Android App Penetration Testing Checklist with 154 Test cases [Free Excel File]

Get Free Android App Penetration Testing Checklist [Excel file]

With 2.9 million apps, the Android Play Store is the most widely adopted mobile operating system.

With its vast opportunities, Android also draws the attention of malicious hackers who continuously seek to exploit weaknesses in mobile applications. Because of security concerns, Google has banned many apps from the Play Store.

Building a secure Android app requires thorough mobile application penetration testing. To help you navigate this task, we have developed an Android pen testing checklist that provides step-by-step guidance.

What is Android Application Penetration Testing?

Android Application Penetration Testing is a security assessment process specifically designed to identify vulnerabilities and weaknesses in Android applications. This testing involves simulating real-world attacks to evaluate the security posture of the app, ensuring that it can withstand potential threats and malicious activities.

This includes analysing the application’s code, network communication, data storage, authentication mechanisms, authorization controls, and adherence to secure coding practices.

Why Android Apps Need Pentesting?

Pentesting Android apps is crucial for several reasons:

• Identify Vulnerabilities: Android apps can be susceptible to various security vulnerabilities, such as insecure data storage, improper input validation, insecure communication, inadequate authentication mechanisms or busines logic vulnerabilities. Pen testing helps to identify these vulnerabilities and weaknesses in the application’s code and configurations. This process is crucial for addressing the security risks highlighted by the OWASP Mobile Top 10, which outlines the most critical security threats faced by mobile applications.
• Protect User Data: Mobile apps often handle sensitive user information, including personal data, financial details, and login credentials. Pen testing helps ensure that appropriate security measures are in place to protect user data from unauthorized access, data breaches, or misuse.
• Mitigate Risks: By conducting Android pen testing, developers and organizations can identify and understand the potential risks and threats their Android apps may face. This knowledge allows them to proactively address and mitigate these risks before attackers can exploit them.
• Enhance Application Security: Pen testing helps improve the overall security posture of an Android app. Developers can implement security patches, fixes, and updates by identifying vulnerabilities and weaknesses to enhance the app’s resilience against attacks.

Steps in Android Application Penetration Testing

When conducting Android application penetration testing, following a structured approach is essential to uncover and address security vulnerabilities effectively. An Android application pentesting checklist can help ensure that all critical areas are thoroughly examined.

Here’s a comprehensive guide to the steps involved in Android app pentesting, including key tasks and methodologies to follow:

1. Reconnaissance and Information Gathering

The first phase in pen testing the Android app involves gathering information about the target application. This includes understanding the app’s functionality, intended user base, underlying technologies, and potential external dependencies. APK decompilers, network sniffers, and online research techniques help collect valuable information to build a solid testing foundation.

2. Threat Modeling and Risk Assessment

Based on the gathered information, the tester identifies and prioritizes potential threats and risks in this phase. This involves considering the app’s attack surface, threat vectors, potential impact, and the likelihood of exploitation. Testers can create a focused and efficient testing strategy by understanding the application’s critical assets and potential vulnerabilities.

3. Analysis / Assessment

• Static Analysis:Static analysis involves examining the Android app’s code and resources without running it. Testers use tools to find security issues like insecure data storage, input validation problems, or code injection vulnerabilities. This process helps identify codebase issues and ensure secure coding practices. To conduct a thorough analysis, follow an Android Static Analysis checklist that includes reviewing code for common flaws, verifying data handling, and checking adherence to secure coding standards.
• Dynamic Analysis: Dynamic analysis involves executing the application to observe its behaviour in runtime. Testers use tools and techniques to analyse network traffic, API interactions, session management, and input validation. This helps identify runtime vulnerabilities, logic flaws, insecure data transmission, and weaknesses in authentication and authorization mechanisms.
• Architecture Analysis: Pentesters assess the application’s architecture to understand its overall design and identify any security vulnerabilities from architectural flaws. This analysis focuses on aspects such as the interaction between different components, data flows, trust boundaries, and potential points of compromise.
• Reverse Engineering: Reverse engineering involves dissecting the application to understand its inner workings, even if the source code is unavailable. Pentesters analyze the application’s binaries, protocols, and dependencies to uncover potential vulnerabilities, hidden features, or weak security mechanisms.
• Analysis of File System: Pentesters examine the application’s file system to identify sensitive data stored insecurely. This analysis may involve looking for hardcoded credentials, sensitive configuration files, temporary files containing sensitive information, or any other files that attackers could target.
• Inter-application Communication: This technique focuses on analyzing how different applications within a system communicate with each other. Pentesters assess the security of inter-application communication mechanisms, such as APIs, shared resources, or network protocols, to identify potential vulnerabilities or weaknesses that attackers could exploit.

