Home / Attacks & tests / Execution of Untrusted Code
13 test cases
Execution of Untrusted Code
This category examines every route by which code or content the application did not author comes to be executed inside it: embedded web views, dynamically loaded modules, and the memory-handling defects that let crafted data become instruction in native components.
What an attacker is trying to achieve
The attacker wants execution inside the application's own identity, where it inherits the sandbox, the permissions and the stored credentials. A web view that loads attacker content, a module loaded from a writable location, or a parser that mishandles a crafted file all reach the same place.
Test cases
13 test cases in this category. Each states what the test proves, how it is carried out, what has to be in place beforehand, what a positive result looks like, and whether the work is manual, automated or a mixture.
AND-CODE-01 WebView Security
Objective — Determine how embedded web views are configured and whether their settings permit content to reach capabilities the application holds.
How it is tested — Enumerate every web view and record its configuration: script execution, file access, content access, mixed content handling and whether it loads arbitrary destinations. Establish which destinations each can be made to load, including via parameters the application accepts from outside. Determine whether certificate errors are ignored, and whether local files can be read by content the web view loads.
Prerequisites — The decompiled package; a device; a proxy; a destination the tester controls to load into the view.
Indicators — A web view loading a caller-supplied destination; file access enabled alongside remote content; certificate errors overridden; mixed content permitted.
Coverage — MASVS-PLATFORM-2MASVS-NETWORK-1CWE-749CWE-295
Depth — Manual Configuration has to be read from the code and confirmed by loading real content into the view.
AND-CODE-02 External Interfaces Exposed to WebView Content
Objective — Determine what native capability the application exposes to content running inside a web view, and whether that content can be attacker-controlled.
How it is tested — Enumerate the interfaces bridged into web views and the methods each exposes. Establish what those methods can do — read storage, issue authenticated requests, return credentials, invoke platform features. Then establish whether any content the view loads can originate outside the application: a caller-supplied destination, an intercepted plaintext load, or third-party content embedded in a trusted page.
Prerequisites — The decompiled package; a device; the ability to serve content into the web view, whether by parameter or by interception.
Indicators — A bridged method exposing storage, credentials or authenticated requests; a bridge present on a view that loads remote content; third-party content reaching a bridged view.
Coverage — MASVS-PLATFORM-2MASVS-CODE-4CWE-749CWE-94
Depth — Manual The finding is the combination of a capable bridge and reachable content; either alone is not one.
AND-CODE-03 JavaScript Execution Risks in WebViews
Objective — Determine whether content rendered in a web view can execute script carrying data supplied by another user or by an attacker.
How it is tested — Identify what the application renders in web views — user-generated content, server-delivered markup, help and terms content, notification bodies — and submit script payloads into each. Establish whether the application encodes before rendering, and whether the view executes script at all. Where script executes, determine what it reaches: bridged interfaces, local files, and the session material the view carries.
Prerequisites — A device; content-submission paths that reach a web view; a second account where content is rendered to another user.
Indicators — Script from submitted content executing in a web view; markup rendered unencoded; executing script reaching a bridged interface or local file.
Coverage — MASVS-PLATFORM-2MASVS-CODE-4CWE-79CWE-749
Depth — Manual Requires driving content through the application to the view rather than testing the view directly.
AND-CODE-04 Code Signing
Objective — Determine whether the application's integrity can be verified and whether it detects having been repackaged and re-signed.
How it is tested — Examine the signing configuration and the scheme in use. Repackage the application with a different signing identity, install it, and establish whether it runs unchanged. Determine whether the application verifies its own signature at runtime and what it does on failure, and whether the server distinguishes a genuine client from a repackaged one. Establish whether any debug or test signing material remains in the release.
Prerequisites — The distributed package; tooling to repackage and re-sign; a device permitting installation from outside the store; a proxy to observe server behaviour.
Indicators — A repackaged application running unchanged; no runtime integrity check, or one that only warns; the server unable to distinguish a repackaged client; debug signing material in the release.
Coverage — MASVS-RESILIENCE-1MASVS-RESILIENCE-2CWE-347CWE-494
Depth — Manual Confirmation is repackaging and running, which cannot be inferred from the package alone.
