Testing the Android Application

This document describes the testing of the Android application.

Penetration testing

As described in the Testing Plan we carried out the penetration testing of the application using Drozer, F-Secure's tool for security testing Android applications.

During the automated penetration testing, we used the following modules of Drozer:

• app.package.attacksurface
• intents.fuzzinozer

Identifying the attack surface

We identified the attack surface using the app.package.attacksurface module of drozer. It analyzed the application, and concluded that the attack surface of the application is the following:

• LoginAcivity
• MainActivity

It is consistent with the notion, that we did not define any content providers, broadcast receivers or services.

Fuzzing the attack surface

We fuzzed the intents of the attack surface using the intents.fuzzinozer module of Drozer. During the fuzzing, Drozer identified 2,226,048 potential intents worth to try, but none of the intents executed yielded any vulnerabilities in the application.

Conclusion

In conclusion all the requirements defined during the design phase are covered. The penetration test did not reveal any shortcomings of the application, we concluded that the client satisfies all of our functional- and security requirements.