MASTG-TECH-0008: Accessing App Data Directories

Once you have installed the app, there is further information to explore, where tools like objection come in handy.

When using objection you can retrieve different kinds of information, where env will show you all the directory information of the app.

$ objection -g sg.vp.owasp_mobile.omtg_android explore

...g.vp.owasp_mobile.omtg_android on (google: 8.1.0) [usb] # env

Name                    Path
----------------------  ---------------------------------------------------------------------------
cacheDirectory          /data/user/0/sg.vp.owasp_mobile.omtg_android/cache
codeCacheDirectory      /data/user/0/sg.vp.owasp_mobile.omtg_android/code_cache
externalCacheDirectory  /storage/emulated/0/Android/data/sg.vp.owasp_mobile.omtg_android/cache
filesDirectory          /data/user/0/sg.vp.owasp_mobile.omtg_android/files
obbDir                  /storage/emulated/0/Android/obb/sg.vp.owasp_mobile.omtg_android
packageCodePath         /data/app/sg.vp.owasp_mobile.omtg_android-kR0ovWl9eoU_yh0jPJ9caQ==/base.apk

Among this information we find:

  • The internal data directory (aka. sandbox directory) which is at /data/data/[package-name] or /data/user/0/[package-name]
  • The external data directory at /storage/emulated/0/Android/data/[package-name] or /sdcard/Android/data/[package-name]
  • The path to the app package in /data/app/

The internal data directory is used by the app to store data created during runtime and has the following basic structure:

...g.vp.owasp_mobile.omtg_android on (google: 8.1.0)  [usb] # ls
Type       ...  Name
---------  ...  -------------------
Directory  ...  cache
Directory  ...  code_cache
Directory  ...  lib
Directory  ...  shared_prefs
Directory  ...  files
Directory  ...  databases

Readable: True  Writable: True

Each folder has its own purpose:

  • cache: This location is used for data caching. For example, the WebView cache is found in this directory.
  • code_cache: This is the location of the file system's application-specific cache directory designed for storing cached code. On devices running Android 5.0 (API level 21) or later, the system will delete any files stored in this location when the app or the entire platform is upgraded.
  • lib: This folder stores native libraries written in C/C++. These libraries can have one of several file extensions, including .so and .dll (x86 support). This folder contains subdirectories for the platforms the app has native libraries for, including
    • armeabi: compiled code for all ARM-based processors
    • armeabi-v7a: compiled code for all ARM-based processors, version 7 and above only
    • arm64-v8a: compiled code for all 64-bit ARM-based processors, version 8 and above based only
    • x86: compiled code for x86 processors only
    • x86_64: compiled code for x86_64 processors only
    • mips: compiled code for MIPS processors
  • shared_prefs: This folder contains an XML file that stores values saved via the SharedPreferences APIs.
  • files: This folder stores regular files created by the app.
  • databases: This folder stores SQLite database files generated by the app at runtime, e.g., user data files.

However, the app might store more data not only inside these folders but also in the parent folder (/data/data/[package-name]).

Refer to the "Testing Data Storage" chapter for more information and best practices on securely storing sensitive data.