AND-CODE-05 Dynamic Code Loading
Objective — Determine whether the application loads executable code at runtime, and whether the source of that code can be influenced.
How it is tested — Identify calls that load classes, modules or native libraries at runtime, and trace where the loaded artefact comes from: bundled, downloaded, or read from a filesystem location. For downloaded code, establish whether the channel is authenticated and the artefact's integrity verified before loading. For code read from disk, establish whether the location is writable by anything other than the application.
Prerequisites — The decompiled package; a device with filesystem access; a proxy able to intercept and modify downloads.
Indicators — Code loaded from a writable location; a downloaded module loaded without integrity verification; a loading path whose source is influenced by external input.
Coverage — MASVS-CODE-2MASVS-RESILIENCE-1CWE-494CWE-829
Depth — Manual Requires tracing the artefact's provenance through the code, not just spotting the call.
AND-CODE-06 Dynamic Code Execution Decisions
Objective — Determine whether decisions about what to execute — feature toggles, scripted rules, server-delivered configuration — can be influenced to change the application's behaviour.
How it is tested — Identify configuration and rule data the application interprets rather than merely reads, whether delivered from the server or stored locally. Modify it, in transit through a proxy and at rest on the device, and observe whether behaviour changes. Establish whether such data is integrity-protected, and whether it can enable functionality intended to remain disabled or disable a control intended to remain on.
Prerequisites — A proxy able to modify responses; a device with access to stored configuration; the decompiled package to identify interpreted data.
Indicators — Behaviour changing from modified configuration; a security control disabled by a toggle the client accepts; interpreted rules delivered without integrity protection.
Coverage — MASVS-CODE-4MASVS-RESILIENCE-1CWE-494CWE-807
Depth — Manual Requires distinguishing configuration the client obeys from data it merely displays.
AND-CODE-07 Stack-Based Buffer Overflows
Objective — Determine whether native components mishandle input that exceeds the stack buffers allocated for it.
How it is tested — Identify native libraries and the entry points through which application data reaches them — media decoding, cryptography, compression, protocol parsing. Submit oversized values through each, increasing length progressively, and observe for termination rather than rejection. Where source or symbols are available, review the copy operations directly for unbounded forms.
Prerequisites — The native libraries and a disassembler; a device where crashes can be observed and the application reinstalled; permission to crash it.
Indicators — The process terminating at a length threshold; a crash whose fault address reflects submitted content; an unbounded copy into a fixed buffer in the disassembly.
Coverage — MASVS-CODE-4CWE-121CWE-787
Depth — Manual Requires reaching native code through the application's own data paths and reading crash behaviour.
AND-CODE-08 Heap-Based Buffer Overflows
Objective — Determine whether native components mishandle input affecting dynamically allocated memory, through inconsistent sizes or arithmetic that does not hold.
How it is tested — Target native code that allocates based on values taken from input: image and media dimensions, declared record counts, decompressed sizes. Submit inputs whose declared size disagrees with the content that follows, and values chosen to make an allocation calculation wrap or truncate. Observe for corruption and termination rather than for a clean rejection.
Prerequisites — Native libraries and a disassembler; a device permitting crash observation; sample files whose headers can be edited independently of their content.
Indicators — A crash within allocation or copy routines; a declared size trusted without reconciliation against content; corrupted output rather than refusal.
Coverage — MASVS-CODE-4CWE-122CWE-787
Depth — Manual Requires reasoning about allocation from outside the process, guided by the disassembly.
AND-CODE-09 Object Lifetime Vulnerabilities
Objective — Determine whether native components use memory after releasing it, or release it more than once, under sequences the application can be driven to produce.
How it is tested — Identify native operations with an explicit lifecycle — open and close, initialise and destroy, subscribe and cancel — and drive them in orders the application's own interface does not produce: cancel during processing, close twice, reuse a handle after release, interrupt an operation part-way. Concentrate on error paths, where cleanup is most often duplicated or omitted.
Prerequisites — Native libraries; a device permitting crashes; the ability to interrupt operations, including by removing connectivity mid-operation.
Indicators — A crash following cancellation or repeated release; behaviour depending on memory state rather than input; instability after an interrupted operation.
