MASTG-DEMO-0059: App Writing Sensitive Data to Sandbox using SharedPreferences

Download MASTG-DEMO-0059 APK Open MASTG-DEMO-0059 Folder Build MASTG-DEMO-0059 APK

Sample

The code snippet below shows sample code which stores sensitive data using SharedPreferences. It stores sensitive data using String and StringSet.

package org.owasp.mastestapp

import android.content.Context
import android.security.keystore.KeyGenParameterSpec
import android.security.keystore.KeyProperties
import android.util.Base64
import java.security.KeyStore
import javax.crypto.Cipher
import javax.crypto.KeyGenerator
import javax.crypto.SecretKey
import androidx.core.content.edit

class MastgTest(private val context: Context) {
    private val awsKey = "AKIAIOSFODNN7EXAMPLE"
    private val githubToken = "ghp_1234567890abcdefghijklmnOPQRSTUV"
    private val preSharedKeys = hashSetOf(
        "MIIEvAIBADANBgkqhkiG9w0BAQEFAASCAmIwggJeAgEAAoGBALfX7kbfFv3pc3JjOHQ=",
        "gJXS9EwpuzK8U1TOgfplwfKEVngCE2D5FNBQWvNmuHHbigmTCabsA=")
    private val keyAlias = "mastgKey"

    private fun getOrCreateSecretKey(): SecretKey {
        val keyStore = KeyStore.getInstance("AndroidKeyStore").apply { load(null) }
        return if (keyStore.containsAlias(keyAlias)) {
            (keyStore.getEntry(keyAlias, null) as KeyStore.SecretKeyEntry).secretKey
        } else {
            KeyGenerator.getInstance(
                KeyProperties.KEY_ALGORITHM_AES,
                "AndroidKeyStore"
            ).apply {
                init(
                    KeyGenParameterSpec.Builder(
                        keyAlias,
                        KeyProperties.PURPOSE_ENCRYPT or KeyProperties.PURPOSE_DECRYPT
                    )
                        .setBlockModes(KeyProperties.BLOCK_MODE_GCM)
                        .setEncryptionPaddings(KeyProperties.ENCRYPTION_PADDING_NONE)
                        .build()
                )
            }.generateKey()
        }
    }

    private fun encrypt(plainText: String): String {
        val cipher = Cipher.getInstance("AES/GCM/NoPadding")
        cipher.init(Cipher.ENCRYPT_MODE, getOrCreateSecretKey())
        val iv = cipher.iv
        val encryptedBytes = cipher.doFinal(plainText.toByteArray(Charsets.UTF_8))
        val combined = iv + encryptedBytes
        return Base64.encodeToString(combined, Base64.DEFAULT)
    }

    fun mastgTest(): String {
        return try {
            var returnStatus = ""
            val sharedPref = context.getSharedPreferences(
                "MasSharedPref_Sensitive_Data",
                Context.MODE_PRIVATE
            )
            sharedPref.edit {
                putString("UnencryptedGitHubToken", githubToken)
                returnStatus += "[FAIL]: Stored sensitive data (Github Token) using putString.\n\n"

                putString("EncryptedGitHubToken", encrypt(awsKey))
                returnStatus += "[OK]: Stored encrypted sensitive data (AWS key) using putString.\n\n"

                putStringSet("UnencryptedPreSharedKeys", preSharedKeys)
                returnStatus += "[FAIL]: Stored unencrypted binary keys using putStringSet.\n\n"
            }
            returnStatus
        } catch (e: Exception) {
            "Error during MastgTest: ${e.message ?: "Unknown error"}"
        }
    }
}

Steps

1. Install the app on a device ( Installing Apps)
2. Make sure you have Frida for Android installed on your machine and the frida-server running on the device
3. Run run.sh to spawn the app with Frida
4. Click the Start button
5. Stop the script by pressing Ctrl+C and/or q to quit the Frida CLI

hooks.jsrun.sh

var target = {
  category: "STORAGE",
  demo: "0059",
  hooks: [
    {
      class: "android.app.SharedPreferencesImpl$EditorImpl",
      methods: [
        "putString",
        "putStringSet"
      ]
    },
    {
      class: "javax.crypto.Cipher",
      methods: [
        "getInstance",
        "doFinal",
        "init",
        "update"
      ]
    },
    {
      class: "java.security.KeyStore",
      methods: [
        // "getInstance",
        "setEntry",
        "getEntry"
      ]
    },
    {
      class: "javax.crypto.KeyGenerator",
      methods: [
        "getInstance",
        // "init",
        "generateKey"
      ]
    },
    {
      class: "android.util.Base64",
      methods: [
        "encodeToString",
        "decode"
      ]
    }
  ]
}

#!/bin/bash
../../../../utils/frida/android/run.sh ./hooks.js

Observation

The output shows all instances of strings written via SharedPreferences that were found at runtime. A backtrace is also provided to help identify the location in the code.

