saint-graves/sica-fondt
1
0
Fork 0
mirror of https://github.com/SHOGGOTH-SECTOR/sica-fondt.git synced 2026-08-01 08:30:20 +00:00
Code Issues Packages Projects Releases Wiki Activity
sica-fondt/knowledge/cyber-skills/skills/exploiting-insecure-data-storage-in-mobile/references/api-reference.md
Claude 24f816b6a3
Consolidate 22 sibling repos into layered organism structure 
Place useful parts of the surrounding repos into sica-fondt by layer, per the
body model (Ada = membrane; brain/endocrine/capabilities/knowledge non-Ada):

- brain/        LLM reasoning + providers (dapr, hermes, MoMoA)
- capabilities/ REPRAG sidecars: hermes tools/skills, dapr tools, parallel
                dispatch, A51 channels, and the OSINT cluster
- knowledge/    LORAG corpus: 754 cyber-skills, agency personas, secure-coding,
                MITRE ATT&CK data
- reference/    defensive threat-reference (C3, shhbruh doc) + AdaYaml parser

License handling: AGPL sources (worldosint, advanced_evolution, mercury,
Reticulum) and GPL DeTTECT are SPEC-only clean-room/port descriptions — no
copyleft code copied. MIT/Apache/data parts copied as working trees.

Safety: shhbruh escape/persistence material and C3 covert-C2 kept as reference
only, not wired into the running organism. See CONSOLIDATION.md.

https://claude.ai/code/session_01UehUqEXXJJCsHoA4voCU5c
2026-06-10 06:53:01 +00:00

2.6 KiB
Raw Blame History

API Reference: Insecure Mobile Data Storage Detection

OWASP Mobile Top 10 — M9: Insecure Data Storage

Risk Areas

Storage Type Platform Risk
SharedPreferences Android HIGH (plaintext XML)
SQLite databases Both CRITICAL if unencrypted
Keychain (improper) iOS MEDIUM
External storage Android HIGH (world-readable)
Plist files iOS HIGH (plaintext)

Android Data Locations

App Private Storage

/data/data/<package>/shared_prefs/    # SharedPreferences XML
/data/data/<package>/databases/        # SQLite databases
/data/data/<package>/files/            # App files
/data/data/<package>/cache/            # Cache data

External Storage (World-Readable)

/sdcard/Android/data/<package>/

ADB Commands

Pull App Data

adb pull /data/data/com.target.app/ ./extracted/

List SharedPreferences

adb shell run-as com.target.app ls /data/data/com.target.app/shared_prefs/

Read SharedPreferences

adb shell run-as com.target.app cat shared_prefs/credentials.xml

SQLite Analysis

Python sqlite3

import sqlite3
conn = sqlite3.connect("app.db")
cursor = conn.cursor()
cursor.execute("SELECT name FROM sqlite_master WHERE type='table'")
for table in cursor.fetchall():
    cursor.execute(f"PRAGMA table_info({table[0]})")
    print(cursor.fetchall())

iOS Data Locations

App Sandbox

/var/mobile/Containers/Data/Application/<UUID>/
    Documents/
    Library/Preferences/     # NSUserDefaults (plist)
    Library/Caches/
    tmp/

Keychain

# Using keychain-dumper
./keychain-dumper -a

Frida Scripts for Data Storage Audit

Hook SharedPreferences (Android)

Java.perform(function() {
    var sp = Java.use("android.app.SharedPreferencesImpl$EditorImpl");
    sp.putString.implementation = function(key, value) {
        console.log("SharedPrefs PUT: " + key + " = " + value);
        return this.putString(key, value);
    };
});

Hook NSUserDefaults (iOS)

var NSUserDefaults = ObjC.classes.NSUserDefaults;
var orig = NSUserDefaults["- setObject:forKey:"];
Interceptor.attach(orig.implementation, {
    onEnter: function(args) {
        console.log("NSUserDefaults: " + ObjC.Object(args[3]) + " = " + ObjC.Object(args[2]));
    }
});

Secure Storage Alternatives

Platform Secure Method
Android EncryptedSharedPreferences, Android Keystore
iOS Keychain Services with kSecAttrAccessible
Both SQLCipher for encrypted databases