4. Exploitation

The exploitation phase focuses on exploiting the identified vulnerabilities to determine their impact and potential for unauthorized access or data compromise. Pen testers conduct targeted attacks to gain unauthorized access, escalate privileges, or manipulate the application’s behaviour. They also test for common attack vectors like SQL injection, cross-site scripting (XSS), or insecure direct object references.

5. Reporting

After completing the testing process, testers compile a detailed report that includes identified vulnerabilities, their severity, and recommended remediation steps. The report serves as a roadmap for developers and stakeholders to understand the security weaknesses and prioritize fixes to enhance the application’s security posture.

Top Use Cases to Include in Your Android Pen Testing Checklist

1. Authentication and Authorization Checks

Insufficient authentication and authorization can lead to unauthorized access and misuse of sensitive functionality or data in an Android app. Here are some top use cases for Android application penetration testing to test for these vulnerabilities:

• Weak Password Policies: Test the app’s authentication mechanism by attempting to create accounts with weak passwords, such as simple or common passwords, and check if the app enforces strong password policies.
• Brute-Force and Dictionary Attacks: Perform brute-force or dictionary-based attacks to test if the app’s authentication mechanism can withstand repeated login attempts with incorrect credentials.
• Session Management: Test the app’s session management to ensure that session tokens or cookies are properly generated, invalidated, and protected against session hijacking or fixation attacks.
• Privilege Escalation: Test if it’s possible to elevate privileges or bypass authorization controls by manipulating input parameters, changing user roles, or tampering with authorization tokens.
• Access Control Testing: Verify if the app properly enforces access controls for different user roles or permissions—test scenarios where a user attempts to access restricted functionality or sensitive data without authorization.
• API Authorization: Test the app’s API endpoints to ensure proper authorization checks are performed before accessing sensitive data or performing privileged operations. Verify that APIs reject unauthorized requests.

Here is a detailed blog on authorization, rate limiting, and 12 ways to protect your APIs

• Account Lockout Mechanisms: Test if the app implements account lockout mechanisms to prevent brute-force attacks. Check if the app locks user accounts after a certain number of failed login attempts.
• Remember Me Functionality: Test the “Remember Me” or persistent login feature to ensure that it does not compromise the security of user accounts by providing unauthorized access to the app.

2. Data Storage Security Evaluation

• Internal Storage: Pen-test Android apps to identify if they securely store sensitive data locally. Android includes measures to safeguard files created on internal storage, ensuring that they are accessible exclusively by the app. However, developers may unknowingly undermine this protection by implementing modes such as MODE_WORLD_READABLE and MODE_WORLD_WRITABLE, inadvertently allowing unauthorized access by other apps, including malicious ones.

When performing static analysis, pay close attention to code sections that involve such modes. These modes can introduce security vulnerabilities, allowing unauthorized access to files. Additionally, during dynamic analysis, it is essential to validate the permissions of files created by the application to ensure that they adhere to the required security restrictions.

• External Storage: Pentesting Android apps should involve evaluating the security of sensitive data stored on external storage. Verify that files created on external storage, such as SD Cards, are not globally readable or writable, as this would pose a security risk.

Also, check if the app properly handles data from external storage by performing input validation to mitigate potential vulnerabilities. We strongly advise against storing sensitive information on external storage due to its susceptibility to removal and modification by users and other applications.

Additionally, we caution against storing executable or class files on external storage before dynamic loading and recommend cryptographically verifying such files to prevent the execution of malicious code. By conducting these assessments, pen testers ensure that the app follows best practices and safeguards sensitive data when using external storage.

3. Sensitive Data Exposure Assessment

• Data Storage Review: Android provides a convenient way for applications to save XML files in the directory /data/data/<packagename>/shared_prefs/. However, it is essential to note that sensitive information may sometimes be found in clear text within this folder, posing a security risk. Assess if encryption mechanisms, like Android Keystore System or secure storage libraries, are used appropriately to protect stored data. Discover the impacts of excessive data exposure here.
• Logging Mechanisms: Examine the app’s logging mechanisms to identify if sensitive information, such as passwords, API keys, or user credentials, is being logged in plaintext. Check for improper logging practices that might leak sensitive data to log files.
• Error Handling: Analyze how the app handles errors and exceptions. Ensure that error messages and stack traces do not reveal sensitive information that could aid an attacker in exploiting vulnerabilities.
• Code Review: Perform a thorough code review to identify any instances where sensitive data is handled without proper security measures, such as missing input validation or insecure data handling practices.