{
  "id": "048be862-005c-45e2-b504-9ab6fa280784",
  "category": "STORAGE",
  "time": "2025-09-01T06:36:43.565Z",
  "class": "android.app.SharedPreferencesImpl$EditorImpl",
  "method": "putString",
  "stackTrace": [
    "android.app.SharedPreferencesImpl$EditorImpl.putString(Native Method)",
    "org.owasp.mastestapp.MastgTest.mastgTest(MastgTest.kt:60)",
    "org.owasp.mastestapp.MainActivityKt.MainScreen$lambda$10$lambda$9(MainActivity.kt:88)",
    "org.owasp.mastestapp.MainActivityKt.$r8$lambda$q7zJ11jwoN73NSP2ckY8XHAEb68(Unknown Source:0)",
    "org.owasp.mastestapp.MainActivityKt$$ExternalSyntheticLambda2.run(D8$$SyntheticClass:0)",
    "java.lang.Thread.run(Thread.java:920)"
  ],
  "inputParameters": [
    {
      "type": "java.lang.String",
      "value": "UnencryptedGitHubToken"
    },
    {
      "type": "java.lang.String",
      "value": "ghp_1234567890abcdefghijklmnOPQRSTUV"
    }
  ],
  "returnValue": [
    {
      "type": "android.content.SharedPreferences$Editor",
      "value": "<instance: android.content.SharedPreferences$Editor, $className: android.app.SharedPreferencesImpl$EditorImpl>"
    }
  ]
}
{
  "id": "36886813-56aa-4085-b677-42da89a30df5",
  "category": "STORAGE",
  "time": "2025-09-01T06:36:43.567Z",
  "class": "javax.crypto.Cipher",
  "method": "getInstance",
  "stackTrace": [
    "javax.crypto.Cipher.getInstance(Native Method)",
    "org.owasp.mastestapp.MastgTest.encrypt(MastgTest.kt:44)",
    "org.owasp.mastestapp.MastgTest.mastgTest(MastgTest.kt:63)",
    "org.owasp.mastestapp.MainActivityKt.MainScreen$lambda$10$lambda$9(MainActivity.kt:88)",
    "org.owasp.mastestapp.MainActivityKt.$r8$lambda$q7zJ11jwoN73NSP2ckY8XHAEb68(Unknown Source:0)",
    "org.owasp.mastestapp.MainActivityKt$$ExternalSyntheticLambda2.run(D8$$SyntheticClass:0)",
    "java.lang.Thread.run(Thread.java:920)"
  ],
  "inputParameters": [
    {
      "type": "java.lang.String",
      "value": "AES/GCM/NoPadding"
    }
  ],
  "returnValue": [
    {
      "type": "javax.crypto.Cipher",
      "value": "<instance: javax.crypto.Cipher>"
    }
  ]
}
{
  "id": "8afa596d-e749-4184-8c84-aea3c00244f9",
  "category": "STORAGE",
  "time": "2025-09-01T06:36:43.572Z",
  "class": "javax.crypto.KeyGenerator",
  "method": "getInstance",
  "stackTrace": [
    "javax.crypto.KeyGenerator.getInstance(Native Method)",
    "org.owasp.mastestapp.MastgTest.getOrCreateSecretKey(MastgTest.kt:26)",
    "org.owasp.mastestapp.MastgTest.encrypt(MastgTest.kt:45)",
    "org.owasp.mastestapp.MastgTest.mastgTest(MastgTest.kt:63)",
    "org.owasp.mastestapp.MainActivityKt.MainScreen$lambda$10$lambda$9(MainActivity.kt:88)",
    "org.owasp.mastestapp.MainActivityKt.$r8$lambda$q7zJ11jwoN73NSP2ckY8XHAEb68(Unknown Source:0)",
    "org.owasp.mastestapp.MainActivityKt$$ExternalSyntheticLambda2.run(D8$$SyntheticClass:0)",
    "java.lang.Thread.run(Thread.java:920)"
  ],
  "inputParameters": [
    {
      "type": "java.lang.String",
      "value": "AES"
    },
    {
      "type": "java.lang.String",
      "value": "AndroidKeyStore"
    }
  ],
  "returnValue": [
    {
      "type": "javax.crypto.KeyGenerator",
      "value": "<instance: javax.crypto.KeyGenerator>"
    }
  ]
}
{
  "id": "3e97f8ba-1d93-4321-bfe8-394ccd6829c8",
  "category": "STORAGE",
  "time": "2025-09-01T06:36:43.575Z",
  "class": "javax.crypto.KeyGenerator",
  "method": "generateKey",
  "stackTrace": [
    "javax.crypto.KeyGenerator.generateKey(Native Method)",
    "org.owasp.mastestapp.MastgTest.getOrCreateSecretKey(MastgTest.kt:39)",
    "org.owasp.mastestapp.MastgTest.encrypt(MastgTest.kt:45)",
