Thursday, May 8, 2025
HomeAndroidAndroid Application Penetration Testing - Part 9

Android Application Penetration Testing – Part 9

Published on

SIEM as a Service

Follow Us on Google News

In Last Part, Android Application Penetration Testing Part 8 We have seen about the Attacking through Content Provider when an app wants to share data with another app.

Attacking through Android Pasteboard:

Android provides the clipboard framework for copying and pasting different types of data. The data could be text, images, binary stream data or other complex data types.

Simple text data is stored directly in the clipboard, while complex data is stored as a reference that the pasting application resolves with a content provider.

- Advertisement - Google News

Copying and pasting work both within an application and between applications that implement the framework.

In order to use a clipboard, you need to instantiate an object of ClipboardManager by calling the getSystemService() method.

“Service call clipboard” where service codes are 1, 2, and 3, for getClipboardText, setClipboardText, and hasClipboardText respectively.

Service call clipboard 2 s16 thisisinsertedtext

Consider a bank application and we are copying account number from an application

we can see all process and we can grep the process we want by using apk name

ps | grep ‘insecure’

we can get the account number which were copied by using following command

su (PID) u0_a80 service call clipboard 2 s16 (.apk name) com.android.insecurebank

We can see the input which was copied in an application. When it comes to a credit card, debit card, PIN , CVV and account number, It will be much critical.

Mitigation:

To avoid completely clipboard usage, KeePass proposes what it calls Auto-Type: it will directly fill targeted fields by simulating the appropriate key presses. The advantage is that no data ever passes through the clipboard.

When using the clipboard to copy/paste passwords, KeePass can be configured to automatically clear the clipboard after a short amount of time.

When copying a password, KeePass displays at the bottom of its main window a decreasing progress bar giving the user a visual feedback over the timeout progress, and once the timeout expires (15 or 30 seconds for instance) and if the clipboard still contains KeePass data then KeePass deletes the clipboard content (the user must not use one of those “clipboard history managers” for this to be really effective though).

Also Read :     Top 5 Best Android Hacking Apps 2017

Attacking through Android Keyboard Cache:

Android contains a user dictionary, where words entered by a user can be saved for future auto-correction. This user dictionary is available to any app without special permissions.

In the following example, we are adding username ti dictionary by selecting text

you can retrieve this information in user_dict database

you can find user_dict.db in /data/data/com.android.providers.userdictionary/databases 

by opening the database sqlite3 user_dict.db 

select * from words;  This SQL query provide you all information or words which added into ‘added to dictionary’

Mitigation:

Disable the auto-correct feature for any sensitive information, not just for password fields. Since the keyboard caches sensitive information, it may be recoverable.

For increased security, consider implementing a custom keyboard (and potentially PIN entry), which can disable caching and provide additional protection against malware.

Android Application Penetration Testing Other Parts :

Gurubaran
Gurubaran
Gurubaran is a co-founder of Cyber Security News and GBHackers On Security. He has 10+ years of experience as a Security Consultant, Editor, and Analyst in cybersecurity, technology, and communications.

Latest articles

Researchers Turn the Tables: Scamming the Scammers in Telegram’s PigButchering Scheme

Cybersecurity specialists have devised an innovative approach to combat an emerging cybercrime called "PigButchering"...

New Spam Campaign Leverages Remote Monitoring Tools to Exploit Organizations

A sophisticated spam campaign targeting Portuguese-speaking users in Brazil has been uncovered by Cisco...

New Attack Exploits X/Twitter Ad URL Feature to Deceive Users

Silent Push Threat Analysts have recently exposed a sophisticated financial scam leveraging a vulnerability...

Guess Which Browser Tops the List for Data Collection!

Google Chrome has emerged as the undisputed champion of data collection among 10 popular...

Resilience at Scale

Why Application Security is Non-Negotiable

The resilience of your digital infrastructure directly impacts your ability to scale. And yet, application security remains a critical weak link for most organizations.

Application Security is no longer just a defensive play—it’s the cornerstone of cyber resilience and sustainable growth. In this webinar, Karthik Krishnamoorthy (CTO of Indusface) and Phani Deepak Akella (VP of Marketing – Indusface), will share how AI-powered application security can help organizations build resilience by

Discussion points


Protecting at internet scale using AI and behavioral-based DDoS & bot mitigation.
Autonomously discovering external assets and remediating vulnerabilities within 72 hours, enabling secure, confident scaling.
Ensuring 100% application availability through platforms architected for failure resilience.
Eliminating silos with real-time correlation between attack surface and active threats for rapid, accurate mitigation

More like this

Android Security Update -A Critical RCE Vulnerability Actively Exploited in the Wild 

Google has released critical security patches for Android devices to address 57 vulnerabilities across...

GPUAF: Two Methods to Root Qualcomm-Based Android Phones

Security researchers have exposed critical vulnerabilities in Qualcomm GPU drivers, impacting a vast array...

SpyMax Android Spyware: Full Remote Access to Monitor Any Activity

Threat intelligence experts at Perplexity uncovered an advanced variant of the SpyMax/SpyNote family of...