[MASWE-0040] Add Dynamic test and demo for Android
Author: IPMegladonCreated Sep 11, 2026Updated Sep 11, 2026
For MASWE-0040 - Sensitive Data Leaked via Accessibility Services, the Test title: Runtime Check Of Sensitive Fields Not Using Secure Input
Summary:
Test:
Uiautomator can be used to query the android accessibility interface:
adb exec-out uiautomator dump /dev/tty
Sensitive fields should return as text="••••••" password="true".
Note: it is important that the app does not display the entered data before masking it as this can still be captured, e.g. this will look like text="••3", text="•••4" from an Accessibility perspective.
Of course this will not prevent against touchjacking (getting coords of where user taps) or overlay attacks, both of which I believe can be done with accessibility options.
Source: OWASP/mastg