    "org.owasp.mastestapp.MastgTest.mastgTest(MastgTest.kt:63)",
    "org.owasp.mastestapp.MainActivityKt.MainScreen$lambda$10$lambda$9(MainActivity.kt:88)",
    "org.owasp.mastestapp.MainActivityKt.$r8$lambda$q7zJ11jwoN73NSP2ckY8XHAEb68(Unknown Source:0)",
    "org.owasp.mastestapp.MainActivityKt$$ExternalSyntheticLambda2.run(D8$$SyntheticClass:0)",
    "java.lang.Thread.run(Thread.java:920)"
  ],
  "inputParameters": [],
  "returnValue": [
    {
      "type": "javax.crypto.SecretKey",
      "value": "<instance: javax.crypto.SecretKey, $className: android.security.keystore2.AndroidKeyStoreSecretKey>"
    }
  ]
}
{
  "id": "865e4b9f-1f64-47ff-bd7b-b8f0dd769120",
  "category": "STORAGE",
  "time": "2025-09-01T06:36:43.586Z",
  "class": "javax.crypto.Cipher",
  "method": "init",
  "stackTrace": [
    "javax.crypto.Cipher.init(Native Method)",
    "javax.crypto.Cipher.init(Cipher.java:1084)",
    "javax.crypto.Cipher.init(Native Method)",
    "org.owasp.mastestapp.MastgTest.encrypt(MastgTest.kt:45)",
    "org.owasp.mastestapp.MastgTest.mastgTest(MastgTest.kt:63)",
    "org.owasp.mastestapp.MainActivityKt.MainScreen$lambda$10$lambda$9(MainActivity.kt:88)",
    "org.owasp.mastestapp.MainActivityKt.$r8$lambda$q7zJ11jwoN73NSP2ckY8XHAEb68(Unknown Source:0)",
    "org.owasp.mastestapp.MainActivityKt$$ExternalSyntheticLambda2.run(D8$$SyntheticClass:0)"
  ],
  "inputParameters": [
    {
      "type": "int",
      "value": 1
    },
    {
      "type": "java.security.Key",
      "value": "<instance: java.security.Key, $className: android.security.keystore2.AndroidKeyStoreSecretKey>"
    },
    {
      "type": "java.security.SecureRandom",
      "value": "<instance: java.security.SecureRandom>"
    }
  ],
  "returnValue": [
    {
      "type": "void",
      "value": "void"
    }
  ]
}
{
  "id": "cc62db52-46aa-4e94-a0be-7a812bb3043a",
  "category": "STORAGE",
  "time": "2025-09-01T06:36:43.585Z",
  "class": "javax.crypto.Cipher",
  "method": "init",
  "stackTrace": [
    "javax.crypto.Cipher.init(Native Method)",
    "org.owasp.mastestapp.MastgTest.encrypt(MastgTest.kt:45)",
    "org.owasp.mastestapp.MastgTest.mastgTest(MastgTest.kt:63)",
    "org.owasp.mastestapp.MainActivityKt.MainScreen$lambda$10$lambda$9(MainActivity.kt:88)",
    "org.owasp.mastestapp.MainActivityKt.$r8$lambda$q7zJ11jwoN73NSP2ckY8XHAEb68(Unknown Source:0)",
    "org.owasp.mastestapp.MainActivityKt$$ExternalSyntheticLambda2.run(D8$$SyntheticClass:0)",
    "java.lang.Thread.run(Thread.java:920)"
  ],
  "inputParameters": [
    {
      "type": "int",
      "value": 1
    },
    {
      "type": "java.security.Key",
      "value": "<instance: java.security.Key, $className: android.security.keystore2.AndroidKeyStoreSecretKey>"
    }
  ],
  "returnValue": [
    {
      "type": "void",
      "value": "void"
    }
  ]
}
{
  "id": "6294b01b-661c-4652-8db5-ddd797a5b722",
  "category": "STORAGE",
  "time": "2025-09-01T06:36:43.592Z",
  "class": "javax.crypto.Cipher",
  "method": "doFinal",
  "stackTrace": [
    "javax.crypto.Cipher.doFinal(Native Method)",
    "org.owasp.mastestapp.MastgTest.encrypt(MastgTest.kt:47)",
    "org.owasp.mastestapp.MastgTest.mastgTest(MastgTest.kt:63)",
    "org.owasp.mastestapp.MainActivityKt.MainScreen$lambda$10$lambda$9(MainActivity.kt:88)",
    "org.owasp.mastestapp.MainActivityKt.$r8$lambda$q7zJ11jwoN73NSP2ckY8XHAEb68(Unknown Source:0)",
    "org.owasp.mastestapp.MainActivityKt$$ExternalSyntheticLambda2.run(D8$$SyntheticClass:0)",
    "java.lang.Thread.run(Thread.java:920)"
  ],
  "inputParameters": [
    {
      "type": "[B",
      "value": "AKIAIOSFODNN7EXAMPLE"
    }
  ],
  "returnValue": [
    {
