You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: demos/android/MASVS-STORAGE/MASTG-DEMO-0069/MASTG-DEMO-0069.md
+1-1Lines changed: 1 addition & 1 deletion
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -32,4 +32,4 @@ The output contains the extracted sensitive data, showing PII (email address) an
32
32
33
33
### Evaluation
34
34
35
-
This test fails because the app uses DataStore without encryption, storing sensitive data such as an access token (secret) and the user's email address (PII) in **plaintext** within the sandbox.
35
+
This test fails because the app uses DataStore without encryption, storing sensitive data such as an access token (secret) and the user's email address (PII) in **plaintext** within the sandbox.
@@ -30,19 +31,21 @@ The goal of this test is to detect insecure storage of sensitive information in
30
31
- a secure mechanism (e.g., applying an `EncryptedFile.Builder` for Preferences DataStore or using an encrypted custom serializer for Proto DataStore) is explicitly applied to the sensitive fields.
31
32
32
33
### Dynamic Analysis
34
+
33
35
1. Install and run the app on a rooted or emulated device (@MASTG-TECH-0005).
34
36
2. Trigger app functionality that processes or stores sensitive data.
35
-
3. Access the app’s private storage (typically `/data/data/<package_name>/datastore/`) and locate the DataStore files. This requires accessing the app data directories (@MASTG-TECH-0008). File names usually end with:
37
+
3. Access the app's private storage (typically `/data/data/<package_name>/datastore/`) and locate the DataStore files. This requires accessing the app data directories (@MASTG-TECH-0008). File names usually end with:
36
38
-`.preferences_pb` (Preferences DataStore)
37
39
-`.proto` (Proto DataStore)
38
40
4. Extract the DataStore files from the device using @MASTG-TECH-0003.
39
-
5. Inspect the file content using a suitable tool, applying the technique for Dynamic Analysis (@MASTG-TECH-0015) to confirm whether sensitive data is stored in plaintext. *Note: Proto DataStore files require a Proto decoder for inspection.*
41
+
5. Inspect the file content using a suitable tool, applying the technique for Dynamic Analysis (@MASTG-TECH-0015) to confirm whether sensitive data is stored in plaintext. _Note: Proto DataStore files require a Proto decoder for inspection._
40
42
41
43
---
42
44
43
45
## Observation
44
46
45
47
The output should indicate:
48
+
46
49
- which DataStore files the app creates,
47
50
- whether sensitive data (tokens, secrets, PII) is present inside these files,
48
51
- whether the stored values appear in plaintext (or easily reversible format).
@@ -52,5 +55,6 @@ The output should indicate:
52
55
## Evaluation
53
56
54
57
The test fails if:
58
+
55
59
- sensitive data is stored in DataStore files without encryption.
56
60
- plaintext tokens, secrets, or PII can be read from the DataStore files through static or dynamic analysis.
0 commit comments