Android Pentesting Part 3
Dynamic Findings:
Android dynamic analysis involves testing an application while it is running to identify security vulnerabilities that may not be apparent through static analysis alone.
Unlike static analysis, which focuses on reviewing source code and configuration files, dynamic analysis allows testers to observe the application’s runtime behavior, network communications, authentication mechanisms, and interactions with the underlying operating system.
Tools such as Burp Suite, Frida, and Objection help security testers intercept network traffic, inspect application behavior, and assess security controls under different runtime conditions. During this phase, testers should focus on insecure network communication, improper session management, authentication and authorization flaws, sensitive data exposure, SSL/TLS certificate validation, and runtime security mechanisms.
Each finding should be validated with a practical proof of concept (PoC), supported by appropriate evidence, and mapped to the relevant OWASP Mobile Application Security Testing Guide (MASTG) recommendations.
The ultimate goal is to understand how the application behaves in real-world scenarios, determine the actual impact of identified vulnerabilities, and recommend effective remediation measures. So lets get started with the impact
DA-01 SSL Pinning Not Implemented
The application does not implement certificate or public-key pinning. Once a trusted proxy certificate is installed on a test device, traffic between the app and its backend can be intercepted and inspected using a proxy tool such as Burp Suite.
DA-02 No Anti-Debugging Mechanism Implemented
The application does not detect or block an attached debugger. A tester was able to attach jdb / Frida to the running process and step through, hook, or modify its runtime behaviour.
DA-03 Missing Useful HTTP Security Headers
Server responses returned to the app’s API calls omit several recommended security headers, including Strict-Transport-Security, X-Content-Type-Options, and Cache-Control directives on responses that carry sensitive data.
DA-04 Adversary Can Fingerprint the Application Server From HTTP Responses
Server response headers disclose backend software and version information — including web server and application framework version banners — that were captured during testing.
DA-05 Password Replay Attack
A previously captured authentication request — including the credentials or tokens it contains — can be resent to the server and is accepted again, indicating the backend has no protection against request replay.
DA- 06 TLS Padding Oracle Information Disclosure Vulnerability (TLS POODLE)
Closely related to the SSLv3 finding above, the server’s TLS configuration includes CBC-mode cipher suites that remain susceptible to padding-oracle attacks capable of leaking encrypted content byte-by-byte.
DA-07 Session Cookie Attributes Are Not Set Properly
Session cookies issued by the backend are missing recommended security attributes — specifically Secure, HttpOnly, and/or SameSite.
DA-08 Adversary Can Access the Default Web Page
An embedded web endpoint reachable by the application exposes a default or placeholder web page directly, rather than the app-controlled content that end users are expected to see.
DA-09 Mobile App URL Accessed Through a Web Browser
Backend endpoints intended to be consumed only by the mobile application were found to be directly reachable from a standard desktop web browser, without any app-specific validation preventing access.
DA-10 Adversary Can Perform Malicious Activity via Parameter Manipulation
Request parameters — including object identifiers, role flags, and monetary amounts — can be altered using an intercepting proxy, and the server processes the modified values without adequate authorisation checks.
Chapter Summary & Key Takeaways
Get Aerialist71’s stories in your inbox
Join Medium for free to get updates from this writer.
Dynamic analysis provides valuable insights into an Android application’s security posture by examining its behavior during execution. Throughout this chapter, we explored how to intercept and analyze application traffic using Burp Suite, investigate runtime behavior, and identify vulnerabilities through practical testing techniques.
Key Takeaways
- Network Traffic Analysis: Inspect HTTP/HTTPS communications to identify sensitive data exposure, insecure transmission, and improper certificate validation.
- Authentication & Session Management: Evaluate login mechanisms, session handling, token security, and logout functionality.
- Data Exposure: Examine application behavior for sensitive information leakage through network traffic, logs, runtime storage, and application responses.
- Runtime Security Testing: Analyze application behavior using tools such as Frida and Objection to assess the effectiveness of security controls.
- Vulnerability Validation: Develop practical PoCs, collect supporting evidence, assess business impact, and distinguish genuine vulnerabilities from false positives.
- Remediation & Reporting: Document each confirmed finding with its severity, technical details, impact, reproduction steps, and recommended mitigation.
Remember: Dynamic analysis complements static analysis; neither approach is sufficient on its own to establish an application’s overall security posture. Combining both approaches provides broader coverage and helps testers identify vulnerabilities that might otherwise go undetected.
In this new age era there are also other super critical and high findings that one should read like intent injection, content provider bypass using drozer, task hijacking, calling internal activity without authentication.
So, keep learning, exploring, and sharpening your skills! If you have any suggestions for improving this article or would like me to cover other Android application security concepts in more detail, feel free to share your thoughts in the comments. Your feedback and suggestions are always welcome!
