Tips for testing OWASP MSTG-STORAGE-5

MSTG-STORAGE-5 states right now:


When users type in input fields, the software automatically suggests data. This feature can be very useful for messaging apps. However, the keyboard cache may disclose sensitive information when the user selects an input field that takes this type of information.

Static Analysis

In the layout definition of an activity, you can define TextViews that have XML attributes. If the XML attribute android:inputType is given the value textNoSuggestions, the keyboard cache will not be shown when the input field is selected. The user will have to type everything manually.


Source Code Auditing Tip

But… wait. Are you just looking for the string ‘textNoSuggestions’ when doing static analysis? Don’t forget to also look for ‘InputType.TYPE_TEXT_FLAG_NO_SUGGESTIONS‘ as the input type can be changed dynamically from an Activity. If you are only looking at the XML attributes of Layouts, you are missing out apps that dynamically change it..

Patch coming

By the time you read this my patch to the official OWASP MSTG repository clarifying how to detect it with static analysis better is probably merged. However, you could have read it here first.

Quick notes about Azure Table Storage Injection in Windows Azure Mobile Services

One beautiful afternoon you come across the popular Azure Table Storage service during an assessment. Shit, a NoSQL service hosted on Azure. It must be secure right?Well, again it is up to the developer’s implementation and unsurprisingly, it is possible to use SQL injection (NoSQL injection?) to extract more data than intended if the developers failed at sanitizing parameters. 

How do you identify this service?

  • Look for apps sending requests to *
  • Requests sent to /tables/
  • Requests containing the operators shown next included in the request variable ‘filter’

What operators can you use to extract information?

Extract information from other tables using the following supported comparison operators:

  • eq (Equal) 
  • gt (GreaterThan)
  • ge (GreaterThanOrEqual)
  • lt (LessThan)
  • le (LessThanOrEqual) 
  • ne (NotEqual)

 I hope you find the operators reference useful and remember to stay on the hunt ;).

Querying tables and entities:

Descarga de "Detector de Puertas Traseras"

Finalmente hemos publicado la última herramienta de Websec para permitirle a usuarios checar fácilmente si su red tiene dispositivos vulnerables que pongan en riesgo su información. La herramienta checa las puertas traseras de los dispositivos más populares en MX y creemos que servirá muy bien en otros paises de LATAM. Los invitamos a descargarla!