EasyShop Android Security Workshop

EasyShop is a deliberately vulnerable Android application designed for hands-on mobile security training. It is intended for teaching common Android security flaws in a safe, controlled environment using real app behavior, ADB commands, and basic reverse engineering techniques.

Quick start

Prerequisites

• Android Studio
• Java/Kotlin Android SDK
• An emulator or a connected Android device
• ADB installed and available in PATH

Build and run

You can use either of these approaches:

1. Build the APK locally from source:

./gradlew assembleDebug

2. Or install and run the app directly in Android Studio by opening the project, selecting a device or emulator, and pressing Run.

If you want to analyze the app as an APK, you can also use the generated APK from a debug or release build and inspect it with tools such as ADB, JADX, or APK parsing utilities.

A prebuilt APK is also available from the GitHub releases page:

https://github.com/shubhankar-gaur/EasyShop/releases/tag/apk

Then launch the app from the emulator/device.

Suggested workshop flow

A good way to teach this app is to move from observation to exploitation in a clear sequence. The steps below are intentionally progressive and stay close to what the app actually implements.

Progressive ADB workflow

Step	Command	What it helps you learn
1. Confirm the device is available	adb devices -l	Verifies the emulator or device is connected and visible to ADB.
2. Identify the app package	adb shell pm list packages -3	Finds installed third-party apps, including the target package.
3. Check the app package path	adb shell pm path com.example.easyshop	Locates the installed APK path on the device.
4. Inspect package-level exposure	adb shell dumpsys package com.example.easyshop	Reveals exported components, permissions, and other manifest-level exposure.
5. See what activity is currently on screen	adb shell dumpsys activity top | grep ACTIVITY	Shows which activity is currently in the foreground.
6. Watch runtime logs	adb logcat or adb logcat *:W	Shows app-generated logs, including sensitive data and runtime behavior.
7. Explore app-private data	adb shell then run-as com.example.easyshop	Lets you inspect files from the app’s private sandbox without root access.
8. Inspect app preferences and storage	cd shared_prefs and cat AppSession.xml	Shows plaintext preference entries stored by the app.
9. Pull public files from storage	adb pull /sdcard/Download/easyshop_export.txt .	Demonstrates how files written to a public directory can be accessed externally.
10. Launch exported components	adb shell am start -n com.example.easyshop/.AdminActivity	Shows how exported activities can be opened directly.
11. Test intent-based access	adb shell am start -n com.example.easyshop/.AdminActivity --es role admin	Demonstrates that authorization is influenced by an intent extra.
12. Exercise deep-link and WebView handling	adb shell am start -a android.intent.action.VIEW -d "shop://support?url=https://www.google.com"	Shows how the app processes URL data from an intent.
13. Query the exposed provider	adb shell content query --uri content://com.example.easyshop.provider/contacts	Demonstrates provider exposure and data access.
14. Inspect background entry points	adb shell am startservice -n com.example.easyshop/.OrderSyncService --es action sync_all	Shows how exported services can be invoked remotely.

Vulnerabilities covered by this app

The app currently demonstrates the following issues, all of which are visible in the manifest, code, or resources:

Vulnerability	Evidence in the project	Notes
Debuggable build state	app/src/main/AndroidManifest.xml	The app is marked as debuggable, which makes app-private data easier to inspect.
Backup enabled	app/src/main/AndroidManifest.xml	Backup is allowed, making data extraction easier through ADB backup workflows.
Exported components	app/src/main/AndroidManifest.xml	Multiple activities, services, a receiver, and the provider are exported.
Insecure internal storage access	app/src/main/java/com/example/easyshop/InsecureStorageActivity.java	Data written to the app sandbox is exposed through the debug/run-as workflow.
Plaintext SharedPreferences	app/src/main/java/com/example/easyshop/InsecureStorageActivity.java	A session token is stored in a plain XML preference file.
Public external storage write	app/src/main/java/com/example/easyshop/InsecureStorageActivity.java	Sensitive text is written to a public downloads directory.
Hardcoded secrets	app/src/main/java/com/example/easyshop/Config.java	A Stripe-style test key and backend URL are embedded in source.
Secret values in resources	app/src/main/res/values/strings.xml	A support password is present as a plain string resource.
Credential leakage in logs	app/src/main/java/com/example/easyshop/LoginActivity.java	Login credentials are logged in clear text.
Insecure admin access check	app/src/main/java/com/example/easyshop/AdminActivity.java	The activity trusts an intent extra to decide whether access is granted.
WebView URL handling weakness	app/src/main/java/com/example/easyshop/SupportWebViewActivity.java	The activity loads a URL based on intent input and deep-link data.
WebView file access	app/src/main/java/com/example/easyshop/SupportWebViewActivity.java	File access is enabled for the WebView, which broadens the attack surface.
Provider exposure	app/src/main/java/com/example/easyshop/ContactsProvider.java	The content provider is exported and exposes data through its query interface.
Broadcast-driven UI proxy	app/src/main/java/com/example/easyshop/NotificationReceiver.java	An exported receiver launches an internal notification activity using attacker-controlled data.

Suggested teaching order

1. Start with the ADB workflow and the manifest review.
2. Move to data storage and app-private file access.
3. Explore exported components and intent handling.
4. Review the WebView and provider access paths.
5. Finish with static analysis of source, resources, and the manifest.

Demo credentials

• Username: admin
• Password: password
• Package name: com.example.easyshop

Important note

This app is intentionally insecure. It should be used only for educational, authorized security testing and workshop purposes.