MASTG-DEMO-0059: Using SharedPreferences to Write Sensitive Data Unencrypted to the App Sandbox

Download MASTG-DEMO-0059 APK Open MASTG-DEMO-0059 Folder Build MASTG-DEMO-0059 APK

Sample¶

The code below stores sensitive data using the SharedPreferences API, both with and without encryption:

An AWS key is stored encrypted
A GitHub token is stored unencrypted
A set of binary pre-shared keys is stored unencrypted

When encryption is performed, it uses a securely generated key stored in the Android KeyStore.

MastgTest.kt
package org.owasp.mastestapp

import android.content.Context
import android.security.keystore.KeyGenParameterSpec
import android.security.keystore.KeyProperties
import android.util.Base64
import java.security.KeyStore
import javax.crypto.Cipher
import javax.crypto.KeyGenerator
import javax.crypto.SecretKey
import androidx.core.content.edit

class MastgTest(private val context: Context) {
    private val awsKey = "AKIAABCDEFGHIJKLMNOP"
    private val githubToken = "ghp_1234567890abcdefghijklmnopqrstuvABCD"
    private val preSharedKeys = hashSetOf(
        "-----BEGIN PRIVATE KEY-----\nMIIEvAIBADANBgkqhkiG9w0BAQEFAASCAmIwggJeAgEAAoGBALfX7kbfFv3pc3JjOHQ=\n-----END PRIVATE KEY-----",
        "-----BEGIN PRIVATE KEY-----\ngJXS9EwpuzK8U1TOgfplwfKEVngCE2D5FNBQWvNmuHHbigmTCabsA=\n-----END PRIVATE KEY-----"
    )
    private val keyAlias = "mastgKey"

    private fun getOrCreateSecretKey(): SecretKey {
        val keyStore = KeyStore.getInstance("AndroidKeyStore").apply { load(null) }
        return if (keyStore.containsAlias(keyAlias)) {
            (keyStore.getEntry(keyAlias, null) as KeyStore.SecretKeyEntry).secretKey
        } else {
            KeyGenerator.getInstance(
                KeyProperties.KEY_ALGORITHM_AES,
                "AndroidKeyStore"
            ).apply {
                init(
                    KeyGenParameterSpec.Builder(
                        keyAlias,
                        KeyProperties.PURPOSE_ENCRYPT or KeyProperties.PURPOSE_DECRYPT
                    )
                        .setBlockModes(KeyProperties.BLOCK_MODE_GCM)
                        .setEncryptionPaddings(KeyProperties.ENCRYPTION_PADDING_NONE)
                        .build()
                )
            }.generateKey()
        }
    }

    private fun encrypt(plainText: String): String {
        val cipher = Cipher.getInstance("AES/GCM/NoPadding")
        cipher.init(Cipher.ENCRYPT_MODE, getOrCreateSecretKey())
        val iv = cipher.iv
        val encryptedBytes = cipher.doFinal(plainText.toByteArray(Charsets.UTF_8))
        val combined = iv + encryptedBytes
        return Base64.encodeToString(combined, Base64.DEFAULT)
    }

    fun mastgTest(): String {
        return try {
            var returnStatus = ""
            val sharedPref = context.getSharedPreferences(
                "MasSharedPref_Sensitive_Data",
                Context.MODE_PRIVATE
            )
            sharedPref.edit {
                putString("UnencryptedGitHubToken", githubToken)
                returnStatus += "[FAIL]: Stored unencrypted sensitive data (Github Token) using putString.\n\n"

                putString("EncryptedAwsKey", encrypt(awsKey))
                returnStatus += "[OK]: Stored encrypted sensitive data (AWS key) using putString.\n\n"

                putStringSet("UnencryptedPreSharedKeys", preSharedKeys)
                returnStatus += "[FAIL]: Stored unencrypted binary keys using putStringSet.\n\n"
            }
            returnStatus
        } catch (e: Exception) {
            "Error during MastgTest: ${e.message ?: "Unknown error"}"
        }
    }
}

When executing the code, you will be able to inspect the shared preferences file created in the app sandbox. For example, run the following command:

adb shell cat /data/data/org.owasp.mastestapp/shared_prefs/MasSharedPref_Sensitive_Data.xml

Which returns:

MasSharedPref_Sensitive_Data.xml
<?xml version='1.0' encoding='utf-8' standalone='yes' ?>
<map>
    <string name="EncryptedAwsKey">V1QyXhGV88RQLmMjoTLLlQIphb6SKf4CBqx+PqhH/TTPFtCh9RPTAYezWW5RPhPP&#10;    </string>
    <set name="UnencryptedPreSharedKeys">
        <string>-----BEGIN PRIVATE KEY-----\nMIIEvAIBADANBgkqhkiG9w0BAQEFAASCAmIwggJeAgEAAoGBALfX7kbfFv3pc3JjOHQ=\n-----END PRIVATE KEY-----</string>
        <string>-----BEGIN PRIVATE KEY-----\ngJXS9EwpuzK8U1TOgfplwfKEVngCE2D5FNBQWvNmuHHbigmTCabsA=\n-----END PRIVATE KEY-----</string>
    </set>
    <string name="UnencryptedGitHubToken">ghp_1234567890abcdefghijklmnopqrstuvABCD</string>
</map>

All unencrypted entries can be leveraged by an attacker.

Steps¶

Install the app on a device ( Installing Apps)
Make sure you have Frida for Android installed on your machine and the frida-server running on the device
Run run.sh to spawn the app with Frida
Click the Start button
Stop the script by pressing Ctrl+C and/or q to quit the Frida CLI

These are the relevant methods we are hooking to detect the use of SharedPreferences to write strings: - SharedPreferences.Editor.putString(...) - SharedPreferences.Editor.putStringSet(...)

Our hooks also trace calls to cryptographic methods to help determine whether the written values are encrypted or not; whether the Android KeyStore is used; and whether Base64 encoding is used to convert binary data to strings: - javax.crypto.Cipher.*(...) - java.security.KeyStore.*(...) - javax.crypto.KeyGenerator.*(...) - android.util.Base64.*(...)

hooks.jsrun.sh

var target = {
  category: "STORAGE",
  demo: "0059",
  hooks: [
    {
      class: "android.app.SharedPreferencesImpl$EditorImpl",
      methods: [
        "putString",
        "putStringSet"
      ]
    },
    {
      class: "javax.crypto.Cipher",
      methods: [
        "getInstance",
        "doFinal",
        "init",
        "update"
      ]
    },
    {
      class: "java.security.KeyStore",
      methods: [
        // "getInstance",
        "setEntry",
        "getEntry"
      ]
    },
    {
      class: "javax.crypto.KeyGenerator",
      methods: [
        "getInstance",
        // "init",
        "generateKey"
      ]
    },
    {
      class: "android.util.Base64",
      methods: [
        "encodeToString",
        "decode"
      ]
    }
  ]
}

#!/bin/bash
../../../../utils/frida/android/run.sh ./hooks.js

Observation¶

The output shows all instances of strings written via SharedPreferences that were found at runtime. A backtrace is also provided to help identify the corresponding locations in the code.

