Damn Vulnerable Android Application by Security Compass - Lab 4 Secure Logging

Lab 4 Secure Logging

Welcome back friends, Today we're gonna have a look on lab 4 Secure Logging from Damn Vulnerable Android Application by Security Compass series.

Some times developers log the info about application to the android log, this some times contains sensitive information of an application.

So in this lab we are gonna test this flaw on the vulnerable app, for this we have use adb logcat.

Now after starting the logcat we have to browse through the app or have to make some activity like fund transfer etc. and then we need to check the logs for some sensitive info.

We juz tried to check the account balance.

and we got this in logs

After this we tried for fund transfer

We got this in Logs

Solution:

Developer should be very carefull about what he is logging about the app. He should refrain from logging any sensitive information like session keys etc.