Skip to content

Commit 1ce211c

Browse files
titzecpholguera
titze
and
cpholguera
authored
Port MASTG test 0039 (by @Guardsquare) (#3042)
* Port MASTG test 0039 * linter * Fix tool link * Update tests-beta/android/MASVS-RESILIENCE/MASTG-TEST-0x39-1.md Co-authored-by: Carlos Holguera <[email protected]> * review update * update IDs * delete renamed files * update tests content --------- Co-authored-by: Carlos Holguera <[email protected]>
1 parent 2b57a03 commit 1ce211c

File tree

5 files changed

+142
-0
lines changed

5 files changed

+142
-0
lines changed

‎techniques/android/MASTG-TECH-0117.md‎

Lines changed: 47 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,47 @@
1+
---
2+
title: Obtaining Information from the AndroidManifest
3+
platform: android
4+
---
5+
6+
Multiple ways exist to view the contents of the AndroidManifest:
7+
8+
## Using @MASTG-TOOL-0011
9+
10+
The full AndroidManifest can be extracted using @MASTG-TOOL-0011:
11+
12+
```sh
13+
$ apktool d myapp.apk -s -o apktooled_app
14+
I: Using Apktool 2.7.0 on myapp.apk
15+
I: Loading resource table...
16+
I: Decoding AndroidManifest.xml with resources...
17+
I: Loading resource table from file: /home/.local/share/apktool/framework/1.apk
18+
I: Regular manifest package...
19+
I: Decoding file-resources...
20+
I: Decoding values */* XMLs...
21+
I: Copying raw classes.dex file...
22+
I: Copying assets and libs...
23+
I: Copying unknown files...
24+
I: Copying original files...
25+
I: Copying META-INF/services directory
26+
```
27+
28+
`-s` skips baksmaliing the dex files and is faster.
29+
30+
The AndroidManifest.xml is extracted and decoded to `apktooled_app/AndroidManifest.xml`, where you can simply open and view it.
31+
32+
## Using @MASTG-TOOL-0124
33+
34+
If you are only interested in specific values of the manifest, you can use alternatively use @MASTG-TOOL-0124. Please note that the output is not a XML file.
35+
36+
Viewing all contents of the AndroidManifest can be performed with:
37+
38+
```bash
39+
$ aapt d badging MASTG-DEMO-0001.apk
40+
package: name='org.owasp.mastestapp' versionCode='1' versionName='1.0' platformBuildVersionName='14' platformBuildVersionCode='34' compileSdkVersion='34' compileSdkVersionCodename='14'
41+
sdkVersion:'29'
42+
targetSdkVersion:'34'
43+
uses-permission: name='android.permission.INTERNET'
44+
uses-permission: name='org.owasp.mastestapp.DYNAMIC_RECEIVER_NOT_EXPORTED_PERMISSION'
45+
application-label:'MASTestApp'
46+
...
47+
```

‎tests-beta/android/MASVS-RESILIENCE/MASTG-TEST-0226.md‎

Lines changed: 32 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,32 @@
1+
---
2+
title: Debuggable Flag Enabled in the AndroidManifest
3+
platform: android
4+
id: MASTG-TEST-0226
5+
type: [static]
6+
weakness: MASWE-0067
7+
---
8+
9+
## Overview
10+
11+
This test case checks if the app has the `debuggable` flag ([`android:debuggable`](https://developer.android.com/guide/topics/manifest/application-element#debug)) set to `true` in the `AndroidManifest.xml`. When this flag is enabled, it allows the app to be debugged enabling attackers to inspect the app’s internals, bypass security controls, or manipulate runtime behavior.
12+
13+
Although having the `debuggable` flag set to `true` [is not considered a direct vulnerability](https://developer.android.com/privacy-and-security/risks/android-debuggable), it significantly increases the attack surface by providing unauthorized access to app data and resources, particularly in production environments.
14+
15+
## Steps
16+
17+
1. Obtain the `AndroidManifest.xml` file using @MASTG-TECH-0117.
18+
2. Search for the `debuggable` flag:
19+
- Look for `android:debuggable` if analyzing raw XML using tools like @MASTG-TOOL-0011.
20+
- Look for `application-debuggable` if using @MASTG-TOOL-0124.
21+
22+
## Observation
23+
24+
The output should explicitly show whether the `debuggable` flag is set (`true` or `false`). If the flag is not specified, it is treated as `false` by default for release builds.
25+
26+
## Evaluation
27+
28+
The test case fails if the `debuggable` flag is explicitly set to `true`. This indicates that the app is configured to allow debugging, which is inappropriate for production environments.
29+
30+
To mitigate this issue, ensure the debuggable flag in the AndroidManifest.xml is set to false for all release builds.
31+
32+
**Note:** Disabling debugging via the `debuggable` flag is an important first step but does not fully protect the app from advanced attacks. Skilled attackers can enable debugging through various means, such as binary patching (see @MASTG-TECH-0038) to allow attachment of a debugger or the use of binary instrumentation tools like @MASTG-TOOL-0001 to achieve similar capabilities. For apps requiring a higher level of security, consider implementing anti-debugging techniques as an additional layer of defense. Refer to @MASWE-0101 for detailed guidance.

