# Lab 3 - Sample APK for MobSF Static Analysis

## About this APK

The lab requires a deliberately vulnerable Android APK for MobSF static analysis.

## Recommended Sample APK

Use the **OWASP UnCrackable Level 1** APK, which is the canonical teaching sample
for mobile static analysis and is freely available from the OWASP MASTG project:

  https://github.com/OWASP/owasp-mastg/tree/master/Crackmes/Android/Level_01

Download the file `UnCrackable-Level1.apk` and place it in this directory as
`sample.apk` before running the lab.

The OWASP UnCrackable samples are purpose-built training targets that contain
intentional weaknesses (hard-coded secrets, weak crypto, debuggable flags) - they
map directly to the MASVS findings described in the book. No real user data is
involved.

## Alternative: Build a Minimal Synthetic APK

If you cannot download the OWASP sample, `build-synthetic-apk.sh` in this
directory will construct a minimal synthetic APK with hard-coded strings using
only standard tools (aapt2 / apktool if available). The resulting APK is not
runnable but is sufficient for MobSF static analysis.

## Authorisation reminder

Only upload APKs you own or are explicitly authorised to test. The OWASP
UnCrackable samples and any APK you built yourself are safe. Do NOT upload
third-party app-store APKs to MobSF without the developer's written permission.
