnerabilities in Android application backends through combined static and dynamic analysis. AndroScanner extracts backend API calls from APK files using apktool, Androguard, and Frida-based dynamic instrumentation, then vets them against the OWASP API Security Top 10 using APIFuzzer. We evaluate AndroScanner on two Android applications: a purposely vulnerable bank application and a production recruitment application with over 50,000 downloads on Google Play Store. Across both applications, AndroScanner extracted 24 APIs and identified 5 vulnerabilities, including a previously unreported zero-day Excessive Data Exposure vulnerability (ranked 3rd in the OWASP API Security Top 10) in the production application. The vulnerability was responsibly disclosed to the development team prior to publication. AndroScanner is available upon request to assist developers in identifying and remediating backend security risks before deployment.

翻译：移动应用依赖复杂的后端服务，这带来了显著的安全风险，而开发者往往缺乏有效评估这些风险的工具。本文提出AndroScanner，一种通过静态与动态分析相结合来自动检测安卓应用后端漏洞的流水线方案。AndroScanner利用apktool、Androguard及基于Frida的动态插桩技术，从APK文件中提取后端API调用，随后依据OWASP API安全Top 10列表，使用APIFuzzer对这些API进行审查。我们在两款安卓应用上对AndroScanner进行了评估：一款为刻意构造的易受攻击的银行应用，另一款为Google Play商店下载量超过5万次的正式招聘应用。在这两款应用中，AndroScanner共提取了24个API，并识别出5个漏洞，其中包括该正式应用中一处此前未被报告的零日漏洞——过度数据暴露（Excessive Data Exposure）漏洞（在OWASP API安全Top 10中排名第三）。该漏洞已在论文发表前负责任地向开发团队披露。AndroScanner可按需获取，以帮助开发者在部署前识别并修复后端安全风险。