Repository navigation
feat(mobile): add Reverse Engineering lesson and challenges to the Android app - #1106
Open
SeanDuggan wants to merge 19 commits into
Open
SeanDuggan wants to merge 19 commits into
SeanDuggan wants to merge 19 commits into
Conversation
Adds the Gradle project, manifest, resources, launch/login/main activities, navigation, preferences, authentication, key validation and progress tracking utilities, and the home, progress, scoreboard and ADB reference screens. Lesson and challenge screens referenced by the navigation graph are added in the following PRs, so those destinations are not usable until then. Part of the split of OWASP#894 (mobile app).
Disable cleartext traffic app-wide via a network security config and reject non-https server URLs at login, registration and key validation. Debug builds additionally trust user-installed CAs for local development.
The shell now builds with an empty KeyValidator.Module enum and empty nav, menu and module-info registries. Each lesson/challenge category PR registers its own entries. Removes the myapp://open deep link and the KeyValidator unit test, which return with the first category.
Removes lesson/challenge strings and the Insufficient Cryptography ADB reference card. These return with their own category PRs.
The app asks /mobileModuleStatus which modules the signed-in student can open and greys out the rest in the navigation drawer and progress list, with the server's reason shown when tapped. This mirrors the platform's open floor / CTF rules: module closed, event not running, module blocked. Advisory only: the server re-checks every module start and key request. It fails open, so signed-out or offline use and failed requests grey out nothing. Status refreshes on resume, drawer open, sign in and sign out.
…JDK path Changing server_preference while signed in kept the old server's session cookie, so it would be sent to the new server. Log out when the server actually changes. Remove org.gradle.java.home, which pinned a Windows Android Studio path and overrode JAVA_HOME on other machines.
Replace the individually listed local planning docs with a single *.md rule.
Remove CHALLENGE_SOLUTIONS.txt and missing_challenges.txt, which refer to no files in the repository.
The logcat grep example rendered a literal "search_term" on the ADB Commands screen.
The Reverse Engineering rows still held DrumaDrumaDrumBoomBoom and christopherjenkins, which the rewritten app never shows. The app validates the two offline keys by SHA-256, so set moduleResult to those keys and keep hardcodedKey=1 so the web comparison accepts what the app displays.
The Android app lives in mobile/, not mobile/MobileShepherd/.
…l' into mobile-split/04-android-app-shell
Insecure Communication is deferred to 4.0.1. Remove its key hash entries, ProGuard rules and the cleartext-traffic comment.
…-reverse-engineering
Drop the About dialog button that opened owasp.org and the unused hidden Top 10 FAB with its string. Lessons now name the relevant risk as plain text.
…-reverse-engineering
This branch has not been deployed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Adds the Reverse Engineering (M7) module to the Mobile Shepherd app, the first lesson-plus-challenge pair after the app shell.
KeyProvider(intentionally discoverable).ReverseEngineering1Modeland must be decoded after decompiling.mobileBlurb.appLinkstring.Scope
Android app plus its challenge/lesson content only. No platform changes.
Notes
/mobileFlagSubmitreturns 404 for them and the app falls back to a local SHA-256 compare, so nocore.resultsrow is written.mobileBlurb.appLinkis also added by the Client-Side Injection, Insecure Data Storage and Poor Authentication PRs, so expect a trivial one-line conflict on rebase.Testing