Android-Reports-and-Resources

HackerOne Reports

Hardcoded credentials

Disclosure of all uploads via hardcoded api secret

WebView

Android security checklist: WebView

Insecure deeplinks

Account Takeover Via DeepLink

Sensitive information disclosure

RCE/ACE

Why dynamic code loading could be dangerous for your apps: a Google example

RCE in TinyCards for Android

Persistent arbitrary code execution in Android's Google Play Core Library: details, explanation and the PoC

CVE-2020-8913: Persistent arbitrary code execution in Google Play Core library

TikTok: three persistent arbitrary code executions and one theft of arbitrary files

Memory corruption

Exploiting memory corruption vulnerabilities on Android

Cryptography

Use cryptography in mobile apps the right way

SQL Injection

SQL Injection in Content Provider

Session theft

Steal user session

Steal files

Android security checklist: theft of arbitrary files

How to exploit insecure WebResourceResponse configurations + an example of the vulnerability in Amazon apps

Vulnerable to local file steal, Javascript injection, Open redirect

Token leakage due to stolen files via unprotected Activity

Steal files due to exported services

Steal files due to unprotected exported Activity

Steal files due to insecure data storage

Insecure local data storage, makes it easy to steal files

Bypasses

Accidental $70k Google Pixel Lock Screen Bypass

Golden techniques to bypass host validations

Two-factor authentication bypass due to vuln endpoint

Another endpoint Auth bypass

Bypass PIN/Fingerprint lock

Bypass lock protection

Bypass of biometrics security functionality

XSS

HTML Injection in BatterySaveArticleRenderer WebView

XSS via SAMLAuthActivity

XSS in ImageViewerActivity

XSS via start ContentActivity

XSS on Owncloud webview

Privilege Escalation

20 Security Issues Found in Xiaomi Devices

Discovering vendor-specific vulnerabilities in Android

Common mistakes when using permissions in Android

Two weeks of securing Samsung devices: Part 2

Two weeks of securing Samsung devices: Part 1

Intent Spoofing

Access of some not exported content providers

Access protected components via intent

Fragment injection

Javascript injection

CSRF

Deeplink leads to CSRF in follow action

Case sensitive account collisions

overwrite account associated with email via android application

Intercept Broadcasts

Possible to intercept broadcasts about file uploads

Vulnerable exported broadcast reciever

View every network request response's information

Practice Apps

Oversecured Vulnerable Android App

Damn Vulnerable Bank

InsecureShop

Vuldroid

InjuredAndroid

Android-InsecureBankv2

Damn Insecure and Vulnerable app

OWASP-GoatDroid-Project

Sieve mwrlabs

Tools

Resources