owasp.sat.agoat

`dex#1:strings` contains a value matching the pattern for AWS access key ID. It is a string literal in compiled DEX bytecode (Java / Kotlin source). DEX strings are extracted in seconds with `apktool` / `baksmali` — the bytecode form does not hide them. Anyone with the APK has this credential.

`void owasp.sat.agoat.InputValidationsWebViewURLActivity.onCreate$lambda$0(WebView, EditText, View)` calls `WebSettings.setAllowUniversalAccessFromFileURLs(true)` (or `WebView.setAllowUniversalAccessFromFileURLs(true)`). Bridges the SOP entirely from `file://` to ANY origin. JS in a local HTML file can read `https://accounts.google.com` if the user is logged in. The single most dangerous WebView setting.

`android:debuggable="true"` is set on `<application>`. Debug builds expose JDWP, allow attaching a debugger to any process, and bypass platform tamper-detection paths — a release APK in this state is trivially modifiable on any unrooted device.

`void owasp.sat.agoat.BioMetricAuthActivity.onCreate$lambda$0(BioMetricAuthActivity, View)` calls the EVENT-BOUND `BiometricPrompt.authenticate(...)` overload — confirmed from the callsite's target descriptor, which carries no `CryptoObject`. The result is purely a success-callback fire, not a key-unlock: an attacker who can hook the success path on a rooted device bypasses the check entirely. The result-bound overload takes a `CryptoObject` (wrapping a `Cipher`, `Mac`, or `Signature` whose key requires biometric auth to unlock), which this call does not.

`<base-config cleartextTrafficPermitted="true">` permits unencrypted HTTP for any domain that doesn't have a more specific override. Any host the app talks to over HTTP is observable and modifiable on the network path.

The field `aws_secret_access_key` in `owasp.sat.agoat.CloudServicesActivity` is initialised in the constructor with a hardcoded AWS secret access key `OviCwsFNWeoCSDKl3ZoD8j4BPnc1kCsfV+lOABCw`. The value is baked into the DEX and extractable by anyone with the APK (`apktool` + `grep`); combined with the app's access-key ID it grants direct programmatic access to the AWS account with whatever IAM permissions that key carries (CWE-798: use of hard-coded credentials).

The certificate's Common Name matches the Android SDK's well-known debug key. Production builds signed with this key share an identity with every other `android-debug-key`-signed app — the package signature no longer uniquely identifies your release, breaking signature-permission models, KeyStore key separation, and Play Store upload verification.

`<trust-anchors><certificates src="user"/></trust-anchors>` in `base-config` makes the app trust any CA the user has installed on the device. Attackers and corporate MITM boxes typically install their own CAs to inspect TLS traffic; this configuration opts the app into being intercepted.

`void owasp.sat.agoat.InputValidationsWebViewURLActivity.onCreate$lambda$0(WebView, EditText, View)` calls `WebSettings.setAllowFileAccess(true)` (or `WebView.setAllowFileAccess(true)`). JavaScript loaded via `file://` URIs can read other `file://` URIs (the entire app's filesystem reachable through the WebView). Pre-API 30 this was the default; modern Android defaults it off.

`void owasp.sat.agoat.InputValidationsWebViewURLActivity.onCreate$lambda$0(WebView, EditText, View)` calls `WebSettings.setAllowFileAccessFromFileURLs(true)` (or `WebView.setAllowFileAccessFromFileURLs(true)`). Bridges the WebView's same-origin policy across `file://` URIs — JS in one local HTML file can XHR another local file. Ostensibly useful for local single-page apps but a vector for exfiltrating local data.

`void owasp.sat.agoat.BioMetricAuthActivity.onCreate(Bundle)` calls `setNegativeButtonText`, which on `BiometricPrompt` offers the user a fallback path out of the biometric ceremony (typically a PIN/pattern entry, or a `cancel` that lets the app fall back to a plaintext flow). On many apps the fallback drops the cryptographic binding entirely — the fingerprint check becomes a UX nicety rather than a security control.

The activity `owasp.sat.agoat.AccessControl1ViewActivity` is exported (or implicitly exported via its intent-filter) and declares no `android:permission` to gate access. Any other app on the device can launch / bind to / call into it without consent.

The provider `owasp.sat.agoat.ContentProviderActivity` is exported (or implicitly exported via its intent-filter) and declares no `android:permission` to gate access. Any other app on the device can launch / bind to / call into it without consent.

The receiver `owasp.sat.agoat.ShowDataReceiver` is exported (or implicitly exported via its intent-filter) and declares no `android:permission` to gate access. Any other app on the device can launch / bind to / call into it without consent.

The service `owasp.sat.agoat.DownloadInvoiceService` is exported (or implicitly exported via its intent-filter) and declares no `android:permission` to gate access. Any other app on the device can launch / bind to / call into it without consent.

Activity `owasp.sat.agoat.InsecureStorageSDCardActivity` (matched the 'card entry' naming pattern) does not set `WindowManager.LayoutParams.FLAG_SECURE` — neither directly nor via any class in its superclass chain (`InsecureStorageSDCardActivity -> AppCompatActivity -> FragmentActivity -> ComponentActivity -> ComponentActivity -> Activity`). The screen will be captured by OS screenshots, retained in the recents thumbnail cache (so another app, or anyone with momentary device access, can see the last frame after the user backgrounds the app), and recordable by any `MediaProjection`-based screen recorder. For a screen handling card entry, that exposure is a credible data-leak path.

`void owasp.sat.agoat.InputValidationsWebViewURLActivity.onCreate$lambda$0(WebView, EditText, View)` feeds `WebView.loadUrl` data the taint analyzer traces back to a user-controlled input field (`getText()` on a text widget). A value the user types (or that is injected into the field) reaching a WebView content loader — an injection primitive. Static analysis can't confirm the value is unvalidated or the component reachable; the `requires_review: true` evidence flag marks the callsite for manual triage.

`String owasp.sat.agoat.AccessControlIssue1Activity.hashPIN(String)` calls `MessageDigest.getInstance("MD5")`. The requested algorithm is broken — chosen-prefix collisions in seconds on commodity hardware. Static analysis cannot tell whether this code path handles security-relevant data, but the safe default is to assume it does — the cost of switching to a modern primitive is minimal compared to a single confirmed vulnerability.

`void owasp.sat.agoat.InputValidationsWebViewURLActivity.onCreate$lambda$0(WebView, EditText, View)` calls `WebSettings.setAllowContentAccess(true)` (or `WebView.setAllowContentAccess(true)`). Permits the WebView to load `content://` URIs from ContentProviders the app has access to. Less dangerous than the file-URL flags but still a privilege escalation if the WebView loads attacker-controlled HTML.

`android:allowBackup="true"` lets `adb backup` extract the app's private data on a debug-bridged device, and (on Android <12) lets Auto Backup ship the same data to the user's Google Drive — tokens and credentials in `shared_prefs/` / `databases/` ride along. `android:fullBackupContent and dataExtractionRules` are not declared, so that backup path is unscoped and captures everything by default.

No reference to `Debug.isDebuggerConnected`, `PackageManager.checkSignatures`, or other classic tamper-detection APIs. For apps handling sensitive data MASVS-RESILIENCE expects at least one active-debugger check + a signature self-check.

Of 477 app-owned classes (excluding framework / AndroidX / Kotlin / Google Play / OkHttp / Retrofit / RxJava / similar curated-out packages), only 0% carry single-character simple names — the share R8 / ProGuard typically produces. Class, method, and field names are intact, which gives a reverse engineer a free map of your business logic and accelerates RE of any custom anti-tamper / crypto / licensing code shipped with the app.