[walk3]

The .apk is made by amateur and cannot be hard to crack. I tried decompiling and searching for source code but didn't have much luck. Also tried wireshark but my skills are not there.
Would be willing to pay for the help.
(i think every decompiled apk can be vunarable to variable changes? if after login app is not checking for login status it could work?)
(also login system seems to be very basic since owner just sends you username and password which you cannot change. This removes any chance of firebase or some high grade login/register system).

Thanks

[bakalnica90]

Hello, let's discuss further

[Virtual rebel]

well , to actually do this u need to decompile the apk and see the source code for sensitive api which may be vulnerable to idor or any other vuln , sometimes u want to see the old version of the the app to see any sensitive information . if u cant find anything there try dynamic analysing . basically u need to run the apk and send modified request to the server to see if it is vulnerable to any kind of vuln . try removing parameters and try all methoids available
::> Hope It helPs