From meta
Detects sensitive data stored insecurely on mobile devices (Android/iOS). Trigger on: SharedPreferences, NSUserDefaults, SQLite, Room DB, DataStore, Core Data, Keychain misconfiguration, external storage, backup exposure, plaintext files, unencrypted databases, adb backup, iCloud backup, NSFileProtection, EncryptedSharedPreferences, SQLCipher, allowBackup, FLAG_SECURE, keyboard cache, sensitive logs. Covers MASVS-STORAGE-1 (local storage) and MASVS-STORAGE-2 (exposure to unauthorized actors).
npx claudepluginhub securityfortech/hacking-skills --plugin metaThis skill uses the workspace's default tool permissions.
Mobile apps often store sensitive data (credentials, tokens, PII, keys) in locations accessible to other apps, backups, or physical device extraction. Android's SharedPreferences and iOS's NSUserDefaults are plaintext XML/plist files readable with root/jailbreak. External storage is world-readable. Backups (ADB/iCloud) can expose the entire app sandbox unless explicitly excluded. Logging APIs p...
Guides Next.js Cache Components and Partial Prerendering (PPR) with cacheComponents enabled. Implements 'use cache', cacheLife(), cacheTag(), revalidateTag(), static/dynamic optimization, and cache debugging.
Guides building MCP servers enabling LLMs to interact with external services via tools. Covers best practices, TypeScript/Node (MCP SDK), Python (FastMCP).
Generates original PNG/PDF visual art via design philosophy manifestos for posters, graphics, and static designs on user request.
Mobile apps often store sensitive data (credentials, tokens, PII, keys) in locations accessible to other apps, backups, or physical device extraction. Android's SharedPreferences and iOS's NSUserDefaults are plaintext XML/plist files readable with root/jailbreak. External storage is world-readable. Backups (ADB/iCloud) can expose the entire app sandbox unless explicitly excluded. Logging APIs persist sensitive data in system logs readable by other apps. The attacker gains access to credentials or session tokens without ever touching the backend.
allowBackup="true" in AndroidManifest.xml without fullBackupContent exclusion rules/data/data/<pkg>/shared_prefs/ containing tokens, passwords, or keys/sdcard/ or getExternalStorageDirectory() containing sensitive contentNSFileProtectionComplete data protection classkSecAttrAccessibleAlways or no accessibility constraintsLog.d, NSLog, print) containing session tokens or user datainputType="textPassword" or secureTextEntry=trueAndroid:
apktool d app.apk — review AndroidManifest.xml for allowBackup, fullBackupContentadb backup -f backup.ab -noapk <pkg> → extract with android-backup-extractor/data/data/<pkg>/ (rooted): shared_prefs/, databases/, files/sqlite3 app.db .dump — look for unencrypted sensitive tablesgrep -r "getExternalStorage" in decompiled sourceadb logcat | grep -i "password\|token\|secret\|key"android hooking list activities → android clipboard monitoriOS:
ideviceinstaller to pull app sandbox dataobjection --gadget TARGET run ios filesystem list<uuid>.plist in Library/Preferencesobjection run ios keychain dumpNSFileManager writeToFile to observe Data Protection class used# Android — pull and extract backup
adb backup -f backup.ab -noapk TARGET_PKG
java -jar abe.jar unpack backup.ab backup.tar
tar xvf backup.tar
# Android — inspect SharedPreferences (rooted)
adb shell "cat /data/data/TARGET_PKG/shared_prefs/*.xml"
# Android — check logcat for leaks
adb logcat | grep -iE "password|token|secret|api.?key|session|auth"
# iOS — Frida: dump NSUserDefaults
frida -U TARGET -e "ObjC.classes.NSUserDefaults.standardUserDefaults().dictionaryRepresentation()"
# iOS — objection: keychain dump
objection --gadget TARGET run ios keychain dump
# iOS — check Data Protection class
frida -U TARGET -l data_protection_check.js
allowBackup=truekSecAttrAccessibleWhenPasscodeSetThisDeviceOnly survive device-to-device migrationgcore or Frida memory scanneradb logcat -d captures prior log buffer; sensitive data logged before crash is preservedScenario 1 — ADB Backup Token Theft
Setup: App stores JWT in SharedPreferences, allowBackup=true. → Trigger: Attacker with USB access runs adb backup. → Impact: Extracts valid session token, authenticates to backend as victim.
Scenario 2 — External Storage Credential Exposure
Setup: App writes exported reports to getExternalStorageDirectory(). → Trigger: Malicious app with READ_EXTERNAL_STORAGE reads the files. → Impact: PII and embedded tokens from reports leaked to third-party app.
Scenario 3 — iOS Keychain Accessible After Reboot
Setup: App stores password in Keychain with kSecAttrAccessibleAlways. → Trigger: Attacker with physical device access extracts Keychain via jailbreak. → Impact: Password retrieved even when device is locked/rebooted.
// Android — encrypted SharedPreferences
val masterKey = MasterKey.Builder(context).setKeyScheme(MasterKey.KeyScheme.AES256_GCM).build()
val prefs = EncryptedSharedPreferences.create(context, "secure_prefs", masterKey,
EncryptedSharedPreferences.PrefKeyEncryptionScheme.AES256_SIV,
EncryptedSharedPreferences.PrefValueEncryptionScheme.AES256_GCM)
// Android — exclude from backup
// res/xml/backup_rules.xml
// <exclude domain="sharedpref" path="." />
// iOS — Keychain with strict access control
let access = SecAccessControlCreateWithFlags(nil, kSecAttrAccessibleWhenPasscodeSetThisDeviceOnly,
.userPresence, nil)
// iOS — exclude file from backup
var url = URL(fileURLWithPath: sensitiveFilePath)
try url.setResourceValues({ v in v.isExcludedFromBackup = true }())
[[mobile-weak-crypto]] is the direct mitigation path: data that must be stored locally should be protected using properly implemented cryptography with keys in the Android Keystore or iOS Secure Enclave. [[mobile-auth-bypass]] overlaps when insecure storage holds auth tokens — a stolen JWT from SharedPreferences enables direct backend access without triggering biometric checks. [[mobile-resilience]] controls (root/jailbreak detection) are the last line of defense if storage protections fail, since extraction typically requires root or jailbreak access.