Hacking AndroGoat: Hardcoding Issues

In previous part, we exploited the Android OS components to bypass screens. In this part, we put down ADB for a moment and pick up our decompiler.

Hardcoding is the bad habit of embedding sensitive data (like passwords, keys, or logic) directly into the source code. Developers often do this for “quick testing” but forget to remove it. Using Jadx-GUI, we can reverse engineer the APK and find these secrets in plain text.

1. Shopping Cart (Business Logic Leak)

Hardcoding isn’t just about passwords; it’s also about business rules. If an app validates a coupon code on the client side, users can find that code and get free stuff.

The Scenario

The “Shopping Cart” feature asks for a Promo Code to get a discount.

Open AndroGoat.apk in jadx. Navigate to the AndroidManifest and find HardCodeActivity.

In HardCodeActivity, you'll find the promo code embedded directly in the code. In this case, the promo code is NEW2019.

We found the string "NEW2019" hardcoded. We enter this code into the running app, and it works! We successfully bypassed the payment logic and got the product for free.

2. AI Chat (Vendor API Key Leak)

Apps often use third-party services like ChatGPT (OpenAI). To talk to these services, the app needs an API Key. If this key is stored in the app, attackers can steal it and use the developer’s paid quota.

The Scenario

The “AI” menu allows users to chat with a bot.

first we look for AIChatActivity in Jadx. Then we spot a variable storing a long string starting with sk-.

We extracted a valid OpenAI API Key (sk-abcdef...). An attacker could take this key and use it in their own scripts, causing the developer to receive a massive bill from OpenAI (Quota Theft).

3. Cloud Services (Infrastructure Compromise)

This is the most dangerous scenario. Developers sometimes embed “Access Keys” and “Secret Keys” for cloud platforms like AWS, Google Cloud, or Azure directly into the app.

The Scenario

The “Cloud Services” menu checks for connectivity to an AWS bucket.

Get Bumi Aryadirangga’s stories in your inbox

Join Medium for free to get updates from this writer.

Remember me for faster sign in

We examine CloudServicesActivity.

We find two static final strings that look suspiciously like AWS credentials.

We successfully extracted the AWS Access Key and Secret Key. With these credentials, an attacker could use the AWS CLI to download private customer data, delete backups, or mine cryptocurrency on the company’s servers.

Conclusion & Mitigation

In this session, we didn’t need to hack a server; the developer gave us the keys.

Lessons for Developers:

1. Never Hardcode: Source code is public. If it’s in the app, it’s visible.
2. Backend Proxy: Always perform sensitive operations (like checking a promo code or talking to OpenAI) on your Backend Server. The app should only send a request to your server, and your server holds the secrets.
3. Secrets Management: If you must use keys, use secure storage or inject them during the build process (though gradle.properties isn't a silver bullet either).