Reviewing cross-platform apps: React Native, Flutter and hybrid
You learn how apps built from one codebase look inside the package and where they go wrong: JavaScript bundles, Dart snapshots, bridge plugins, secure storage plugins and over-the-air update mechanisms.
Level 301 · 22 lessons · 18 practice labs
Lessons
Recognising the framework
- Telling which framework a package was built with
- How a cross-platform app runs: bridge and rendering engine
- Where the logic lives: bundle file, snapshot, native modules
- Risks the frameworks share
- Short task: classify five packages by framework and show the evidence
React Native
- Reading the JavaScript bundle: plain and Hermes bytecode
- Environment variables and keys baked into the bundle
- AsyncStorage versus secure storage plugins
- Native modules and link handling
- Auditing npm dependencies
- Short task: find the embedded service key in a React Native bundle and write the fix
Flutter
- Layout of a Flutter package: libapp, assets, plugins
- Hunting strings in the snapshot and secrets in assets
- The secure storage plugin and network trust settings
- Dart source review and pub dependency audit
- Short task: move Dart code that writes a token to a plain file into secure storage and test it
Hybrid and over-the-air updates
- Hybrid apps: web code, plugins and the content security policy
- The permission and bridge surface plugins open
- Over-the-air updates: bundle signing and integrity checks
- Reporting a cross-platform finding for both platforms
- Short task: find the missing signature check in an over-the-air update configuration
Capstone
- Capstone: review the Android and iOS packages built from one codebase and write a single report
Practice labs
- Find which framework an APK was built with: Show the telltale file in the package contents.
- Classify five packages by framework: Write the React Native, Flutter, hybrid or native verdict with evidence for each APK and IPA.
- Map where the logic lives on both platforms: Tabulate where the bundle file, snapshot and native modules sit in the APK and IPA of one app.
- Search the JavaScript bundle for URLs: Extract the API addresses from the bundle file.
- Find the service key baked into the bundle: Find the key that came from an environment variable and recommend a fix.
- Extract and examine strings from Hermes bytecode: Decode the bytecode, pick out sensitive strings and explain the difference from a plain bundle.
- Find the values written to AsyncStorage in code: Show the call that stores the token in the source.
- Move the token to a secure storage plugin: Change the storage module and pass the node tests.
- Audit npm dependencies and replace the risky package: Clear the high-severity flaw in the audit output and replace the unmaintained package.
- List the asset files in a Flutter package: Find the configuration files in the assets folder.
- Search the snapshot for embedded strings: Extract URL-like and key-like values from libapp.
- Move Dart code that writes to a plain file into secure storage: Change the storage class, check the network trust setting and verify with dart test.
- Read the content security policy in a hybrid app: Find the policy in the index file.
- Extract the permissions the plugins open: Match the plugin list to permissions and flag the unused plugin.
- Find the missing signature check in over-the-air updates: Examine the update configuration, prove signature verification is off and write the corrected setting.
- Decide which platforms a finding affects: Show the bundle key finding holds in both the APK and the IPA.
- Separate shared-code findings from native-layer ones: Classify eight findings as shared, Android only and iOS only.
- Review two packages from one codebase and write one report: Review the APK and IPA of the Ayçiçeği Gıda app, writing shared findings once and noting platform differences.
About this course
You learn how apps built from one codebase look inside the package and where they go wrong: JavaScript bundles, Dart snapshots, bridge plugins, secure storage plugins and over-the-air update mechanisms.
What you will learn
- Recognising the framework
- React Native
- Flutter
- Hybrid and over-the-air updates
- Capstone
Prerequisites
You should be comfortable with the level 101 and 201 topics of the same path.
Lab environment
Lessons run in your own Kali Linux terminal that opens in the browser. Nothing to install; the lab starts clean in every lesson.
Frequently asked questions
- Is this course right for my level?
- The course is at level 301; it assumes you know the topics of the lower-level courses.
- Is there anything to install?
- No. Every lesson runs in your own lab environment that opens in the browser.
- How do lessons work?
- Each lesson has 8 to 10 steps and a short quiz. Early steps show the command to type, later steps give less help; if two attempts fail, the solution opens.
- Can I try it for free?
- Yes. The first three lessons of every course are free.