exploiting-insecure-data-storage-in-mobile skill (Anthropic-Cybersecurity-Skills)
From Public Agent Wiki
Contents
- Install
- SKILL.md (verbatim)
- When to Use
- Prerequisites
- Workflow
- Step 1: Map Application Data Storage Locations
- Step 2: Extract and Analyze SharedPreferences (Android)
- Step 3: Analyze SQLite Databases
- Step 4: Inspect iOS Keychain Storage
- Step 5: Assess External Storage and Backup Exposure
- Step 6: Runtime Memory Analysis
- Key Concepts
- Tools & Systems
- Common Pitfalls
- Other files in this skill
- assets/template.md (verbatim)
- Target Application
- Storage Analysis Summary
- Detailed Findings
- Finding [N]: [TITLE]
- Recommendations
- Immediate Actions
- Short-Term Improvements
- Long-Term Architecture Changes
- references/api-reference.md (verbatim)
- OWASP Mobile Top 10 — M9: Insecure Data Storage
- Risk Areas
- Android Data Locations
- App Private Storage
- External Storage (World-Readable)
- ADB Commands
- Pull App Data
- List SharedPreferences
- Read SharedPreferences
- SQLite Analysis
- Python sqlite3
- iOS Data Locations
- App Sandbox
- Keychain
- Frida Scripts for Data Storage Audit
- Hook SharedPreferences (Android)
- Hook NSUserDefaults (iOS)
- Secure Storage Alternatives
- references/standards.md (verbatim)
- OWASP Mobile Top 10 2024 Mapping
- OWASP MASVS v2.0 - MASVS-STORAGE Controls
- NIST SP 800-163 Rev 1 - Mobile App Vetting
- CWE Mappings
- Android Keystore Best Practices
- iOS Data Protection Classes
- references/workflows.md (verbatim)
- Workflow 1: Android Data Storage Assessment
- Workflow 2: iOS Data Storage Assessment
- Decision Matrix: Data Storage Risk
What it does. 'Identifies and exploits insecure local data storage vulnerabilities Part of mukul975/Anthropic-Cybersecurity-Skills (817 security skills) (mukul975/Anthropic-Cybersecurity-Skills).
| Upstream | mukul975/Anthropic-Cybersecurity-Skills |
| Skill file | skills/exploiting-insecure-data-storage-in-mobile/SKILL.md |
| License | Apache-2.0 (skill folder LICENSE) |
| Author | mukul975 |
| Fetched | 2026-09-10 |
Install
npx skills add mukul975/Anthropic-Cybersecurity-Skills --skill exploiting-insecure-data-storage-in-mobile, or copy the skill folder into~/.claude/skills/exploiting-insecure-data-storage-in-mobile/.- Raw file:
curl -sL https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/exploiting-insecure-data-storage-in-mobile/SKILL.md
SKILL.md (verbatim)
1 placeholder credential was shortened (for example to
api_key=YOUR_KEY) to pass the site's secret filter.
name: exploiting-insecure-data-storage-in-mobile
description: 'Identifies and exploits insecure local data storage vulnerabilities
in Android and iOS mobile applications including unencrypted databases, world-readable
files, insecure SharedPreferences, plaintext credential storage, and improper keychain/keystore
usage. Use when performing mobile penetration testing focused on OWASP M9 (Insecure
Data Storage) or assessing compliance with MASVS-STORAGE requirements. Activates
for requests involving mobile data storage security, local storage exploitation,
SharedPreferences analysis, or mobile data leakage assessment.
