From 5960a4154bca57496710e4765a8fce174327e62c Mon Sep 17 00:00:00 2001 From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com> Date: Sat, 7 Mar 2026 12:26:05 +0000 Subject: [PATCH 1/2] Initial plan From a0269001fd25f83469d1483732c4275a5306bd10 Mon Sep 17 00:00:00 2001 From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com> Date: Sat, 7 Mar 2026 12:28:49 +0000 Subject: [PATCH 2/2] Update MASTG-TECH-0142 with direct file system inspection methods and update related tests/demos Co-authored-by: cpholguera <29175115+cpholguera@users.noreply.github.com> --- .../MASTG-DEMO-0082/MASTG-DEMO-0082.md | 2 +- techniques/android/MASTG-TECH-0142.md | 54 ++++++++++++++++++- .../android/MASVS-PLATFORM/MASTG-TEST-0320.md | 2 +- 3 files changed, 54 insertions(+), 4 deletions(-) diff --git a/demos/android/MASVS-PLATFORM/MASTG-DEMO-0082/MASTG-DEMO-0082.md b/demos/android/MASVS-PLATFORM/MASTG-DEMO-0082/MASTG-DEMO-0082.md index df05dec4133..6f57e29f949 100644 --- a/demos/android/MASVS-PLATFORM/MASTG-DEMO-0082/MASTG-DEMO-0082.md +++ b/demos/android/MASVS-PLATFORM/MASTG-DEMO-0082/MASTG-DEMO-0082.md @@ -25,7 +25,7 @@ The sensitive data is stored using `localStorage.setItem` in the inline HTML loa 4. Click the **Start** button in the app 5. Wait for the Frida script to capture the WebView cleanup calls 6. Stop the script by quitting the Frida CLI -7. Use @MASTG-TECH-0002 to search the contents of the `/data/data//app_webview/` directory for the sensitive data used in the WebView. +7. Use @MASTG-TECH-0142 to search the contents of the `/data/data//app_webview/` directory for the sensitive data used in the WebView. {{ script.js # run.sh }} diff --git a/techniques/android/MASTG-TECH-0142.md b/techniques/android/MASTG-TECH-0142.md index a74f3c823fe..242909422af 100644 --- a/techniques/android/MASTG-TECH-0142.md +++ b/techniques/android/MASTG-TECH-0142.md @@ -3,6 +3,56 @@ title: Inspecting WebView Storage platform: android --- -To inspect WebView Storage, first follow the steps in official ["Remote debugging WebViews" documentation](https://developer.chrome.com/docs/devtools/remote-debugging/webviews) to connect Chrome DevTools to the WebView of your app. +You can inspect WebView storage either directly on the device file system or using Chrome DevTools. @MASTG-KNOW-0018 describes the different storage areas and what to expect in each. -With the DevTools open, navigate to the Application tab. In the Storage section, you can inspect the different storage areas of the WebView. +## Direct File System Inspection + +Android WebView stores its data in the `/data/data//app_webview/` directory. You can access and retrieve the contents of this directory using @MASTG-TECH-0002: + +- **Using @MASTG-TOOL-0004**: Pull the directory directly with `adb pull`: + + ```bash + adb pull /data/data//app_webview/ ./app_webview/ + ``` + + You can then inspect the contents locally. To search for specific data without pulling the directory, use `adb shell`: + + ```bash + adb shell grep -r "" /data/data//app_webview/ + ``` + + !!! note + This requires either a rooted device or a debuggable app. On a non-rooted device with a non-debuggable app, `adb` won't have access to the app's private data directory. + +- **Using @MASTG-TOOL-0007**: Open the Device File Explorer in Android Studio via **View** -> **Tool Windows** -> **Device File Explorer** and navigate to `/data/data//app_webview/`. You can then browse and download files directly from the UI. + + !!! note + This requires either a rooted device or a debuggable app. + +- **Using @MASTG-TOOL-0038**: Connect to the app with objection and navigate to the `app_webview` directory to list and download files: + + ```bash + objection -g explore + ``` + + ```bash + # Navigate to the app_webview directory + cd app_webview + + # List contents + ls + + # Download a specific file + filesystem download + + # Download the entire directory + filesystem download app_webview ./app_webview --folder + ``` + + This approach works without requiring a rooted device and without setting the app as debuggable. + +## Using Chrome DevTools + +To inspect WebView storage interactively, first follow the steps in the official ["Remote debugging WebViews" documentation](https://developer.chrome.com/docs/devtools/remote-debugging/webviews) to connect Chrome DevTools to the WebView of your app. + +With the DevTools open, navigate to the **Application** tab. In the **Storage** section, you can inspect the different storage areas of the WebView. diff --git a/tests-beta/android/MASVS-PLATFORM/MASTG-TEST-0320.md b/tests-beta/android/MASVS-PLATFORM/MASTG-TEST-0320.md index c313799ba19..7534a1eeda5 100644 --- a/tests-beta/android/MASVS-PLATFORM/MASTG-TEST-0320.md +++ b/tests-beta/android/MASVS-PLATFORM/MASTG-TEST-0320.md @@ -34,7 +34,7 @@ This test uses dynamic analysis to monitor the relevant API calls and file syste 3. Open the app. 4. Use the app extensively to ensure that all relevant WebViews are covered and that sensitive data is loaded into them. Ensure you keep a list of the sensitive data you expect to be cleaned up. 5. Close the app. -6. Use @MASTG-TECH-0002 to pull the contents of the `/data/data//app_webview/` directory or simply search for the sensitive data used in the WebView within that directory. +6. Use @MASTG-TECH-0142 to inspect the contents of the `/data/data//app_webview/` directory or simply search for the sensitive data used in the WebView within that directory. ## Observation