This site is the archived OWASP Foundation Wiki and is no longer accepting Account Requests.
To view the new OWASP Foundation website, please visit https://owasp.org

Difference between revisions of "Android Testing Cheat Sheet"

From OWASP
Jump to: navigation, search
m (Authors and Primary Editors)
(M2 - Insecure Data storage)
Line 33: Line 33:
 
== M1 - Weaker Server side controls ==
 
== M1 - Weaker Server side controls ==
 
== M2 - Insecure Data storage ==
 
== M2 - Insecure Data storage ==
 +
 +
This Section should be ideally tested after using the application for some time. This way application has time to store some data on the disk.
 +
 +
Commonplaces to look at
 +
 +
* /data/data/app_folder
 +
* /sdcard/
 +
* /sdcard1/
 +
 
== M3 - Insufficient Transport Layer ==
 
== M3 - Insufficient Transport Layer ==
 
== M4 - Unintended Data Leakage ==
 
== M4 - Unintended Data Leakage ==

Revision as of 05:16, 17 March 2016

Cheatsheets-header.jpg

Last revision (mm/dd/yy): 03/17/2016

Introduction

DRAFT MODE - This Cheat Sheet is a Work in Progress

This cheat sheet provides a checklist of tasks to be performed to do a penetration test of an Android application. It follows the OWASP Mobile Top 10 Risks list.

Testing Methodology

At the device level, there are 2 ways in which the application shall be tested.

  1. With Android device running in a factory default or normal mode
  2. With Android device running in a rooted mode

At the application level, there are 2 ways in which it shall be tested

  1. Application running on the device (to take benefits of touch related features)
  2. Application running on the emulator (to ease the task of testing using wider screen of desktop or laptop)

Application Mapping

Map the application for possible security vectors

  1. What is the application genre ? (Game, business, productivity etc)
  2. Does the application connect to backend web services?
  3. Is the application purely native or incorporates readymade frameworks?
  4. Does the application store data on the device?
  5. What all features of the device are used by the application? (camera, gyroscope, contacts etc)

OWASP Step-by-step Approach

(For each of the standards below, there shall be multiple steps for the tester to follow])

M1 - Weaker Server side controls

M2 - Insecure Data storage

This Section should be ideally tested after using the application for some time. This way application has time to store some data on the disk.

Commonplaces to look at

  • /data/data/app_folder
  • /sdcard/
  • /sdcard1/

M3 - Insufficient Transport Layer

M4 - Unintended Data Leakage

M5 - Poor Authorization and Authentication

M6 - Broken Cryptography

M7 - Client Side Injection

M8 - Security Decisions via untrusted inputs

M9 - Improper Session Handling

M10 - Lack of Binary Protection

Authors and Primary Editors

Jim Manico

Jonathan Carter

Prashant Phatak

Milan Singh Thakur

Other Cheatsheets