      "type": "[B",
      "value": "0xa132cb95022985be9229fe0206ac7e3ea847fd34cf16d0a1f513d30187b3596e513e13cf..."
    }
  ]
}
{
  "id": "e5172a5f-e38e-4506-b42b-e8ab634b299b",
  "category": "STORAGE",
  "time": "2025-09-01T06:36:43.595Z",
  "class": "android.util.Base64",
  "method": "encodeToString",
  "stackTrace": [
    "android.util.Base64.encodeToString(Native Method)",
    "org.owasp.mastestapp.MastgTest.encrypt(MastgTest.kt:49)",
    "org.owasp.mastestapp.MastgTest.mastgTest(MastgTest.kt:63)",
    "org.owasp.mastestapp.MainActivityKt.MainScreen$lambda$10$lambda$9(MainActivity.kt:88)",
    "org.owasp.mastestapp.MainActivityKt.$r8$lambda$q7zJ11jwoN73NSP2ckY8XHAEb68(Unknown Source:0)",
    "org.owasp.mastestapp.MainActivityKt$$ExternalSyntheticLambda2.run(D8$$SyntheticClass:0)",
    "java.lang.Thread.run(Thread.java:920)"
  ],
  "inputParameters": [
    {
      "type": "[B",
      "value": "0x5754325e1195f3c4502e6323a132cb95022985be9229fe0206ac7e3ea847fd34cf16d0a1f513d30187b3596e513e13cf..."
    },
    {
      "type": "int",
      "value": 0
    }
  ],
  "returnValue": [
    {
      "type": "java.lang.String",
      "value": "V1QyXhGV88RQLmMjoTLLlQIphb6SKf4CBqx+PqhH/TTPFtCh9RPTAYezWW5RPhPP\n"
    }
  ]
}
{
  "id": "eb1fc822-6245-45dd-b245-e01bd93b536b",
  "category": "STORAGE",
  "time": "2025-09-01T06:36:43.597Z",
  "class": "android.app.SharedPreferencesImpl$EditorImpl",
  "method": "putString",
  "stackTrace": [
    "android.app.SharedPreferencesImpl$EditorImpl.putString(Native Method)",
    "org.owasp.mastestapp.MastgTest.mastgTest(MastgTest.kt:63)",
    "org.owasp.mastestapp.MainActivityKt.MainScreen$lambda$10$lambda$9(MainActivity.kt:88)",
    "org.owasp.mastestapp.MainActivityKt.$r8$lambda$q7zJ11jwoN73NSP2ckY8XHAEb68(Unknown Source:0)",
    "org.owasp.mastestapp.MainActivityKt$$ExternalSyntheticLambda2.run(D8$$SyntheticClass:0)",
    "java.lang.Thread.run(Thread.java:920)"
  ],
  "inputParameters": [
    {
      "type": "java.lang.String",
      "value": "EncryptedAwsKey"
    },
    {
      "type": "java.lang.String",
      "value": "V1QyXhGV88RQLmMjoTLLlQIphb6SKf4CBqx+PqhH/TTPFtCh9RPTAYezWW5RPhPP\n"
    }
  ],
  "returnValue": [
    {
      "type": "android.content.SharedPreferences$Editor",
      "value": "<instance: android.content.SharedPreferences$Editor, $className: android.app.SharedPreferencesImpl$EditorImpl>"
    }
  ]
}
{
  "id": "9995b7ce-7c7a-45d1-a83d-3d4de76b8bbd",
  "category": "STORAGE",
  "time": "2025-09-01T06:36:43.598Z",
  "class": "android.app.SharedPreferencesImpl$EditorImpl",
  "method": "putStringSet",
  "stackTrace": [
    "android.app.SharedPreferencesImpl$EditorImpl.putStringSet(Native Method)",
    "org.owasp.mastestapp.MastgTest.mastgTest(MastgTest.kt:66)",
    "org.owasp.mastestapp.MainActivityKt.MainScreen$lambda$10$lambda$9(MainActivity.kt:88)",
    "org.owasp.mastestapp.MainActivityKt.$r8$lambda$q7zJ11jwoN73NSP2ckY8XHAEb68(Unknown Source:0)",
    "org.owasp.mastestapp.MainActivityKt$$ExternalSyntheticLambda2.run(D8$$SyntheticClass:0)",
    "java.lang.Thread.run(Thread.java:920)"
  ],
  "inputParameters": [
    {
      "type": "java.lang.String",
      "value": "UnencryptedPreSharedKeys"
    },
    {
      "type": "java.util.Set",
      "value": "MIIEvAIBADANBgkqhkiG9w0BAQEFAASCAmIwggJeAgEAAoGBALfX7kbfFv3pc3JjOHQ=,gJXS9EwpuzK8U1TOgfplwfKEVngCE2D5FNBQWvNmuHHbigmTCabsA="
    }
  ],
  "returnValue": [
    {
      "type": "android.content.SharedPreferences$Editor",
      "value": "<instance: android.content.SharedPreferences$Editor, $className: android.app.SharedPreferencesImpl$EditorImpl>"
    }
  ]
}

