Android Testing Cheat Sheet

Last revision (mm/dd/yy): 03/17/2016 Introduction DRAFT MODE - This Cheat Sheet is a Work in Progress This cheat sheet provides a checklist of tasks to be performed to do a penetration test of an Android application. It follows the OWASP Mobile Top 10 Risks list. Testing Methodology At the device level, there are 2 ways in which the application shall be tested. With Android device running in a factory default or normal mode With Android device running in a rooted mode At the application level, there are 2 ways in which it shall be tested Application running on the device (to take benefits of touch related features) Application running on the emulator (to ease the task of testing using wider screen of desktop or laptop) Application Mapping Map the application for possible security vectors What is the application genre ? (Game, business, productivity etc) Does the application connect to backend web services? Is the application purely native or incorporates readymade frameworks? Does the application store data on the device? What all features of the device are used by the application? (camera, gyroscope, contacts etc) OWASP Step-by-step Approach (For each of the standards below, there shall be multiple steps for the tester to follow]) M1 - Weaker Server side controls M2 - Insecure Data storage This Section should be ideally tested after using the application for some time. This way application has time to store some data on the disk. Commonplaces to look at /data/data/app_folder /sdcard/ /sdcard1/ M3 - Insufficient Transport Layer M4 - Unintended Data Leakage M5 - Poor Authorization and Authentication M6 - Broken Cryptography M7 - Client Side Injection M8 - Security Decisions via untrusted inputs M9 - Improper Session Handling M10 - Lack of Binary Protection Authors and Primary Editors Jim Manico Jonathan Carter Prashant Phatak Milan Singh Thakur Other Cheatsheets V - T - E Cheat Sheets Developer / Builder 3rd Party Javascript Management Access Control AJAX Security Cheat Sheet Authentication (ES) Bean Validation Cheat Sheet Choosing and Using Security Questions Clickjacking Defense Credential Stuffing Prevention Cheat Sheet Cross-Site Request Forgery (CSRF) Prevention Cryptographic Storage C-Based Toolchain Hardening CSS Security Deserialization DOM based XSS Prevention Forgot Password HTML5 Security HTTP Strict Transport Security Injection Prevention Cheat Sheet Injection Prevention Cheat Sheet in Java JSON Web Token (JWT) Cheat Sheet for Java Input Validation Insecure Direct Object Reference Prevention JAAS Key Management LDAP Injection Prevention Logging Mass Assignment Cheat Sheet .NET Security OS Command Injection Defense Cheat Sheet OWASP Top Ten Password Storage Pinning Query Parameterization REST Security Ruby on Rails Session Management SAML Security SQL Injection Prevention Transaction Authorization Transport Layer Protection TLS Cipher String Configuration Unvalidated Redirects and Forwards User Privacy Protection Web Service Security XSS (Cross Site Scripting) Prevention XML External Entity (XXE) Prevention Cheat Sheet Assessment / Breaker Attack Surface Analysis REST Assessment Web Application Security Testing XML Security Cheat Sheet XSS Filter Evasion Mobile Android Testing IOS Developer Mobile Jailbreaking OpSec / Defender Virtual Patching Vulnerability Disclosure Draft and Beta Application Security Architecture Business Logic Security Content Security Policy Denial of Service Cheat Sheet Grails Secure Code Review IOS Application Security Testing PHP Security Regular Expression Security Cheatsheet Secure Coding Secure SDLC Threat Modeling All Pages In This Category