Repository navigation
feat(mobile): add Client-Side Injection lesson and challenges to the Android app - #1069
Open
SeanDuggan wants to merge 23 commits into
Open
SeanDuggan wants to merge 23 commits into
SeanDuggan wants to merge 23 commits into
Conversation
Adds the Gradle project, manifest, resources, launch/login/main activities, navigation, preferences, authentication, key validation and progress tracking utilities, and the home, progress, scoreboard and ADB reference screens. Lesson and challenge screens referenced by the navigation graph are added in the following PRs, so those destinations are not usable until then. Part of the split of OWASP#894 (mobile app).
Disable cleartext traffic app-wide via a network security config and reject non-https server URLs at login, registration and key validation. Debug builds additionally trust user-installed CAs for local development.
The shell now builds with an empty KeyValidator.Module enum and empty nav, menu and module-info registries. Each lesson/challenge category PR registers its own entries. Removes the myapp://open deep link and the KeyValidator unit test, which return with the first category.
Removes lesson/challenge strings and the Insufficient Cryptography ADB reference card. These return with their own category PRs.
Contributor
There was a problem hiding this comment.
🟡 Changes recommended
One or more issues must be addressed before approval.
4 open issues
What changed in this PR
Adds Client-Side Injection training to the Android application and updates the corresponding server pages to describe the new exercises.
Changes:
- Adds SQLCipher database helpers, challenge logic, module registration, navigation, and Android UI resources.
- Updates lesson/challenge descriptions and replaces legacy APK references with the unified mobile app.
- Adds offline-validation rejection tests and Android build configuration.
Documentation: AGENTS.md needs updating to describe the new mobile/app Gradle project alongside the legacy independent apps.
Validation: Static review only; builds and tests were not run. Five actionable findings were recorded.
| File | Description |
|---|---|
| src/main/webapp/lessons/f758a97011ec4452cc0707e546a7c0f68abc6ef2ab747ea87e0892767152eae1.jsp | Updated as part of this pull request. |
| src/main/webapp/challenges/cfe68711def42bb0b201467b859322dd2750f633246842280dc68c858d208425.jsp | Updated as part of this pull request. |
| src/main/webapp/challenges/8855c8bb9df4446a546414562eda550520e29f7a82400a317c579eb3a5a0a8ef.jsp | Updated as part of this pull request. |
| src/main/resources/i18n/moduleGenerics/mobileGenericStrings.properties | Updated as part of this pull request. |
| src/main/resources/i18n/lessons/m_client_side_injection/f758a97011ec4452cc0707e546a7c0f68abc6ef2ab747ea87e0892767152eae1.properties | Updated as part of this pull request. |
| src/main/resources/i18n/challenges/mobile/clientSideInjection/clientSideInjection.properties | Updated as part of this pull request. |
| mobile/settings.gradle | Updated as part of this pull request. |
| mobile/scripts/calculate_key_hashes.py | Updated as part of this pull request. |
| mobile/gradlew.bat | Updated as part of this pull request. |
| mobile/gradle/wrapper/gradle-wrapper.properties | Updated as part of this pull request. |
| mobile/gradle.properties | Updated as part of this pull request. |
| mobile/build.gradle | Updated as part of this pull request. |
| mobile/app/src/test/java/org/owasp/mobileshepherd/KeyValidatorTest.java | Updated as part of this pull request. |
| mobile/app/src/main/res/xml/preferences.xml | Updated as part of this pull request. |
| mobile/app/src/main/res/xml/network_security_config.xml | Updated as part of this pull request. |
| mobile/app/src/main/res/xml/file_paths.xml | Updated as part of this pull request. |
| mobile/app/src/main/res/xml/data_extraction_rules.xml | Updated as part of this pull request. |
| mobile/app/src/main/res/xml/backup_rules.xml | Updated as part of this pull request. |
| mobile/app/src/main/res/values/themes.xml | Updated as part of this pull request. |
| mobile/app/src/main/res/values/dimens.xml | Updated as part of this pull request. |
| mobile/app/src/main/res/values/colors.xml | Updated as part of this pull request. |
| mobile/app/src/main/res/values-w600dp/dimens.xml | Updated as part of this pull request. |
| mobile/app/src/main/res/values-w1240dp/dimens.xml | Updated as part of this pull request. |
| mobile/app/src/main/res/values-night/themes.xml | Updated as part of this pull request. |
