/android-pentest

Finding Template

Use this template to document individual vulnerabilities discovered during testing.

[FINDING-XXX] [Descriptive Title]

Metadata

Description

[Provide a clear, concise description of the vulnerability. Explain what the issue is and why it matters from a security perspective. This should be understandable by both technical and non-technical readers.]

Technical Details

[Provide detailed technical information about the vulnerability, including:

• Exact location (file path, class name, method)
• Vulnerable code or configuration
• How the vulnerability was discovered
• Technical root cause]

Affected Location:

/data/data/com.target.app/[path]

Vulnerable Code/Configuration:

// Example vulnerable code
public void storeCredentials(String password) {
    SharedPreferences prefs = getSharedPreferences("auth", MODE_PRIVATE);
    prefs.edit().putString("password", password).apply();  // Plaintext!
}

Steps to Reproduce

1. [First step with exact commands/actions]
2. [Second step]
3. [Third step]
4. [Observe the vulnerability]

Commands Used:

# MCP tool
dump_shared_prefs("com.target.app")

# or ADB
adb shell "su -c 'cat /data/data/com.target.app/shared_prefs/auth.xml'"

Frida Script (if applicable):

Java.perform(function() {
    // Hook code here
});

Evidence

Screenshot 1: [Description]

[Insert screenshot or reference to evidence file]

Log Output

[Relevant log output or tool output]

Request/Response (if applicable)

POST /api/login HTTP/1.1
Host: api.target.com
Content-Type: application/json

{"username": "test", "password": "test123"}

Impact

[Describe the potential impact of this vulnerability if exploited. Consider:

• Confidentiality impact
• Integrity impact
• Availability impact
• Business impact
• Affected users/data]

Potential Attack Scenarios:

1. Scenario 1: An attacker with physical device access could...
2. Scenario 2: A malicious app on the same device could...
3. Scenario 3: Through ADB backup, an attacker could...

Remediation

Recommended Fix

[Provide specific, actionable remediation steps]

1. [First remediation step]
2. [Second remediation step]
3. [Third remediation step]

Secure Code Example

// Secure implementation
import androidx.security.crypto.EncryptedSharedPreferences;

public void storeCredentials(String token) {
    SharedPreferences prefs = EncryptedSharedPreferences.create(
        "auth_secure",
        MasterKeys.getOrCreate(MasterKeys.AES256_GCM_SPEC),
        context,
        EncryptedSharedPreferences.PrefKeyEncryptionScheme.AES256_SIV,
        EncryptedSharedPreferences.PrefValueEncryptionScheme.AES256_GCM
    );
    prefs.edit().putString("token", token).apply();
}

References

• OWASP MASTG - Testing Local Storage
• Android Security Documentation
• [Relevant CVE if applicable]

Timeline

Notes

[Any additional notes, considerations, or context that may be helpful]

Severity Rating Guide