output.json
{
  "id": "d1cb86ee-9900-4829-8161-77e18324b574",
  "category": "STORAGE",
  "time": "2025-09-13T10:41:09.890Z",
  "class": "android.app.SharedPreferencesImpl$EditorImpl",
  "method": "putString",
  "stackTrace": [
    "android.app.SharedPreferencesImpl$EditorImpl.putString(Native Method)",
    "org.owasp.mastestapp.MastgTest.mastgTest(MastgTest.kt:61)",
    "org.owasp.mastestapp.MainActivityKt.MainScreen$lambda$6$lambda$5(MainActivity.kt:55)",
    "org.owasp.mastestapp.MainActivityKt.$r8$lambda$PtKdgqcXvbS9cMNZVWq3K3GGQKQ(Unknown Source:0)",
    "org.owasp.mastestapp.MainActivityKt$$ExternalSyntheticLambda3.run(D8$$SyntheticClass:0)",
    "java.lang.Thread.run(Thread.java:1012)"
  ],
  "inputParameters": [
    {
      "type": "java.lang.String",
      "value": "UnencryptedGitHubToken"
    },
    {
      "type": "java.lang.String",
      "value": "ghp_1234567890abcdefghijklmnopqrstuvABCD"
    }
  ],
  "returnValue": [
    {
      "type": "android.content.SharedPreferences$Editor",
      "value": "<instance: android.content.SharedPreferences$Editor, $className: android.app.SharedPreferencesImpl$EditorImpl>"
    }
  ]
}
{
  "id": "0c314619-4159-4e05-88d1-5bae3a0f9c6f",
  "category": "STORAGE",
  "time": "2025-09-13T10:41:09.893Z",
  "class": "javax.crypto.Cipher",
  "method": "getInstance",
  "stackTrace": [
    "javax.crypto.Cipher.getInstance(Native Method)",
    "org.owasp.mastestapp.MastgTest.encrypt(MastgTest.kt:45)",
    "org.owasp.mastestapp.MastgTest.mastgTest(MastgTest.kt:64)",
    "org.owasp.mastestapp.MainActivityKt.MainScreen$lambda$6$lambda$5(MainActivity.kt:55)",
    "org.owasp.mastestapp.MainActivityKt.$r8$lambda$PtKdgqcXvbS9cMNZVWq3K3GGQKQ(Unknown Source:0)",
    "org.owasp.mastestapp.MainActivityKt$$ExternalSyntheticLambda3.run(D8$$SyntheticClass:0)",
    "java.lang.Thread.run(Thread.java:1012)"
  ],
  "inputParameters": [
    {
      "type": "java.lang.String",
      "value": "AES/GCM/NoPadding"
    }
  ],
  "returnValue": [
    {
      "type": "javax.crypto.Cipher",
      "value": "<instance: javax.crypto.Cipher>"
    }
  ]
}
{
  "id": "530769c9-f6bb-4a20-a4d1-05650f039913",
  "category": "STORAGE",
  "time": "2025-09-13T10:41:09.907Z",
  "class": "java.security.KeyStore",
  "method": "getEntry",
  "stackTrace": [
    "java.security.KeyStore.getEntry(Native Method)",
    "org.owasp.mastestapp.MastgTest.getOrCreateSecretKey(MastgTest.kt:25)",
    "org.owasp.mastestapp.MastgTest.encrypt(MastgTest.kt:46)",
    "org.owasp.mastestapp.MastgTest.mastgTest(MastgTest.kt:64)",
    "org.owasp.mastestapp.MainActivityKt.MainScreen$lambda$6$lambda$5(MainActivity.kt:55)",
    "org.owasp.mastestapp.MainActivityKt.$r8$lambda$PtKdgqcXvbS9cMNZVWq3K3GGQKQ(Unknown Source:0)",
    "org.owasp.mastestapp.MainActivityKt$$ExternalSyntheticLambda3.run(D8$$SyntheticClass:0)",
    "java.lang.Thread.run(Thread.java:1012)"
  ],
  "inputParameters": [
    {
      "type": "java.lang.String",
      "value": "mastgKey"
    },
    {
      "type": "java.security.KeyStore$ProtectionParameter",
      "value": "void"
    }
  ],
  "returnValue": [
    {
      "type": "java.security.KeyStore$Entry",
      "value": "<instance: java.security.KeyStore$Entry, $className: java.security.KeyStore$SecretKeyEntry>"
    }
  ]
}
{
  "id": "afd5682f-6521-4406-b60e-0ee67ff409db",
  "category": "STORAGE",
  "time": "2025-09-13T10:41:09.922Z",
  "class": "javax.crypto.Cipher",
  "method": "init",
  "stackTrace": [
    "javax.crypto.Cipher.init(Native Method)",
    "javax.crypto.Cipher.init(Cipher.java:1085)",
    "javax.crypto.Cipher.init(Native Method)",
    "org.owasp.mastestapp.MastgTest.encrypt(MastgTest.kt:46)",
    "org.owasp.mastestapp.MastgTest.mastgTest(MastgTest.kt:64)",
    "org.owasp.mastestapp.MainActivityKt.MainScreen$lambda$6$lambda$5(MainActivity.kt:55)",
    "org.owasp.mastestapp.MainActivityKt.$r8$lambda$PtKdgqcXvbS9cMNZVWq3K3GGQKQ(Unknown Source:0)",
    "org.owasp.mastestapp.MainActivityKt$$ExternalSyntheticLambda3.run(D8$$SyntheticClass:0)"
  ],
  "inputParameters": [
    {
      "type": "int",
      "value": 1
    },
    {
      "type": "java.security.Key",
      "value": "<instance: java.security.Key, $className: android.security.keystore2.AndroidKeyStoreSecretKey>"
    },
    {
      "type": "java.security.SecureRandom",
      "value": "<instance: java.security.SecureRandom>"
    }
  ],
  "returnValue": [
    {
      "type": "void",
      "value": "void"
    }
  ]
}
{
  "id": "3cc2ea7d-f67e-4576-99b9-0d6908b8ce24",
  "category": "STORAGE",
  "time": "2025-09-13T10:41:09.919Z",
  "class": "javax.crypto.Cipher",
  "method": "init",
  "stackTrace": [
    "javax.crypto.Cipher.init(Native Method)",
    "org.owasp.mastestapp.MastgTest.encrypt(MastgTest.kt:46)",
    "org.owasp.mastestapp.MastgTest.mastgTest(MastgTest.kt:64)",
    "org.owasp.mastestapp.MainActivityKt.MainScreen$lambda$6$lambda$5(MainActivity.kt:55)",
    "org.owasp.mastestapp.MainActivityKt.$r8$lambda$PtKdgqcXvbS9cMNZVWq3K3GGQKQ(Unknown Source:0)",