| mobile/app/src/main/res/values-night/colors.xml | Updated as part of this pull request. |
| mobile/app/src/main/res/values-land/dimens.xml | Updated as part of this pull request. |
| mobile/app/src/main/res/navigation/mobile_navigation.xml | Updated as part of this pull request. |
| mobile/app/src/main/res/mipmap-anydpi-v26/ic_launcher.xml | Updated as part of this pull request. |
| mobile/app/src/main/res/mipmap-anydpi-v26/ic_launcher_round.xml | Updated as part of this pull request. |
| mobile/app/src/main/res/menu/main.xml | Updated as part of this pull request. |
| mobile/app/src/main/res/menu/activity_main_drawer.xml | Updated as part of this pull request. |
| mobile/app/src/main/res/layout/nav_item_layout.xml | Updated as part of this pull request. |
| mobile/app/src/main/res/layout/nav_header_main.xml | Updated as part of this pull request. |
| mobile/app/src/main/res/layout/nav_drawer_layout.xml | Updated as part of this pull request. |
| mobile/app/src/main/res/layout/item_user_result.xml | Updated as part of this pull request. |
| mobile/app/src/main/res/layout/item_scoreboard_entry.xml | Updated as part of this pull request. |
| mobile/app/src/main/res/layout/item_module_progress.xml | Updated as part of this pull request. |
| mobile/app/src/main/res/layout/fragment_scoreboard.xml | Updated as part of this pull request. |
| mobile/app/src/main/res/layout/fragment_progress.xml | Updated as part of this pull request. |
| mobile/app/src/main/res/layout/fragment_preferences.xml | Updated as part of this pull request. |
| mobile/app/src/main/res/layout/fragment_home.xml | Updated as part of this pull request. |
| mobile/app/src/main/res/layout/fragment_client_side_injection_lesson.xml | Updated as part of this pull request. |
| mobile/app/src/main/res/layout/fragment_client_side_injection_challenge2.xml | Updated as part of this pull request. |
| mobile/app/src/main/res/layout/fragment_client_side_injection_challenge1.xml | Updated as part of this pull request. |
| mobile/app/src/main/res/layout/dialog_lesson_info.xml | Updated as part of this pull request. |
| mobile/app/src/main/res/layout/dialog_auth.xml | Updated as part of this pull request. |
| mobile/app/src/main/res/layout/content_main.xml | Updated as part of this pull request. |
| mobile/app/src/main/res/layout/app_bar_main.xml | Updated as part of this pull request. |
| mobile/app/src/main/res/layout/activity_main.xml | Updated as part of this pull request. |
| mobile/app/src/main/res/layout/activity_login.xml | Updated as part of this pull request. |
| mobile/app/src/main/res/layout/activity_landing.xml | Updated as part of this pull request. |
| mobile/app/src/main/res/drawable/side_nav_bar.xml | Updated as part of this pull request. |
| mobile/app/src/main/res/drawable/shepherd_background.xml | Updated as part of this pull request. |
| mobile/app/src/main/res/drawable/shape.xml | Updated as part of this pull request. |
| mobile/app/src/main/res/drawable/nav_header_background.xml | Updated as part of this pull request. |
| mobile/app/src/main/res/drawable/ic_status_incomplete.xml | Updated as part of this pull request. |
| mobile/app/src/main/res/drawable/ic_status_complete.xml | Updated as part of this pull request. |
| mobile/app/src/main/res/drawable/ic_menu_web.xml | Updated as part of this pull request. |
| mobile/app/src/main/res/drawable/ic_menu_warning.xml | Updated as part of this pull request. |
| mobile/app/src/main/res/drawable/ic_menu_slideshow.xml | Updated as part of this pull request. |
| mobile/app/src/main/res/drawable/ic_menu_shield.xml | Updated as part of this pull request. |
| mobile/app/src/main/res/drawable/ic_menu_settings.xml | Updated as part of this pull request. |
| mobile/app/src/main/res/drawable/ic_menu_network.xml | Updated as part of this pull request. |
| mobile/app/src/main/res/drawable/ic_menu_lock.xml | Updated as part of this pull request. |
| mobile/app/src/main/res/drawable/ic_menu_link.xml | Updated as part of this pull request. |
| mobile/app/src/main/res/drawable/ic_menu_key.xml | Updated as part of this pull request. |
| mobile/app/src/main/res/drawable/ic_menu_home.xml | Updated as part of this pull request. |
| mobile/app/src/main/res/drawable/ic_menu_gallery.xml | Updated as part of this pull request. |
| mobile/app/src/main/res/drawable/ic_menu_database.xml | Updated as part of this pull request. |
| mobile/app/src/main/res/drawable/ic_menu_code.xml | Updated as part of this pull request. |
| mobile/app/src/main/res/drawable/ic_menu_camera.xml | Updated as part of this pull request. |
