Android Testing Cheat Sheet
Last revision (mm/dd/yy): 02/24/2017
This cheat sheet provides a checklist of tasks to be performed to do a penetration test of an Android application. It follows the OWASP Mobile Top 10 Risks list.
A complete android pen testing involves different areas such as the ones described in the above picture
In this first phase, the focus relies on understanding the application logic and what exactly the application does. This involves some manual test where we do some basic operations such as install the APK on the phone, login and comprehend the functionality of the app
This is one of the most challenging and exciting parts of the pentest assessment. Android apps are packed as an APK, also known as Android Package Kit or Android Application Package. Our mission as Pen testers is to verify how well protected the application has been created and designed against known threat actors.Android Mobile applications are distributed through platforms like Google Play. Since the application is fully installed on the client, it becomes vulnerable to any attacks coming from the client.
At the application level, there are 2 ways in which it shall be tested
Map the application for possible security vectors
OWASP Step-by-step Approach
(For each of the standards below, there shall be multiple steps for the tester to follow])
M1 - Weaker Server side controls
M2 - Insecure Data storage
This Section should be ideally tested after using the application for some time. This way application has time to store some data on the disk.
Commonplaces to look at
M3 - Insufficient Transport Layer
Multiple layer of checks to be performed here
1. On Server side
2. On Device Side
M4 - Unintended Data Leakage
Simmilar to M2 this section requires application to be used however while the application is in use we need to monitor following places.
M5 - Poor Authorization and Authentication
One of the simplest check's to be performed after application is used for some time and it has time to put the data inside system.
M6 - Broken Cryptography
There are multiple things to look at
M7 - Client Side Injection
Android applications need to store data locally in sqlite files or XML structures and hence need to performs either SQL/XML Queries or file I/O.
This gives rise to 2 major issues.
If the application is a HTML5 hybrid application then Cross Site Scripting (XSS) should also be considered. XSS will expose the entire application to the attacker as HTML5 applications will have the ability to call native functionality and hence control over the entire application.
M8 - Security Decisions via untrusted inputs
M9 - Improper Session Handling
Improper Session Handling typically results in the same outcomes as poor authentication. Once you are authenticated and given a session, that session allows one access to the mobile application. There are multiple things to look at
M10 - Lack of Binary Protection
Android Binaries are basically dex classes, which if not protected can result in an easy decompilation of source code. This could lead to code / logic leakage.
Following controls need to be checked for and validated:
Authors and Primary Editors