Android SAST Agent

Static Application Security Testing for Android applications (APK files).

Overview

Agent Name: AndroidSASTAgent Scan Type: android Credit Cost: 1 credit Target Types: APK files, Android source code

Capabilities

APK decompilation and analysis
Manifest permission review
Insecure data storage detection
Weak cryptography identification
WebView vulnerability detection
Certificate pinning assessment
Hardcoded secrets detection
Third-party library vulnerabilities

Usage


# Analyze APK file
alprina scan ./app.apk --type android
 
# Comprehensive analysis
alprina scan ./app.apk --type android --profile comprehensive
 
# API usage
curl -X POST https://api.alprina.com/v1/scan/android \
  -H "Authorization: Bearer YOUR_API_KEY" \
  -d '{
    "target": "./app.apk",
    "options": {
      "decompile": true,
      "check_permissions": true,
      "check_crypto": true
    }
  }'

What It Detects

Data Storage Issues
- Unencrypted SharedPreferences
- Insecure file storage
- SQL injection in databases
- Exposed content providers
Cryptography Problems
- Weak encryption algorithms
- Hardcoded encryption keys
- Improper certificate validation
- Missing certificate pinning
Permission Issues
- Excessive permissions
- Dangerous permissions without justification
- Custom permission vulnerabilities
WebView Vulnerabilities
- JavaScript enabled unnecessarily
- File access enabled
- Mixed content
- SSL errors ignored

Example Output


{
  "scan_id": "scan_android303",
  "agent": "AndroidSASTAgent",
  "app_info": {
    "package_name": "com.example.app",
    "version": "1.2.3",
    "min_sdk": 21,
    "target_sdk": 33
  },
  "findings": [
    {
      "severity": "high",
      "category": "data_storage",
      "title": "Sensitive Data Stored in SharedPreferences",
      "description": "User credentials stored without encryption",
      "file": "MainActivity.java",
      "line": 156,
      "code_snippet": "prefs.edit().putString(\"password\", password).apply();",
      "recommendation": "Use EncryptedSharedPreferences from AndroidX Security library"
    }
  ],
  "permissions": {
    "dangerous": ["READ_CONTACTS", "ACCESS_FINE_LOCATION"],
    "normal": ["INTERNET", "ACCESS_NETWORK_STATE"]
  }
}

Best Practices

1. Scan Before Release


# CI/CD integration
alprina scan ./app/build/outputs/apk/release/app-release.apk \
  --type android \
  --fail-on high

2. Fix Common Issues

Insecure Storage:


// Bad
val prefs = context.getSharedPreferences("prefs", MODE_PRIVATE)
prefs.edit().putString("token", apiToken).apply()
 
// Good
val masterKey = MasterKey.Builder(context)
    .setKeyScheme(MasterKey.KeyScheme.AES256_GCM)
    .build()
val encryptedPrefs = EncryptedSharedPreferences.create(
    context,
    "secure_prefs",
    masterKey,
    EncryptedSharedPreferences.PrefKeyEncryptionScheme.AES256_SIV,
    EncryptedSharedPreferences.PrefValueEncryptionScheme.AES256_GCM
)
encryptedPrefs.edit().putString("token", apiToken).apply()

3. Review Permissions


<!-- Only request necessary permissions -->
<uses-permission android:name="android.permission.INTERNET" />
<!-- Avoid dangerous permissions when possible -->

Compliance

Helps meet:

OWASP MASVS - Mobile Application Security Verification Standard
Google Play Security - App security requirements
PCI DSS - Mobile payment security