| mobile/app/src/main/res/drawable/ic_menu_alert.xml | Updated as part of this pull request. |
| mobile/app/src/main/res/drawable/ic_launcher_background.xml | Updated as part of this pull request. |
| mobile/app/src/main/res/drawable/ic_expand_more.xml | Updated as part of this pull request. |
| mobile/app/src/main/res/drawable/grassbackground.xml | Updated as part of this pull request. |
| mobile/app/src/main/res/drawable/card_ripple.xml | Updated as part of this pull request. |
| mobile/app/src/main/res/drawable/button_scale_animation.xml | Updated as part of this pull request. |
| mobile/app/src/main/res/drawable/bg_scoreboard_row.xml | Updated as part of this pull request. |
| mobile/app/src/main/res/drawable/bg_medal_silver.xml | Updated as part of this pull request. |
| mobile/app/src/main/res/drawable/bg_medal_gold.xml | Updated as part of this pull request. |
| mobile/app/src/main/res/drawable/bg_medal_bronze.xml | Updated as part of this pull request. |
| mobile/app/src/main/res/drawable/animation.xml | Updated as part of this pull request. |
| mobile/app/src/main/res/drawable-v24/ic_menu.xml | Updated as part of this pull request. |
| mobile/app/src/main/res/drawable-v24/ic_launcher_foreground.xml | Updated as part of this pull request. |
| mobile/app/src/main/res/drawable-v24/ic_launcher_background.xml | Updated as part of this pull request. |
| mobile/app/src/main/res/drawable-v24/animation.xml | Updated as part of this pull request. |
| mobile/app/src/main/res/anim/slide_out_right.xml | Updated as part of this pull request. |
| mobile/app/src/main/res/anim/slide_out_left.xml | Updated as part of this pull request. |
| mobile/app/src/main/res/anim/slide_in_right.xml | Updated as part of this pull request. |
| mobile/app/src/main/res/anim/slide_in_left.xml | Updated as part of this pull request. |
| mobile/app/src/main/res/anim/scale_up.xml | Updated as part of this pull request. |
| mobile/app/src/main/res/anim/scale_down.xml | Updated as part of this pull request. |
| mobile/app/src/main/res/anim/fade_out.xml | Updated as part of this pull request. |
| mobile/app/src/main/res/anim/fade_in.xml | Updated as part of this pull request. |
| mobile/app/src/main/java/org/owasp/mobileshepherd/utils/ModuleInfoHelper.java | Updated as part of this pull request. |
| mobile/app/src/main/java/org/owasp/mobileshepherd/utils/KeyValidator.java | Updated as part of this pull request. |
| mobile/app/src/main/java/org/owasp/mobileshepherd/utils/KeyProvider.java | Updated as part of this pull request. |
| mobile/app/src/main/java/org/owasp/mobileshepherd/utils/CompletionVisualFeedback.java | Updated as part of this pull request. |
| mobile/app/src/main/java/org/owasp/mobileshepherd/utils/CompletionBadge.java | Updated as part of this pull request. |
| mobile/app/src/main/java/org/owasp/mobileshepherd/ui/progress/ProgressFragment.java | Updated as part of this pull request. |
| mobile/app/src/main/java/org/owasp/mobileshepherd/ui/lessons/clientsideinjection/helpers/DatabaseHelper.java | Updated as part of this pull request. |
| mobile/app/src/main/java/org/owasp/mobileshepherd/ui/home/HomeFragment.java | Updated as part of this pull request. |
| mobile/app/src/main/java/org/owasp/mobileshepherd/ui/challenges/clientsideinjection/helpers/Challenge2DatabaseHelper.java | Updated as part of this pull request. |
| mobile/app/src/main/java/org/owasp/mobileshepherd/ui/challenges/clientsideinjection/helpers/Challenge1DatabaseHelper.java | Updated as part of this pull request. |
| mobile/app/src/main/java/org/owasp/mobileshepherd/ui/challenges/clientsideinjection/ClientSideInjectionChallenge2Model.java | Updated as part of this pull request. |
| mobile/app/src/main/java/org/owasp/mobileshepherd/ui/challenges/clientsideinjection/ClientSideInjectionChallenge1Model.java | Updated as part of this pull request. |
| mobile/app/src/main/java/org/owasp/mobileshepherd/ui/challenges/clientsideinjection/ClientSideInjectionChallenge1Fragment.java | Updated as part of this pull request. |
| mobile/app/src/main/java/org/owasp/mobileshepherd/ui/adb/AdbReferenceFragment.java | Updated as part of this pull request. |
| mobile/app/src/main/java/org/owasp/mobileshepherd/Preferences.java | Updated as part of this pull request. |
| mobile/app/src/main/java/org/owasp/mobileshepherd/NavigationItem.java | Updated as part of this pull request. |
| mobile/app/src/main/java/org/owasp/mobileshepherd/NavigationAdapter.java | Updated as part of this pull request. |