    "org.owasp.mastestapp.MainActivityKt$$ExternalSyntheticLambda3.run(D8$$SyntheticClass:0)",
    "java.lang.Thread.run(Thread.java:1012)"
  ],
  "inputParameters": [
    {
      "type": "int",
      "value": 1
    },
    {
      "type": "java.security.Key",
      "value": "<instance: java.security.Key, $className: android.security.keystore2.AndroidKeyStoreSecretKey>"
    }
  ],
  "returnValue": [
    {
      "type": "void",
      "value": "void"
    }
  ]
}
{
  "id": "6200a4e6-607f-46b3-9b70-f57ea8ba80af",
  "category": "STORAGE",
  "time": "2025-09-13T10:41:09.936Z",
  "class": "javax.crypto.Cipher",
  "method": "doFinal",
  "stackTrace": [
    "javax.crypto.Cipher.doFinal(Native Method)",
    "org.owasp.mastestapp.MastgTest.encrypt(MastgTest.kt:48)",
    "org.owasp.mastestapp.MastgTest.mastgTest(MastgTest.kt:64)",
    "org.owasp.mastestapp.MainActivityKt.MainScreen$lambda$6$lambda$5(MainActivity.kt:55)",
    "org.owasp.mastestapp.MainActivityKt.$r8$lambda$PtKdgqcXvbS9cMNZVWq3K3GGQKQ(Unknown Source:0)",
    "org.owasp.mastestapp.MainActivityKt$$ExternalSyntheticLambda3.run(D8$$SyntheticClass:0)",
    "java.lang.Thread.run(Thread.java:1012)"
  ],
  "inputParameters": [
    {
      "type": "[B",
      "value": "AKIAABCDEFGHIJKLMNOP"
    }
  ],
  "returnValue": [
    {
      "type": "[B",
      "value": "0xf752de9dab78e423147bbf8274f34f81c28e6474b3725fe8457be0cddc5b4330fc75ed6b..."
    }
  ]
}
{
  "id": "9a519c23-77fd-4f5a-9b2b-ea80d5cd5be8",
  "category": "STORAGE",
  "time": "2025-09-13T10:41:09.941Z",
  "class": "android.util.Base64",
  "method": "encodeToString",
  "stackTrace": [
    "android.util.Base64.encodeToString(Native Method)",
    "org.owasp.mastestapp.MastgTest.encrypt(MastgTest.kt:50)",
    "org.owasp.mastestapp.MastgTest.mastgTest(MastgTest.kt:64)",
    "org.owasp.mastestapp.MainActivityKt.MainScreen$lambda$6$lambda$5(MainActivity.kt:55)",
    "org.owasp.mastestapp.MainActivityKt.$r8$lambda$PtKdgqcXvbS9cMNZVWq3K3GGQKQ(Unknown Source:0)",
    "org.owasp.mastestapp.MainActivityKt$$ExternalSyntheticLambda3.run(D8$$SyntheticClass:0)",
    "java.lang.Thread.run(Thread.java:1012)"
  ],
  "inputParameters": [
    {
      "type": "[B",
      "value": "0x53e09f5c462870a214466544f752de9dab78e423147bbf8274f34f81c28e6474b3725fe8457be0cddc5b4330fc75ed6b..."
    },
    {
      "type": "int",
      "value": 0
    }
  ],
  "returnValue": [
    {
      "type": "java.lang.String",
      "value": "U+CfXEYocKIURmVE91Lenat45CMUe7+CdPNPgcKOZHSzcl/oRXvgzdxbQzD8de1r\n"
    }
  ]
}
{
  "id": "926d8968-dc8b-4d23-b1f1-657b6410957a",
  "category": "STORAGE",
  "time": "2025-09-13T10:41:09.945Z",
  "class": "android.app.SharedPreferencesImpl$EditorImpl",
  "method": "putString",
  "stackTrace": [
    "android.app.SharedPreferencesImpl$EditorImpl.putString(Native Method)",
    "org.owasp.mastestapp.MastgTest.mastgTest(MastgTest.kt:64)",
    "org.owasp.mastestapp.MainActivityKt.MainScreen$lambda$6$lambda$5(MainActivity.kt:55)",
    "org.owasp.mastestapp.MainActivityKt.$r8$lambda$PtKdgqcXvbS9cMNZVWq3K3GGQKQ(Unknown Source:0)",
    "org.owasp.mastestapp.MainActivityKt$$ExternalSyntheticLambda3.run(D8$$SyntheticClass:0)",
    "java.lang.Thread.run(Thread.java:1012)"
  ],
  "inputParameters": [
    {
      "type": "java.lang.String",
      "value": "EncryptedAwsKey"
    },
    {
      "type": "java.lang.String",
      "value": "U+CfXEYocKIURmVE91Lenat45CMUe7+CdPNPgcKOZHSzcl/oRXvgzdxbQzD8de1r\n"
    }
  ],
  "returnValue": [
    {
      "type": "android.content.SharedPreferences$Editor",
      "value": "<instance: android.content.SharedPreferences$Editor, $className: android.app.SharedPreferencesImpl$EditorImpl>"
    }
  ]
}
{
  "id": "f2b7501a-b08a-4280-86a4-4f9e17a2f4f6",
  "category": "STORAGE",
  "time": "2025-09-13T10:41:09.949Z",
  "class": "android.app.SharedPreferencesImpl$EditorImpl",
  "method": "putStringSet",
  "stackTrace": [
    "android.app.SharedPreferencesImpl$EditorImpl.putStringSet(Native Method)",
    "org.owasp.mastestapp.MastgTest.mastgTest(MastgTest.kt:67)",
    "org.owasp.mastestapp.MainActivityKt.MainScreen$lambda$6$lambda$5(MainActivity.kt:55)",
    "org.owasp.mastestapp.MainActivityKt.$r8$lambda$PtKdgqcXvbS9cMNZVWq3K3GGQKQ(Unknown Source:0)",
    "org.owasp.mastestapp.MainActivityKt$$ExternalSyntheticLambda3.run(D8$$SyntheticClass:0)",
    "java.lang.Thread.run(Thread.java:1012)"
  ],
  "inputParameters": [
    {
      "type": "java.lang.String",
      "value": "UnencryptedPreSharedKeys"
    },
    {
      "type": "java.util.Set",
      "value": "-----BEGIN PRIVATE KEY-----\nMIIEvAIBADANBgkqhkiG9w0BAQEFAASCAmIwggJeAgEAAoGBALfX7kbfFv3pc3JjOHQ=\n-----END PRIVATE KEY-----,-----BEGIN PRIVATE KEY-----\ngJXS9EwpuzK8U1TOgfplwfKEVngCE2D5FNBQWvNmuHHbigmTCabsA=\n-----END PRIVATE KEY-----"
    }
  ],
  "returnValue": [
    {
      "type": "android.content.SharedPreferences$Editor",
      "value": "<instance: android.content.SharedPreferences$Editor, $className: android.app.SharedPreferencesImpl$EditorImpl>"
    }
  ]
}