‎tests-beta/android/MASVS-RESILIENCE/MASTG-TEST-0227.md‎

Lines changed: 53 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,53 @@
1+
---
2+
title: Debugging Enabled for WebViews
3+
platform: android
4+
id: MASTG-TEST-0227
5+
type: [static]
6+
weakness: MASWE-0067
7+
---
8+
9+
## Overview
10+
11+
The `WebView.setWebContentsDebuggingEnabled(true)` API enables debugging for **all** WebViews in the application. This feature can be useful during development, but introduces significant security risks if left enabled in production. When enabled, a connected PC can debug, eavesdrop, or modify communication within any WebView in the application. See the ["Android Documentation"](https://developer.chrome.com/docs/devtools/remote-debugging/webviews/#configure_webviews_for_debugging) for more details.
12+
13+
Note that this flag works independently of the `debuggable` attribute in the `AndroidManifest.xml` (see @MASTG-TEST-0226). Even if the app is not marked as debuggable, the WebViews can still be debugged by calling this API.
14+
15+
## Steps
16+
17+
1. Run @MASTG-TECH-0014 with a tool such as @MASTG-TOOL-0110 on the app binary and look for uses of:
18+
- `WebView.setWebContentsDebuggingEnabled` being set to `true`.
19+
- `ApplicationInfo.FLAG_DEBUGGABLE`.
20+
21+
## Observation
22+
23+
The output should list:
24+
25+
- All locations where `WebView.setWebContentsDebuggingEnabled` is called with `true` at runtime.
26+
- Any references to `ApplicationInfo.FLAG_DEBUGGABLE`.
27+
28+
## Evaluation
29+
30+
The test case fails if `WebView.setWebContentsDebuggingEnabled(true)` is called unconditionally or in contexts where the `ApplicationInfo.FLAG_DEBUGGABLE` flag is not checked.
31+
32+
To mitigate this issue:
33+
34+
- Set `WebView.setWebContentsDebuggingEnabled` to `false` in production, or remove the calls entirely if they are unnecessary.
35+
- If WebView debugging is required during development, ensure it is enabled only when the app is in a debuggable state by [checking the `ApplicationInfo.FLAG_DEBUGGABLE` flag at runtime](https://developer.chrome.com/docs/devtools/remote-debugging/webviews/#configure_webviews_for_debugging).
36+
37+
For example:
38+
39+
```kotlin
40+
if (Build.VERSION.SDK_INT >= Build.VERSION_CODES.KITKAT) {
41+
if (0 != (getApplicationInfo().flags & ApplicationInfo.FLAG_DEBUGGABLE))
42+
{ WebView.setWebContentsDebuggingEnabled(true); }
43+
}
44+
```
45+
46+
**Note:** Disabling WebView debugging this way helps protect an app already running on a device. For an attacker to exploit WebView debugging, they must have physical access to the device (e.g., a stolen or test device) or remote access through malware or other malicious means. Additionally, the device must typically be unlocked, and the attacker would need to know the device PIN, password, or biometric authentication to gain full control and connect debugging tools like `adb` or Chrome DevTools.
47+
48+
However, disabling WebView debugging does not eliminate all attack vectors. An attacker could:
49+
50+
1. Patch the app to add calls to these APIs (see @MASTG-TECH-0038), then repackage and re-sign it (see @MASTG-TECH-0039).
51+
2. Use runtime method hooking (see @MASTG-TECH-0043) to enable WebView debugging dynamically at runtime.
52+
53+
Disabling WebView debugging serves as one layer of defense to reduce risks but should be combined with other security measures.

‎tests/android/MASVS-RESILIENCE/MASTG-TEST-0039.md‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -7,6 +7,9 @@ platform: android
77
title: Testing whether the App is Debuggable
88
masvs_v1_levels:
99
- R
10+
status: deprecated
11+
covered_by: [MASTG-TEST-0226,MASTG-TEST-0227]
12+
deprecation_note: New version available in MASTG V2
1013
---
1114

1215
## Overview

‎tools/android/MASTG-TOOL-0124.md‎

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,7 @@
1+
---
2+
title: aapt2
3+
platform: android
4+
source: https://developer.android.com/tools/aapt2
5+
---
6+
7+
[aapt2](https://developer.android.com/tools/aapt2), available in Android SDK Build Tools since revision 26.0.2, is contained in the @MASTG-TOOL-0006 at `[SDK-Path]/build-tools/[version]/aapt2` and can be used, for example, to examine the contents of the AndroidManifest file.

0 commit comments

Comments
 (0)