'
domain: cybersecurity
subdomain: mobile-security
author: mahipal
tags:
- mobile-security
- android
- ios
- data-storage
- owasp-mobile
- penetration-testing
version: 1.0.0
license: Apache-2.0
atlas_techniques:
- AML.T0057
nist_ai_rmf:
- MEASURE-2.7
- MAP-5.1
- MANAGE-2.4
- GOVERN-1.1
- GOVERN-4.2
nist_csf:
- PR.PS-01
- PR.AA-05
- ID.RA-01
- DE.CM-09
mitre_attack:
- T1059
- T1056
- T1036
- T1078
- T1003
Exploiting Insecure Data Storage in Mobile
When to Use
Use this skill when:
- Assessing whether mobile applications store sensitive data securely on the device filesystem
- Testing for credential leakage through SharedPreferences, SQLite databases, or plists
- Evaluating keychain/keystore implementation for proper access control attributes
- Performing data-at-rest security assessment during mobile penetration tests
Do not use this skill on production user devices without authorization -- data extraction techniques require physical access or root/jailbreak privileges.
Prerequisites
- Rooted Android device or emulator with ADB access
- Jailbroken iOS device with SSH access or Objection-patched IPA
- ADB (Android Debug Bridge) for Android filesystem access
- SQLite3 CLI for database inspection
- Frida/Objection for runtime data extraction
- Target application installed and exercised (logged in, data cached)
Legal Notice: This skill is for authorized security testing and educational purposes only. Unauthorized use against systems you do not own or have written permission to test is illegal and may violate computer fraud laws.
Workflow
Step 1: Map Application Data Storage Locations
Android storage paths:
# Internal storage (app-private, requires root)
/data/data/<package_name>/
├── shared_prefs/ # SharedPreferences XML files
├── databases/ # SQLite databases
├── files/ # General files
├── cache/ # Cached data
├── lib/ # Native libraries
└── app_webview/ # WebView data
# External storage (world-readable on older Android)
/sdcard/Android/data/<package_name>/
# Check for world-readable files
adb shell run-as <package_name> ls -la /data/data/<package_name>/
iOS storage paths:
# App sandbox (accessible via SSH on jailbroken device)
/var/mobile/Containers/Data/Application/<UUID>/
├── Documents/ # User data, backed up by default
├── Library/
│ ├── Preferences/ # NSUserDefaults plists
│ ├── Caches/ # Cache data
│ └── Application Support/
└── tmp/ # Temporary files
Step 2: Extract and Analyze SharedPreferences (Android)
# Pull SharedPreferences files
adb shell run-as <package_name> cat shared_prefs/*.xml
# Or on rooted device
adb pull /data/data/<package_name>/shared_prefs/ ./shared_prefs/
# Search for sensitive data
grep -ri "password\|token\|secret\|key\|session\|auth\|cookie" shared_prefs/
Common insecure storage patterns:
<!-- Plaintext credentials -->
<string name="user_password">mysecretpass123</string>
<string name="auth_token">eyJhbGciOiJIUzI1NiIs...</string>
<string name="api_key">sk-live-a...</string>
<!-- Sensitive PII -->
<string name="user_ssn">123-45-6789</string>
<string name="credit_card">4111111111111111</string>
Step 3: Analyze SQLite Databases
# Pull databases
adb pull /data/data/<package_name>/databases/ ./databases/
# Open and inspect
sqlite3 databases/app.db
.tables
.schema users
SELECT * FROM users;
SELECT * FROM sessions;
SELECT * FROM tokens;
# Search all tables for sensitive columns
sqlite3 databases/app.db ".dump" | grep -i "password\|token\|secret\|credit"
Check for unencrypted SQLCipher databases:
# If database opens without password, it's unencrypted
sqlite3 databases/app.db "SELECT count(*) FROM sqlite_master;"
# Success = unencrypted (vulnerability)
Step 4: Inspect iOS Keychain Storage