Evaluation¶

The test fails because secrets are written to SharedPreferences without encryption.

In output.json we can identify several entries that use the SharedPreferences API to write strings to the app's local sandbox—in this case, to /data/data/org.owasp.mastestapp/shared_prefs/MasSharedPref_Sensitive_Data.xml.

Determining if a string is encrypted or not, especially with crypto keys can be challenging.

Option 1: High level trace inspection¶

After slightly processing the output using jq, we can get a high level view of the relevant calls, which can help us identify unencrypted secrets.

evaluation.txtevaluate.sh

Class: android.app.SharedPreferencesImpl$EditorImpl, Method: putString, Params: UnencryptedGitHubToken, ghp_1234567890abcdefghijklmnopqrstuvABCD
Class: javax.crypto.Cipher, Method: getInstance, Params: AES/GCM/NoPadding
Class: java.security.KeyStore, Method: getEntry, Params: mastgKey, void
Class: javax.crypto.Cipher, Method: init, Params: 1, <instance: java.security.Key, $className: android.security.keystore2.AndroidKeyStoreSecretKey>, <instance: java.security.SecureRandom>
Class: javax.crypto.Cipher, Method: init, Params: 1, <instance: java.security.Key, $className: android.security.keystore2.AndroidKeyStoreSecretKey>
Class: javax.crypto.Cipher, Method: doFinal, Params: AKIAABCDEFGHIJKLMNOP
Class: android.util.Base64, Method: encodeToString, Params: 0x53e09f5c462870a214466544f752de9dab78e423147bbf8274f34f81c28e6474b3725fe8457be0cddc5b4330fc75ed6b..., 0
Class: android.app.SharedPreferencesImpl$EditorImpl, Method: putString, Params: EncryptedAwsKey, U+CfXEYocKIURmVE91Lenat45CMUe7+CdPNPgcKOZHSzcl/oRXvgzdxbQzD8de1r