Evaluation

In output.json we can identify several entries that use the SharedPreferences API write strings to the app's local sandbox. In this case to /data/data/org.owasp.mastestapp/shared_prefs/MasSharedPref_Sensitive_Data.xml:

• putString is used to write an unencrypted UnencryptedGitHubToken of value ghp_1234567890a...
• putString is used to write an encrypted EncryptedAwsKey of value V1QyXhGV88RQLmMjoTLLl...
• putStringSet is used to write an unencrypted UnencryptedPreSharedKeys set with values MIIEvAIBADAN... and gJXS9EwpuzK8...

We can use the values and try to trace them back to crypto method calls and check if they are encrypted. For example, let's analyze the EncryptedAwsKey of value V1QyXhGV88RQLmMjoTLLl...:

• V1QyXhGV88RQLmMjoTLLl... is the return value of Base64.encodeToString for the input 0x5754325e1195f3c45...
• 0xa132cb95022985be is the return value of Cipher.doFinal for the input AKIAIOSFODNN7EXAMPLE

However, we cannot find any calls to Base64.encodeToString or Cipher.*** for the preSharedKeys values written by putStringSet (MIIEvAIBADAN... and gJXS9EwpuzK8...).

You can confirm this by reverse engineering the app and inspecting the code. Inspect the stackTrace of the putString and putStringSet entries, then go to the corresponding locations in the code. For example, go to the org.owasp.mastestapp.MastgTest.mastgTest method and try to trace back the input parameters to determine whether they are encrypted.

The test fails due because we found some entries that aren't encrypted.

Any data in the app sandbox can be extracted using backups or root access on a compromised phone. For example, run the following command:

adb shell cat /data/data/org.owasp.mastestapp/shared_prefs/MasSharedPref_Sensitive_Data.xml

Which returns:

<?xml version='1.0' encoding='utf-8' standalone='yes' ?>
<map>
    <string name="EncryptedAwsKey">V1QyXhGV88RQLmMjoTLLlQIphb6SKf4CBqx+PqhH/TTPFtCh9RPTAYezWW5RPhPP&#10;    </string>
    <set name="UnencryptedPreSharedKeys">
        <string>gJXS9EwpuzK8U1TOgfplwfKEVngCE2D5FNBQWvNmuHHbigmTCabsA=</string>
        <string>MIIEvAIBADANBgkqhkiG9w0BAQEFAASCAmIwggJeAgEAAoGBALfX7kbfFv3pc3JjOHQ=</string>
    </set>
    <string name="UnencryptedGitHubToken">ghp_1234567890abcdefghijklmnOPQRSTUV</string>
</map>

All entries that aren't encrypted can be leveraged by an attacker.