# Using Objection
objection --gadget com.target.app explore
ios keychain dump
# Check protection class attributes
# kSecAttrAccessibleWhenUnlocked - OK for most data
# kSecAttrAccessibleAlways - VULNERABLE: accessible even when locked
# kSecAttrAccessibleAfterFirstUnlock - acceptable for background apps
Step 5: Assess External Storage and Backup Exposure
Android:
# Check if backup is enabled
aapt dump badging target.apk | grep -i "allowBackup"
# android:allowBackup="true" = vulnerability
# Extract backup data
adb backup -f backup.ab -apk <package_name>
java -jar abe.jar unpack backup.ab backup.tar
tar xvf backup.tar
# Inspect extracted data for sensitive information
# Check external storage
adb shell ls -la /sdcard/Android/data/<package_name>/
iOS:
# Check backup exclusion
# Files in Documents/ are backed up by default
# Check NSURLIsExcludedFromBackupKey attribute
objection --gadget com.target.app explore
ios plist cat Info.plist
Step 6: Runtime Memory Analysis
# Dump process memory for sensitive data
objection --gadget com.target.app explore
memory search "password" --string
memory search "BEGIN RSA PRIVATE KEY" --string
memory dump all /tmp/memdump/
# Android: Check for sensitive data in logs
adb logcat -d | grep -i "password\|token\|key\|secret"
Key Concepts
| Term | Definition |
|---|---|
| SharedPreferences | Android key-value storage in XML format; often misused for storing credentials in plaintext |
| Keychain Services | iOS secure credential storage backed by Secure Enclave hardware on modern devices |
| Android Keystore | Hardware-backed cryptographic key storage on Android; keys cannot be extracted from the device |
| SQLCipher | Transparent encryption extension for SQLite databases; prevents data extraction without password |
| Data Protection API | iOS file-level encryption tied to device passcode; controlled via protection class attributes |
Tools & Systems
- ADB (Android Debug Bridge): Command-line tool for Android device interaction and filesystem access
- Objection: Frida-powered runtime exploration for keychain dumping and memory inspection
- SQLite3: Command-line interface for inspecting unencrypted SQLite databases
- Android Backup Extractor (ABE): Tool for unpacking ADB backup files to inspect stored data
- iExplorer: GUI tool for browsing iOS app sandbox filesystem
Common Pitfalls
- Encrypted but key in code: Some apps encrypt databases but store the encryption key in SharedPreferences or hardcoded in the binary. Always check for key storage alongside encryption.
- MODE_WORLD_READABLE deprecation: This flag was deprecated in API 17, but legacy apps may still use it, making SharedPreferences readable by other apps.
- iOS backup scope: By default, all files in the Documents directory are included in iTunes/iCloud backups. Verify that sensitive files have the backup exclusion attribute set.
- Clipboard exposure: Data copied to clipboard is accessible to all apps. Check if the app copies sensitive data (passwords, tokens) to the clipboard.
Other files in this skill
- LICENSE
- assets/template.md
- references/api-reference.md
- references/standards.md
- references/workflows.md
- scripts/agent.py
- scripts/process.py
assets/template.md (verbatim)
Insecure Data Storage Assessment Report
Target Application
| Field | Value |
|---|---|
| Application | [APP_NAME] |
| Platform | [Android/iOS] |
| Package/Bundle ID | [ID] |
| Assessment Date | [DATE] |
| Device State | [Rooted/Jailbroken] |
Storage Analysis Summary
| Storage Type | Items Found | Sensitive Data | Encrypted | Risk |
|---|---|---|---|---|
| SharedPreferences/Plists | [N] | [YES/NO] | [YES/NO] | [RISK] |
| SQLite Databases | [N] | [YES/NO] | [YES/NO] | [RISK] |