Class: android.app.SharedPreferencesImpl$EditorImpl, Method: putStringSet, Params: UnencryptedPreSharedKeys, -----BEGIN PRIVATE KEY-----
MIIEvAIBADANBgkqhkiG9w0BAQEFAASCAmIwggJeAgEAAoGBALfX7kbfFv3pc3JjOHQ=
-----END PRIVATE KEY-----,-----BEGIN PRIVATE KEY-----
gJXS9EwpuzK8U1TOgfplwfKEVngCE2D5FNBQWvNmuHHbigmTCabsA=
-----END PRIVATE KEY-----

#!/bin/bash

jq -r -s '
  flatten
  | .[]
  | "Class: \(.class), Method: \(.method), Params: \([.inputParameters[]?.value?] | join(", "))"
' output.json > evaluation.txt

Here we can see that:

the value ghp_1234567890a... is not preceded by any Cipher calls when written via putString.
the value V1QyXhGV88RQLmMjoTLLl... has several calls to Cipher and then a putString.
the set of values MIIEvAIBADAN... and gJXS9EwpuzK8... are also not preceded by any Cipher calls when written via putStringSet.

Option 2: Pattern matching¶

At this point you could use a secrets detection tool such as gitleaks to try to detect any secrets present in cleartext or encoded.

cat ./output.json | gitleaks -v stdin

    ○
    │╲
    │ ○
    ○ ░
    ░    gitleaks

Finding:     "value": "-----BEGIN PRIVATE KEY-----\nMIIEvAIBADANBgkqhkiG9w0BAQEFAASCAmIwggJeAgEAAoGBALfX7kbfFv3pc3JjOHQ=\n-...,-----BEGIN PRIVATE ...
Secret:      -----BEGIN PRIVATE KEY-----\nMIIEvAIBADANBgkqhkiG9w0BAQEFAASCAmIwggJeAgEAAoGBALfX7kbfFv3pc3JjOHQ=\n-...
RuleID:      private-key
Entropy:     4.884846

Finding:     ...END PRIVATE KEY-----,-----BEGIN PRIVATE KEY-----\ngJXS9EwpuzK8U1TOgfplwfKEVngCE2D5FNBQWvNmuHHbigmTCabsA=\n-----END PRIVAT...
Secret:      -----BEGIN PRIVATE KEY-----\ngJXS9EwpuzK8U1TOgfplwfKEVngCE2D5FNBQWvNmuHHbigmTCabsA=\n-----END PRIVAT...
RuleID:      private-key
Entropy:     4.945110

Finding:     "value": "AKIAABCDEFGHIJKLMNOP
Secret:      AKIAABCDEFGHIJKLMNOP
RuleID:      aws-access-token
Entropy:     3.884184

Finding:     "value": "ghp_1234567890abcdefghijklmnopqrstuvABCD
Secret:      ghp_1234567890abcdefghijklmnopqrstuvABCD
RuleID:      github-pat
Entropy:     5.171928

Option 3: Detailed trace inspection¶

The provided output.json in this case allows you to trace the written values back to cryptographic method calls and this way find out whether they are encrypted. For example, let's analyze the EncryptedAwsKey with value V1QyXhGV88RQLmMjoTLLl...:

V1QyXhGV88RQLmMjoTLLl... is the return value of Base64.encodeToString for the input 0x5754325e1195f3c45....
0xa132cb95022985be is the return value of Cipher.doFinal for the input AKIAABCDEFGHIJKLMNOP.

However, we cannot find any calls to Base64.encodeToString or Cipher.* for the preSharedKeys values written by putStringSet (MIIEvAIBADAN... and gJXS9EwpuzK8...).

Option 4: Manual reverse engineering¶

You can confirm this by reverse engineering the app and inspecting the code. Review the stackTrace of the putString and putStringSet entries, then navigate to the corresponding locations in the code. For example, open the org.owasp.mastestapp.MastgTest.mastgTest method and try to trace back the input parameters to determine whether they are encrypted.