Mobile › Module 3 › Lesson 3
Manifest Secrets
Manifest/secrets literacy names exported components, backup flags, and hardcoded keys in YOUR $MOB_LAB APK — report to YOUR notes, not public exploit drops.
Visual · t27_manifest_secrets
Manifest/secrets literacy. $MOB_LAB only. Original Cyberlium.
Opening
allowBackup=true and API keys in strings.xml are defender tickets — literacy finds them on lab APKs you are allowed to read.
Manifest review targets: android:exported, android:allowBackup, debuggable flags, cleartextTrafficPermitted, networkSecurityConfig, deep-link intent-filters. Secret hygiene: hardcoded AWS keys, Firebase URLs, JWT samples in strings or BuildConfig — common MSTG findings on intentional lab flaws. Cyberlium documents manifest/secrets findings on YOUR $MOB_LAB APK — rotate any accidental real keys in projects you own — never scrape secrets from production apps you do not authorize. Next: Static Lab.
1. Manifest red flags (named)
exported=true on unnecessary components. allowBackup=true exposing adb backup surface on older API patterns. usesCleartextTraffic=true bypassing TLS for all hosts. debuggable=true in release builds — lab mistake to recognize.
On $MOB_LAB sample, list three manifest flags and defender meaning each.
Command guide
Try these commands — Manifest red flags (named)
═══ TOOLS & WEBSITES ═══ Browse / read these (authorized learning only — stay in YOUR lab / program scope)
Android manifest security — https://developer.android.com/guide/topics/manifest/manifest-intro MASVS storage/secrets — https://mas.owasp.org/MASVS/0x02-MASVS-STORAGE/ OWASP MASTG secrets — https://mas.owasp.org/MASTG/0x05d-Testing-Data-Storage/
═══ INSTALL ═══
Linux (Debian/Ubuntu):
macOS:
Windows:
═══ LINUX / macOS ═══
Command — copy this
export MOB_LAB=${MOB_LAB:-$HOME/cyberlium-lab/t27-mob}
cat > "$MOB_LAB/notes/manifest-review.txt" <<'EOF'
manifest review literacy (YOUR demo.apk):
- android:exported on components
- android:allowBackup (data exfil risk)
- hardcoded API keys in strings.xml — never commit real secrets
- debuggable=true in release builds — finding template only
never: extract secrets from stranger production APKs
EOFCommand — copy this
unzip -p "$MOB_LAB/apk/demo.apk" AndroidManifest.xml 2>/dev/null | head -5 grep -E 'exported|allowBackup|never|hardcoded' "$MOB_LAB/notes/manifest-review.txt"
Primary tools to practice this lesson: grep, unzip. Reference sites: Android manifest security (https://developer.android.com/guide/topics/manifest/manifest-intro); MASVS storage/secrets (https://mas.owasp.org/MASVS/0x02-MASVS-STORAGE/); OWASP MASTG secrets (https://mas.owasp.org/MASTG/0x05d-Testing-Data-Storage/). Run every command in the box — install first, then the usage lines — only on YOUR lab / program scope.
2. Hardcoded secrets literacy
Search decompiled source and res/values/strings.xml for api_key, secret, password placeholders — lab apps plant them on purpose. Real projects: use backend proxy, Play App Signing, remote config with ACL.
Never paste live production secrets into chat — lab fictional keys only in notes.
3. Responsible disclosure habit
Forbidden: dumping secrets from stranger apps to Telegram, using found keys against live services. Allowed: findings table — flag, lab location, defender fix, severity on $MOB_LAB only.
Ship: manifest/secrets findings table for YOUR lab APK. Next: Static Lab.
4. What you ship: manifest/secrets table for $MOB_LAB
Three manifest flags and one lab secret finding with fix. $MOB_LAB named. chmod 600.
5. What you record before the next lesson
Date. Manifest/secrets table. $MOB_LAB named. File t27-m03-l03-manifest-secrets.txt chmod 600.
6. Wrong vs right: stranger phones vs lab emulator apps
Worked failure — same MSF word, opposite target. Right never needs a café Wi-Fi or classmate laptop.
Wrong
Exfiltrate API keys from production app. Post lab findings with real credentials.
Right
Write manifest/secrets table for YOUR $MOB_LAB sample APK. Next: Static Lab.
Mission: review manifest on YOUR lab APK
1) Flag one exported component. 2) Note allowBackup or cleartext flag. 3) Document one hardcoded lab secret and fix. 4) chmod 600.
Stuck? Ask Cyberlium AI Mentor
networkSecurityConfig is where pinning and cleartext exceptions belong — read it on lab APKs.
Knowledge Check
APPLY: android:allowBackup=true can:
Multiple choice
Knowledge Check
APPLY: True or False: Hardcoded production secrets in APKs are a defender fix priority.
True or False
Knowledge Check
APPLY: Dumping secrets from unauthorized apps is:
Multiple choice