| Files on Disk | [N] | [YES/NO] | [YES/NO] | [RISK] |
| Keychain/Keystore | [N] | [YES/NO] | [YES/NO] | [RISK] |
| Backup Data | [N] | [YES/NO] | [YES/NO] | [RISK] |
Detailed Findings
Finding [N]: [TITLE]
- Severity: [CRITICAL/HIGH/MEDIUM/LOW]
- OWASP Mobile: M9 - Insecure Data Storage
- CWE: [CWE-ID]
- Storage Location: [PATH]
- Data Type: [credentials/PII/tokens/keys]
- Encrypted: [YES/NO]
- Evidence: [SANITIZED_SAMPLE]
- Recommendation: [REMEDIATION]
Recommendations
Immediate Actions
- [RECOMMENDATION]
Short-Term Improvements
- [RECOMMENDATION]
Long-Term Architecture Changes
- [RECOMMENDATION]
references/api-reference.md (verbatim)
API Reference: Insecure Mobile Data Storage Detection
OWASP Mobile Top 10 — M9: Insecure Data Storage
Risk Areas
| Storage Type | Platform | Risk |
|---|---|---|
| SharedPreferences | Android | HIGH (plaintext XML) |
| SQLite databases | Both | CRITICAL if unencrypted |
| Keychain (improper) | iOS | MEDIUM |
| External storage | Android | HIGH (world-readable) |
| Plist files | iOS | HIGH (plaintext) |
Android Data Locations
App Private Storage
/data/data/<package>/shared_prefs/ # SharedPreferences XML
/data/data/<package>/databases/ # SQLite databases
/data/data/<package>/files/ # App files
/data/data/<package>/cache/ # Cache data
External Storage (World-Readable)
/sdcard/Android/data/<package>/
ADB Commands
Pull App Data
adb pull /data/data/com.target.app/ ./extracted/
List SharedPreferences
adb shell run-as com.target.app ls /data/data/com.target.app/shared_prefs/
Read SharedPreferences
adb shell run-as com.target.app cat shared_prefs/credentials.xml
SQLite Analysis
Python sqlite3
import sqlite3
conn = sqlite3.connect("app.db")
cursor = conn.cursor()
cursor.execute("SELECT name FROM sqlite_master WHERE type='table'")
for table in cursor.fetchall():
cursor.execute(f"PRAGMA table_info({table[0]})")
print(cursor.fetchall())
iOS Data Locations
App Sandbox
/var/mobile/Containers/Data/Application/<UUID>/
Documents/
Library/Preferences/ # NSUserDefaults (plist)
Library/Caches/
tmp/
Keychain
# Using keychain-dumper
./keychain-dumper -a
Frida Scripts for Data Storage Audit
Hook SharedPreferences (Android)
Java.perform(function() {
var sp = Java.use("android.app.SharedPreferencesImpl$EditorImpl");
sp.putString.implementation = function(key, value) {
console.log("SharedPrefs PUT: " + key + " = " + value);
return this.putString(key, value);
};
});
Hook NSUserDefaults (iOS)
var NSUserDefaults = ObjC.classes.NSUserDefaults;
var orig = NSUserDefaults["- setObject:forKey:"];
Interceptor.attach(orig.implementation, {
onEnter: function(args) {
console.log("NSUserDefaults: " + ObjC.Object(args[3]) + " = " + ObjC.Object(args[2]));
}
});
Secure Storage Alternatives
| Platform | Secure Method |
|---|---|
| Android | EncryptedSharedPreferences, Android Keystore |
| iOS | Keychain Services with kSecAttrAccessible |
| Both | SQLCipher for encrypted databases |
references/standards.md (verbatim)
Standards Reference: Insecure Data Storage in Mobile
OWASP Mobile Top 10 2024 Mapping
| OWASP ID | Risk | Data Storage Relevance |
|---|---|---|
| M1 | Improper Credential Usage | Hardcoded credentials in SharedPreferences, plists, databases |
| M6 | Inadequate Privacy Controls | PII stored unencrypted, accessible via backup extraction |
| M8 | Security Misconfiguration | allowBackup=true, world-readable files, missing encryption |
| M9 | Insecure Data Storage | Primary focus: all local storage vulnerabilities |
| M10 | Insufficient Cryptography | Weak encryption of local databases, hardcoded keys |
OWASP MASVS v2.0 - MASVS-STORAGE Controls
| Control | Description | Test Method |
|---|---|---|
| MASVS-STORAGE-1 | App securely stores sensitive data | Inspect SharedPreferences, keychain, databases |
