Testing .NET MAUI Android Apps: A Penetration Tester's Guide
Most mobile penetration testing guides assume Java or Kotlin code in the APK, but .NET MAUI apps work differently — the real business logic lives in .dll assemblies, not in DEX files. This guide walks through the full methodology for testing MAUI Android apps, from the perspective of someone who’s done it hands-on.
What you’ll learn
- Why standard tools like jadx won’t show you MAUI business logic, and why you need dnSpy or ILSpy instead
- How to extract and analyze
.dllassemblies from an APK usingapktool - How to map every screen in the app from
AssemblyInfoattributes - How to spot client-side authentication bypass vulnerabilities in
AppShell.cs - Common MAUI-specific vulnerability patterns: plaintext credential storage, client-side auth state, JWT tokens in SharedPreferences, and misconfigured exported activities
- How to use Frida to hook SharedPreferences writes and intercept credentials in real time
- A complete MAUI mobile application penetration testing (MAPT) checklist