4. Cryptographic Practices Review

• Insufficient Transport Layer Protection: While pen testing Android apps, assessing the implementation of algorithms used for various purposes is essential. Developers should avoid using insecure and deprecated algorithms, such as RC4, MD4, MD5, and SHA1, for tasks like authorization checks, data storage, and data transmission. Instead, secure and modern algorithms should be employed to ensure the confidentiality and integrity of sensitive information. When storing passwords, it is recommended to use salted hashes resistant to brute-force attacks.
• Weak Handshake Negotiation: Examining the handshake negotiation process is important. Weak handshake negotiation occurs when an insecure cipher suite is used between the application and server during the SSL/TLS handshake. This weak cipher suite choice exposes the connection to potential MITM attacks, allowing attackers to decrypt the communication easily.
• Poor Key Management Processes : In some cases, developers may store sensitive data in local storage and encrypt it using a hardcoded or predictable key embedded in the code. This inherently insecure approach can enable attackers to extract confidential information by analyzing the code through reverse engineering methods.

5. SSL Pinning Verification

SSL Pinning involves validating the server’s SSL/TLS certificate against a pre-configured or “pinned” certificate within the mobile app. This process helps mitigate the risk of Man-in-the-Middle (MITM) attacks by ensuring that the app only communicates with trusted servers.

Assess the SSL pinning during mobile app penetration testing to validate its implementation and effectiveness.

Check whether the application accepts a certificate from any trusted CA or not. E.g. Check AllowAllHostnameVerifier(Android)

6. Web Vulnerability Testing

It is crucial to be aware of common web application vulnerabilities and exercise caution when assessing the security of an Android application.

• SQL Injection: Take extra precautions when dealing with dynamic queries or Content-Providers. Ensure that parameterized queries are used to prevent SQL Injection attacks.
• JavaScript Injection (XSS): Verify that JavaScript and Plugin support is disabled for any WebViews. By default, these features should be disabled to mitigate the risk of XSS vulnerabilities.
• Local File Inclusion: Confirm that File System Access is disabled for any WebViews. By default, WebView settings should have file access disabled (webview.getSettings().setAllowFileAccess(false);).
• Persistent Cookies: Be mindful of the persistence of cookies even after a session has ended with the Android application. Ensure that cookies are adequately revoked or cleared and take precautions to prevent cookies from being saved to disk.
• Root Detection Bypass: Implement measures to bypass root detection mechanisms to prevent exploitation by rooted devices.

Android Penetration Testing Best Practices

Follow these best practices to significantly improve the security of your Android applications and protect them against potential threats and vulnerabilities:

Understand the App

• Familiarize Yourself with the Application: Thoroughly understand the app’s functionality, architecture, and flow.
• Identify Sensitive Data: Know what sensitive data the app handles, such as personal information, financial data, or proprietary business information.

Prepare the Testing Environment

• Use Real Devices and Emulators: Test on a variety of devices and emulators to cover different scenarios.
• Ensure Proper Configuration: Set up the testing environment with appropriate tools and configurations.

Static Analysis

• Review Source Code: Perform a thorough review of the app’s source code to identify potential vulnerabilities.
• Analyze Manifest File: Check the AndroidManifest.xml file for insecure configurations and permissions.

Dynamic Analysis

• Monitor App Behavior: Use tools to observe the app’s behavior at runtime and identify abnormal activities.
• Check API Endpoints: Ensure that all API endpoints are secure and properly handle requests and responses.

Compliance and Standards

• Adhere to Standards: Ensure the app complies with relevant security standards and regulations, such as OWASP Mobile Security Project guidelines.

Android application penetration testing involves going beyond the surface-level discovery of vulnerabilities. It encompasses an active phase where the pen-testers exploit the identified weaknesses to uncover other vulnerabilities potentially.

Empower your Android app’s protection against vulnerabilities using our ultimate mobile security testing checklist. Level up your security game and build user trust!

Don’t forget to check out our iOS pen testing checklist for complete coverage across platforms.

Stay tuned for more relevant and interesting security articles. Follow Indusface on Facebook, Twitter, and LinkedIn.