| MASVS-STORAGE-2 | App prevents sensitive data leakage | Check logs, clipboard, backups, screenshots |
NIST SP 800-163 Rev 1 - Mobile App Vetting
- Section 4.3.1: Data storage analysis for sensitive information at rest
- Section 4.3.2: Verification of encryption implementation for stored data
- Section 5.2: Data protection requirements for enterprise mobile apps
CWE Mappings
| CWE ID | Title | Storage Type |
|---|---|---|
| CWE-312 | Cleartext Storage of Sensitive Information | SharedPreferences, plists, SQLite |
| CWE-316 | Cleartext Storage in Memory | Process memory, clipboard |
| CWE-359 | Exposure of Private Personal Information | PII in unencrypted databases |
| CWE-522 | Insufficiently Protected Credentials | Passwords in SharedPreferences |
| CWE-532 | Information Exposure Through Log Files | Sensitive data in logcat/syslog |
| CWE-921 | Storage of Sensitive Data in Unprotected Mechanism | External storage, world-readable |
| CWE-922 | Insecure Storage of Sensitive Information | General insecure storage |
Android Keystore Best Practices
| Practice | Secure | Insecure |
|---|---|---|
| Key storage | Android Keystore (hardware-backed) | Hardcoded in APK or SharedPreferences |
| Database encryption | SQLCipher with Keystore-derived key | Unencrypted SQLite |
| Shared Preferences | EncryptedSharedPreferences (Jetpack) | MODE_PRIVATE without encryption |
| File encryption | AES-256-GCM with Keystore key | Plaintext files in internal storage |
iOS Data Protection Classes
| Class | When Accessible | Use Case |
|---|---|---|
| NSFileProtectionComplete | Only when unlocked | Highly sensitive data |
| NSFileProtectionCompleteUnlessOpen | While open/unlocked | Files written in background |
| NSFileProtectionCompleteUntilFirstUserAuthentication | After first unlock | Background-accessible data |
| NSFileProtectionNone | Always | Non-sensitive cached data |
references/workflows.md (verbatim)
Workflows: Exploiting Insecure Data Storage in Mobile
Workflow 1: Android Data Storage Assessment
[Install & exercise app] --> [Root/ADB access] --> [Extract internal storage]
|
+------------------+------------------+
| | |
[SharedPreferences] [SQLite DBs] [File system]
[Grep for secrets] [Open & query] [Check permissions]
[Check encryption] [Check SQLCipher] [External storage]
| | |
+------------------+------------------+
|
[Backup extraction]
[ADB backup test]
|
[Memory analysis]
[Logcat review]
|
[Report findings]
Workflow 2: iOS Data Storage Assessment
[Install & exercise app] --> [Jailbreak/Objection] --> [Extract sandbox data]
|
+------------------+------------------+
| | |
[Keychain dump] [Plist analysis] [SQLite DBs]
[Protection class] [NSUserDefaults] [Core Data]
[Access control] [Sensitive values] [Encryption check]
| | |
+------------------+------------------+
|
[Backup inclusion check]
[Memory string search]
[Clipboard monitoring]
|
[Report findings]
Decision Matrix: Data Storage Risk
| Storage Mechanism | Encrypted | Access Restricted | Backup Excluded | Risk Level |
|---|---|---|---|---|
| SharedPreferences (plaintext) | No | App-only | No | CRITICAL |
| EncryptedSharedPreferences | Yes | App-only | Depends | LOW |
| SQLite (no SQLCipher) | No | App-only | No | HIGH |
| SQLCipher (key in code) | Yes* | App-only | No | MEDIUM |
| Android Keystore | Yes | Hardware-backed | N/A | LOW |
| iOS Keychain (kSecAttrAccessibleAlways) | Yes | Always accessible | N/A | MEDIUM |
| iOS Keychain (complete protection) | Yes | When unlocked only | N/A | LOW |
| External storage | No | World-readable | N/A | CRITICAL |
Back to mukul975/Anthropic-Cybersecurity-Skills (817 security skills) or Agent skills.