| mobile/app/src/main/java/org/owasp/mobileshepherd/LoginActivity.java | Updated as part of this pull request. |
| mobile/app/src/main/java/org/owasp/mobileshepherd/LandingActivity.java | Updated as part of this pull request. |
| mobile/app/src/main/AndroidManifest.xml | Updated as part of this pull request. |
| mobile/app/src/androidTest/java/com/owasp/reverser/ExampleInstrumentedTest.java | Updated as part of this pull request. |
| mobile/app/proguard-rules.pro | Updated as part of this pull request. |
| mobile/app/build.gradle | Updated as part of this pull request. |
| mobile/app/.gitignore | Updated as part of this pull request. |
| mobile/.gitignore | Updated as part of this pull request. |
Review effort: Balanced
The app asks /mobileModuleStatus which modules the signed-in student can open and greys out the rest in the navigation drawer and progress list, with the server's reason shown when tapped. This mirrors the platform's open floor / CTF rules: module closed, event not running, module blocked. Advisory only: the server re-checks every module start and key request. It fails open, so signed-out or offline use and failed requests grey out nothing. Status refreshes on resume, drawer open, sign in and sign out.
…JDK path Changing server_preference while signed in kept the old server's session cookie, so it would be sent to the new server. Log out when the server actually changes. Remove org.gradle.java.home, which pinned a Windows Android Studio path and overrode JAVA_HOME on other machines.
…Android app Adds the first mobile category on top of the app shell: - Android: lesson plus challenges 1 and 2 (SQLCipher-backed databases, SQL injection targets), layouts, navigation destinations, drawer entries and module registration in KeyValidator, ModuleInfoHelper and MainActivity. - Server: updated lesson and challenge JSPs and i18n properties, plus the mobileBlurb.appLink generic string those pages use. - Tests: KeyValidatorTest confirms these modules have no offline hash, so flags are only accepted by the server.
The Login/Search buttons were live while KeyProvider.getKey and the DB
seeding were still in flight. With an empty key, getReadableDatabase("")
threw outside the try block and crashed the app.
Disable the button until seeding succeeds, show an error if seeding fails,
and open the database inside the try block so failures are reported
instead of crashing. Applied to the lesson and both challenges, which
shared the pattern.
SeanDuggan
force-pushed
the
mobile-split/07-client-side-injection
branch
from
October 27, 2026 20:55
b9a7fd2 to
9bc6c75
Compare
Replace the individually listed local planning docs with a single *.md rule.
Remove CHALLENGE_SOLUTIONS.txt and missing_challenges.txt, which refer to no files in the repository.
This was referenced Nov 1, 2026
The logcat grep example rendered a literal "search_term" on the ADB Commands screen.
…app flags The Client Side Injection lesson and challenges 1 and 2 kept the old static results with hardcodedKey=1, so the web SolutionSubmit compared against the old values while the app now shows an HMAC of the MobileModuleFlags base flag. Set hardcodedKey=0 and use the base flags as moduleResult so a key copied from the app is accepted on the web.
…ction' into mobile-split/07-client-side-injection
The Android app lives in mobile/, not mobile/MobileShepherd/.
…l' into mobile-split/04-android-app-shell
Insecure Communication is deferred to 4.0.1. Remove its key hash entries, ProGuard rules and the cleartext-traffic comment.
…-client-side-injection
Drop the About dialog button that opened owasp.org and the unused hidden Top 10 FAB with its string. Lessons now name the relevant risk as plain text.
…-client-side-injection
This branch has not been deployed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Adds the first mobile category on top of the Android app shell.
Android: Client-Side Injection lesson plus challenges 1 and 2, with SQLCipher-backed databases as the SQL injection targets. Layouts, navigation destinations and drawer entries are included, and the three modules are registered in KeyValidator, ModuleInfoHelper and MainActivity.
Server content: the updated lesson and challenge JSPs and i18n properties, plus the mobileBlurb.appLink string those pages use. No platform or servlet changes.
Tests: KeyValidatorTest checks that these modules have no offline hash, so flags are only accepted by the server. Wrong, empty and null keys are rejected.
Depends on: the module IDs/cheatsheets PR, the server API PR and the app shell PR. I'll rebase onto dev once they merge.