Android Hacking for Beginners

This blog-style report details a hands-on security assessment of the Damn Vulnerable Banking App (DVBA). It covers setting up an Android emulator and proxying traffic through Burp, bypassing runtime protections (Frida detection and SSL pinning), extracting and cracking a JWT signing secret to forge admin tokens, analyzing insecure local storage and SQLite databases, launching hidden activities to approve beneficiaries and transfer funds, and reverse-engineering/applying Frida hooks to encrypt/decrypt API payloads — demonstrating how multiple weaknesses can be chained to achieve account takeover and financial fraud.