Hacking AndroGoat: Input Validation
In previous part, we saw how data leaks through side channels like the keyboard and clipboard. In this part, we switch to offensive attacks. We will exploit Input Validation flaws — where the application blindly accepts whatever we type, even if it’s malicious code.
Using our Waydroid setup, we will perform Cross-Site Scripting (XSS), SQL Injection, and Local File Inclusion (LFI) attacks directly on the AndroGoat application.
Cross-Site Scripting (XSS)
If a developer enables JavaScript (setJavaScriptEnabled(true)) and displays user input without sanitization, it becomes vulnerable to XSS.
The Scenario
The app has an input field that reflects our text on the screen.
The code processes all characters without filtering, making it vulnerable to XSS attacks using script tags.
The Exploit
- Inject Payload: We input a classic HTML/JS payload to test if the app interprets tags.
<marquee><h1>HACKED BY BOEMI</h1></marquee>2. When we hit the button, the WebView renders the HTML.
The text “HACKED BY BOEMI” scrolls across the screen. This confirms that the WebView is executing our HTML and JavaScript. An attacker could use this to steal session cookies or display a fake login form (Phishing) overlaying the real app.
SQL Injection (SQLi)
SQL Injection isn’t just for websites; it affects Android apps that use local SQLite databases with dynamic queries.
The Scenario
The app has a user search or login feature backed by a local SQLite database.
The code lacks input filtering and doesn’t use prepared statements, making it susceptible to SQL Injection.
The Exploit
We want to bypass the authentication logic without knowing the user’s password.
- Inject Payload: In the Username field, we input a standard SQL bypass string:
' OR 1=1 --(The -- comments out the rest of the query, making the password check irrelevant).
Get Bumi Aryadirangga’s stories in your inbox
Join Medium for free to get updates from this writer.
2. Execute: We search or attempt to login.
The app dumps all users in the database, including rksjaya and their password qweq. By injecting ' OR 1=1, we forced the database query to always return TRUE, granting us unauthorized access to all records.
WebView Attacks
By default, WebViews in older Android versions or insecure configurations allow the file:// protocol. This allows the WebView to read files stored on the device's internal storage.
The Scenario
The app asks for a URL to load in a WebView.
The WebView lacks input validation, file access controls, and has JavaScript enabled, allowing access to local files.
The Exploit
Instead of a website (https://), we point it to a sensitive local file we discovered in Part 2 (Shared Preferences).
- Inject Payload:
file:///data/data/owasp.sat.agoat/shared_prefs/users.xml2. Execute: Tap “LOAD”.
The WebView successfully loads and displays the XML file containing the username boemi and password qwe. This is a Local File Inclusion (LFI) vulnerability, allowing an attacker to read the app's private files.
QR Code
Input validation issues can also occur in visual inputs like QR Codes.
The Scenario
The app has a QR Code scanner. When it scans a code, it displays the content on the screen.
The Exploit
- Generate Malicious QR: We use an online QR code generator to create a QR containing a JavaScript payload:
<script>alert('QR XSS')</script>
2. We point the AndroGoat scanner at our malicious QR code.
The app scans the code and immediately executes the JavaScript, popping up an alert box saying “QR XSS”. This is a form of Stored XSS if the scanned data is saved to a database and viewed by other users later.
