Scribd
Upload
10 views9 pages

VAPTPoints Status

The document outlines various security vulnerabilities found in a mobile application, including issues such as lack of SSL pinning, insecure logging, and insufficient session expiration. It also highlights the presence of deprecated TLS protocols and insecure data storage practices. The severity of these vulnerabilities ranges from critical to low, with several issues marked as pending resolution.

Uploaded by

ve00ym467
Copyright
© © All Rights Reserved
We take content rights seriously. If you suspect this is your content, claim it here.
Available Formats
Download as XLSX, PDF, TXT or read online on Scribd
10 views9 pages

VAPTPoints Status

The document outlines various security vulnerabilities found in a mobile application, including issues such as lack of SSL pinning, insecure logging, and insufficient session expiration. It also highlights the presence of deprecated TLS protocols and insecure data storage practices. The severity of these vulnerabilities ranges from critical to low, with several issues marked as pending resolution.

Uploaded by

ve00ym467
Copyright
© © All Rights Reserved
We take content rights seriously. If you suspect this is your content, claim it here.
Available Formats
Download as XLSX, PDF, TXT or read online on Scribd
You are on page 1/ 9

S. No.

Oservation Point

SSL Pinning Not


1 Implemented

2 Insecure Logging

Insecure Data
3 Storage

Insufficient Session
4 Expiration

Vulnerable Version
5 (sdk)

Android Backup
6 Enabled
7 Debug Method Enabled

8 Intent Sniffing

TLS 1.1/1.0 Weak


9 Protocol

Androide Pasteboard
10 Vulnerability

database Insecure
11 Data Storage

Missing 'X-Frame-
12 Options' Header
Missing 'X-XSS-
13 Protection' Header
No Account Lockout
14 Policy
Server Leaks
Information via "X-
15 Powered-By”
Description

Certificate pinning means hard coding the certificate known to be used by


the server in the mobile application. The app can then ignore the device’s
trust store and rely on its own, and allow only SSL connections to hosts
signed with certificates stored inside the application.

Logging is a method that developers use for tracing the code and watching
warnings or errors. The Application has enabled “Debuging” to understand
the errors or issues occurred in the application. This is logging all the
sensitive information like username, cookies etc. in the logs of the
application

Insecure data Storage stores data in plain text inside the device that allow
an attacker to see the sensitive data, which is stored on client side without
proper encryption. An attacker can steal the sensitive information which is
stored on device internal or external storage. Android application store
data
in internal storage files,external storage files,shared
preference,database.hidden files ect.

Insufficient Session Expiration can occur when the session is not properly
terminated after the user uses the logout/sign out feature.

This app can be installed on a vulnerable unpatched Android version that


can be installed on an older version of android that has multiple unfixed
vulnerabilities.

The android:allowBackup attribute defines whether application data can


be backed up and restored by a user who has enabled usb debugging. If
backup flag is set to true
Debugging mode is a developer mode in Android phones that allows newly
programmed apps to be copied via USB to the device for testing.
Depending on the OS version and installed utilities, the mode must be
turned on to let developer read internal logs.

Intent sniffing is an attack vector used to capture exposed intents. In


certain cases, applications will broadcast intents and will not define any
permissions that in need to receive the intent. This can then be captured
by
a malicious application. So, passing sensitive data via Intents might
potentially be dangerous.

The remote server offers deprecated TLS 1.1/1.0 protocol which can lead to
weaknesses.

Android provides the clipboard framework for copying and pasting different
types of data. The data could be text, images, binary stream data or other
complex data types.

Insecure data Storage stores data in plain text inside the device that allow
an attacker to see the sensitive data, which is stored on client side
without proper encryption. An attacker can steal the sensitive information
which is stored on device internal or external storage. Android application
store data in internal storage files,external storage files,shared
preference,database.hidden files ect.

The X-Frame-Options HTTP response header can be used to indicate


whether or not a browser should be allowed to render a page in a <frame>
,
<iframe> , <embed> or <object> . Sites can use this to avoid click-
jacking
attacks, by ensuring that their content is not embedded into other sites.
The HTTP 'X-XSS-Protection' response header is a feature of modern
browsers that allows websites to control their XSS auditors.

It is observed that it was no account lockout policy implemented.


The most basic form of identifying a web framework is to look at the X-
Powered-By field in the HTTP response header. Many tools can be used to
fingerprint a target.
Severity Status Remark/Issue

Critical Done

High Done

High Done

Medium Pending from Web

Medium Done

Medium Done
Medium Done

Medium Confirmation Required

Medium Pending from Web

Medium Done

Medium Done App Size increased to 94 MB

Low Pending from Web

Low Pending from Web

Low Pending from Web


Low Pending from Web

You might also like