/android-pentest

OWASP Mobile Top 10 (2024)

Quick reference for Android mobile application security vulnerabilities.

M1: Improper Credential Usage

Description: Hardcoded credentials, insecure credential storage, or improper handling of authentication tokens.

What to look for:

• Hardcoded API keys, passwords, secrets in code
• Credentials stored in SharedPreferences without encryption
• Tokens stored in plain text files
• Credentials in AndroidManifest.xml
• Secrets in BuildConfig or strings.xml

Testing commands:

# Search for hardcoded secrets
grep -rniE "(password|secret|api[_-]?key|token|auth)" jadx_output/
grep -rniE "-----BEGIN" jadx_output/

# Check SharedPreferences
adb shell "su -c 'cat /data/data/<pkg>/shared_prefs/*.xml'" | grep -iE "password|token|key"

CVSS Range: 7.0-9.0 (High to Critical)

M2: Inadequate Supply Chain Security

Description: Vulnerable third-party libraries, malicious SDKs, or insecure build pipelines.

What to look for:

• Outdated libraries with known CVEs
• Suspicious SDK permissions
• Unsigned or self-signed libraries
• Obfuscated malicious code in dependencies

Testing commands:

# List libraries
unzip -l base.apk | grep -E "\.so$|\.jar$"

# Check for known vulnerable libraries
# Use tools like: dependency-check, retire.js for web components

CVSS Range: 5.0-9.0 (Medium to Critical)

M3: Insecure Authentication/Authorization

Description: Weak authentication mechanisms, missing session management, or improper authorization checks.

What to look for:

• Missing authentication on sensitive operations
• Client-side only authentication
• Weak password policies
• Missing session timeout
• Predictable session tokens
• Authorization bypass via parameter tampering

Testing commands:

# Bypass authentication activities
adb shell am start -n <pkg>/<protected_activity>

# Check for hardcoded auth bypass
grep -rni "isAdmin\|isAuthenticated\|checkAuth" jadx_output/

# Monitor auth flows with Frida
frida -U <pkg> -l method_tracer.js  # Configure to trace auth methods

CVSS Range: 6.0-9.5 (Medium to Critical)

M4: Insufficient Input/Output Validation

Description: Improper validation of user input leading to injection attacks, XSS, or buffer overflows.

What to look for:

• SQL injection in Content Providers
• JavaScript injection in WebViews
• Path traversal in file operations
• Command injection
• Format string vulnerabilities in native code

Testing commands:

# Content Provider SQL injection
adb shell content query --uri "content://<authority>" --where "1=1--"

# Path traversal
adb shell content read --uri "content://<authority>/../../etc/passwd"

# WebView JavaScript
# Use Frida to inject: webview.loadUrl("javascript:alert(document.cookie)")

CVSS Range: 5.0-9.5 (Medium to Critical)

M5: Insecure Communication

Description: Unencrypted data transmission, improper certificate validation, or weak TLS configurations.

What to look for:

• HTTP instead of HTTPS
• Missing certificate pinning
• Trust all certificates implementations
• Weak cipher suites
• cleartext traffic allowed

Testing commands:

# Check for cleartext traffic
grep "usesCleartextTraffic" AndroidManifest.xml

# Check for trust all certs
grep -rni "TrustAllCerts\|ALLOW_ALL\|X509TrustManager" jadx_output/

# Bypass SSL pinning
frida -U -f <pkg> -l ssl_pinning_bypass.js --no-pause

CVSS Range: 5.0-8.0 (Medium to High)

M6: Inadequate Privacy Controls

Description: Excessive data collection, improper handling of PII, or privacy policy violations.

What to look for:

• Collection of device identifiers (IMEI, Android ID)
• Location tracking without consent
• Clipboard monitoring
• Contact/SMS access without justification
• Analytics with PII

Testing commands:

# Check permissions
adb shell dumpsys package <pkg> | grep "permission"

# Monitor data collection
adb logcat | grep -iE "location|contact|sms|clipboard"

# Check what's being sent over network
# Use mitmproxy or Burp to inspect traffic

CVSS Range: 3.0-7.0 (Low to High)

M7: Insufficient Binary Protections

Description: Lack of code obfuscation, missing integrity checks, or disabled security features.

What to look for:

• Debuggable flag enabled
• Backup allowed
• No code obfuscation
• Missing root/tamper detection
• Unprotected native libraries

Testing commands:

# Check AndroidManifest
grep -E "debuggable|allowBackup" AndroidManifest.xml

# Check for obfuscation (ProGuard/R8)
# Decompiled code will have meaningful names if not obfuscated

# Test debuggable
adb shell run-as <pkg> id

# Bypass root detection
frida -U -f <pkg> -l root_bypass.js --no-pause

CVSS Range: 3.0-6.0 (Low to Medium)

M8: Security Misconfiguration

Description: Improper security settings, default configurations, or missing security headers.

What to look for:

• Exported components without protection
• Missing network security config
• Default credentials
• Verbose error messages
• Debug logs in production

Testing commands:

# Find exported components
grep 'exported="true"' AndroidManifest.xml

# Check network security config
cat res/xml/network_security_config.xml

# Access exported activities
adb shell am start -n <pkg>/<exported_activity>

# Check logs for sensitive data
adb logcat | grep -i <pkg>

CVSS Range: 4.0-8.0 (Medium to High)

M9: Insecure Data Storage

Description: Sensitive data stored insecurely on the device filesystem.

What to look for:

• Plaintext sensitive data in files
• World-readable file permissions
• Unencrypted databases
• Sensitive data in logs
• Data on external storage

Testing commands:

# Check all app files
adb shell "su -c 'ls -laR /data/data/<pkg>/'"

# Dump SharedPreferences
adb shell "su -c 'cat /data/data/<pkg>/shared_prefs/*.xml'"

# Check databases
adb shell "su -c 'sqlite3 /data/data/<pkg>/databases/*.db .dump'"

# Check external storage
adb shell "su -c 'ls -la /sdcard/Android/data/<pkg>/'"

# Check file permissions
adb shell "su -c 'stat /data/data/<pkg>/*'"

CVSS Range: 5.0-8.0 (Medium to High)

M10: Insufficient Cryptography

Description: Weak cryptographic algorithms, improper key management, or flawed implementations.

What to look for:

• Weak algorithms (DES, MD5, SHA1, RC4)
• ECB mode encryption
• Hardcoded encryption keys
• Predictable IVs
• Insecure random number generation

Testing commands:

# Search for weak crypto
grep -rniE "(DES|ECB|MD5|SHA1|RC4)" jadx_output/

# Find key generation
grep -rni "SecretKeySpec\|KeyGenerator" jadx_output/

# Monitor crypto operations with Frida
frida -U <pkg> -l crypto_hooks.js

CVSS Range: 5.0-9.0 (Medium to Critical)

Quick Severity Reference

References

• OWASP Mobile Top 10
• OWASP MASTG
• OWASP MASVS