Android SecurityAssessment
A hands-on assessment of DIVA, a deliberately vulnerable Android app. Twelve exercises were validated through source review, ADB testing, component abuse, SQL injection, native analysis, and runtime instrumentation.
VIEW ASSESSMENT ↓Proof overclaims
Exercises confirmed
Security areas
Analysis modes
Isolated lab
Inspect the implementation
Reviewed decompiled Java, Android resources, component declarations, and native-library strings to locate trust boundaries and sensitive operations.
Predict the security failure
Converted each code observation into a concrete test: data recovery, crafted input, external component invocation, or runtime observation.
Confirm on the device
Used a rooted Genymotion Android 11 emulator, ADB, Android shell tools, and Frida to validate the behavior live.
Preserve proof and remediation
Captured sanitized evidence, mapped each issue to an OWASP MASVS area, and documented a practical fix.
Twelve exercisesvalidated
Sensitive Logging
A submitted payment-card value appeared in Logcat.
Java Hardcoded Secret
A plaintext vendor key was extracted from decompiled client code.
Insecure Data Storage
Plaintext credentials were recovered from SharedPreferences, SQLite, a private file, and external storage.
SQL Injection
A crafted search returned every seeded user record and its sensitive fields.
Unsafe URI Handling
The WebView rendered attacker-controlled HTML from an untrusted URI scheme.
Broken Component Access Control
Exported activities and a ContentProvider disclosed protected credentials and private notes.
Native Hardcoded Secret
An ELF string exposed the secret; Frida observed the plaintext JNI argument and successful return value.
Frida linker issuediagnosed & fixed
Frida 17.7.3 enumerated processes but aborted during injection on the Android 11 x86_64 image. A matching Frida 16.6.6 client/server pair restored attach, Java bridge, and JNI observation.
[+] DivaJni.access candidate: [REDACTED TRAINING VALUE]
[+] DivaJni.access return value: 1