MOB-BACKUP-EXTRACTCollection

ADB Backup Extraction

adb backup -f data.ab → unpack with abe.jar — recovers app-private data when backupEnabled is unset (default true on old API levels).

§ Where this technique fits

MOB-BACKUP-EXTRACT is catalogued under the Collection tactic of the offensive-security kill-chain. It appears in 1 approved dossier in the registry, typically at step 4 on average.

§ Dossiers chaining this technique

Open ADB on the network → device shell
An IoT / dev device left adbd listening on TCP/5555 — anyone on the LAN runs `adb connect` and gets a shell as the shell user, including pulling user data.
step 4 / 5

§ What commonly comes next

01
Unsecured Credentials
T1552 · Credential Access
seen 1×

§ Where this technique fits

§ Dossiers chaining this technique

Open ADB on the network → device shell

§ What commonly comes next