This site is the archived OWASP Foundation Wiki and is no longer accepting Account Requests.
To view the new OWASP Foundation website, please visit https://owasp.org

Difference between revisions of "Android Testing Cheat Sheet"

From OWASP
Jump to: navigation, search
(Created page with " __NOTOC__ <div style="width:100%;height:160px;border:0,margin:0;overflow: hidden;">link=</div> {| style="padding: 0;margin:0;margin-top:10px;...")
 
m
Line 6: Line 6:
 
Last revision (mm/dd/yy): '''{{REVISIONMONTH}}/{{REVISIONDAY}}/{{REVISIONYEAR}}'''  
 
Last revision (mm/dd/yy): '''{{REVISIONMONTH}}/{{REVISIONDAY}}/{{REVISIONYEAR}}'''  
 
= Introduction  =
 
= Introduction  =
This document is written for security testers and app developers and is intended to provide a set of basic pointers to vital aspects of testing secure apps for the Andoid operating system. It follows the [https://www.owasp.org/index.php/OWASP_Mobile_Security_Project OWASP Mobile Top 10 Risks] list.
+
This cheat sheet provides a checklist of tasks to be performed to do a penetration test of an Android application. It follows the [https://www.owasp.org/index.php/OWASP_Mobile_Security_Project OWASP Mobile Top 10 Risks] list.
  
= More =
+
= Introduction =
???
+
 
 +
== Testing Methodology ==
 +
 
 +
At the device level, there are 2 ways in which the application shall be tested.
 +
# With Android device running in a factory default or normal mode
 +
# With Android device running in a rooted mode
 +
 
 +
At the application level, there are 2 ways in which it shall be tested
 +
# Application running on the device (to take benefits of touch related features)
 +
# Application running on the emulator (to ease the task of testing using wider screen of desktop or laptop)
 +
 
 +
== Application Mapping ==
 +
 
 +
Map the application for possible security vectors
 +
# What is the application genre ? (Game, business, productivity etc)
 +
# Does the application connect to backend web services?
 +
# Is the application purely native or incorporates readymade frameworks?
 +
# Does the application store data on the device?
 +
# What all features of the device are used by the application? (camera, gyroscope, contacts etc)
 +
 
 +
Following high level steps are to be performed
  
 
= Authors and Primary Editors =
 
= Authors and Primary Editors =

Revision as of 21:15, 1 March 2016

Cheatsheets-header.jpg

Last revision (mm/dd/yy): 03/1/2016

Introduction

This cheat sheet provides a checklist of tasks to be performed to do a penetration test of an Android application. It follows the OWASP Mobile Top 10 Risks list.

Introduction

Testing Methodology

At the device level, there are 2 ways in which the application shall be tested.

  1. With Android device running in a factory default or normal mode
  2. With Android device running in a rooted mode

At the application level, there are 2 ways in which it shall be tested

  1. Application running on the device (to take benefits of touch related features)
  2. Application running on the emulator (to ease the task of testing using wider screen of desktop or laptop)

Application Mapping

Map the application for possible security vectors

  1. What is the application genre ? (Game, business, productivity etc)
  2. Does the application connect to backend web services?
  3. Is the application purely native or incorporates readymade frameworks?
  4. Does the application store data on the device?
  5. What all features of the device are used by the application? (camera, gyroscope, contacts etc)

Following high level steps are to be performed

Authors and Primary Editors

?

Other Cheatsheets