Coverage — MASVS-CODE-4CWE-416CWE-415
Depth — Manual The triggering sequences are orderings the interface never produces and must be constructed deliberately.
AND-CODE-10 Format String Vulnerabilities
Objective — Determine whether externally supplied strings reach native formatting functions as the format specification rather than as an argument.
How it is tested — Identify native logging and string-construction paths that receive application data. Submit format specifiers through every field reaching them and observe whether they are rendered literally or interpreted. Where source or symbols permit, review formatting calls for a non-constant format argument. Confirm through output, which is frequently a log rather than anything on screen.
Prerequisites — Native libraries and a disassembler; a device with log access; fields whose values reach native formatting.
Indicators — A specifier interpreted rather than displayed; memory content or pointer-like values in output; a crash on specifier submission; a non-constant format argument in the disassembly.
Coverage — MASVS-CODE-4CWE-134
Depth — Manual Confirmation usually requires reading logs rather than the interface.
AND-CODE-11 Secrets in Native Code
Objective — Determine whether secrets have been placed in native libraries on the assumption that compiled code is harder to read than bytecode.
How it is tested — Extract strings and constant data from every bundled native library and search for keys, credentials, endpoints and tokens. Where values are assembled or obscured at runtime, follow the routine that produces them and recover the result, since anything the application can reconstruct on the device is available to the attacker too. Establish what each recovered secret authorises.
Prerequisites — The native libraries; a disassembler and, for runtime recovery, a debugger or instrumentation on a device.
Indicators — A key or credential in a native library; a value assembled at runtime and recoverable by instrumentation; a secret shared across installations; a recovered secret accepted by the server.
Coverage — MASVS-STORAGE-1MASVS-RESILIENCE-3CWE-798CWE-321
Depth — Manual Static strings automate; runtime-assembled values require instrumenting the application on a device.
AND-CODE-12 Integer Overflows
Objective — Determine whether arithmetic on caller-influenced values exceeds the range of its type, producing a result the surrounding code does not expect.
How it is tested — Identify values used in size, count, index and offset calculations in native code, and submit values near the boundaries of their types. Concentrate on calculations that multiply or add before allocating, since a wrapped result yields an allocation far smaller than the subsequent write assumes. Observe for allocations inconsistent with the requested size, and for corruption downstream.
Prerequisites — Native libraries and a disassembler; a device permitting crashes; input paths carrying numeric values into native code.
Indicators — An allocation inconsistent with the requested size; a crash at a numeric boundary; a length check passing for a value that wraps; corruption after a large numeric input.
Coverage — MASVS-CODE-4CWE-190CWE-680
Depth — Manual The productive values sit at type boundaries, which requires knowing the types from the disassembly.
AND-CODE-13 Integer Underflows
Objective — Determine whether subtraction on caller-influenced values falls below the minimum of its type, producing a large positive result where a small one was expected.
How it is tested — Identify subtractions involving external values — remaining-length calculations, offset differences, countdown counters — and submit values that make the subtrahend exceed the minuend. Establish whether the result is used as a length or bound, where a wrapped value produces a read or write far beyond the buffer. Test declared lengths shorter than the headers they describe.
Prerequisites — Native libraries and a disassembler; a device permitting crashes; the ability to edit declared lengths independently of content.
Indicators — A large read or write following a small numeric input; a crash when a declared length is below its header size; a bound check passing for a value that wrapped.
Coverage — MASVS-CODE-4CWE-191CWE-125
Depth — Manual Requires identifying which subtractions feed a length, which comes from the disassembly.
What we need from you
The decompiled package including native libraries; a device or emulator, preferably with elevated privileges for the memory cases; a proxy for the web view cases; and permission to crash the application, since several confirmations do.
Standards this category maps to
Every identifier below is quoted from the published control list it belongs to. Where a test has no defensible mapping, none is given rather than an approximate one.
- MASVS-PLATFORM-2 — The app uses WebViews securely.
- MASVS-NETWORK-1 — The app secures all network traffic according to the current best practices.
- CWE-749 — Exposed Dangerous Method or Function
- CWE-295 — Improper Certificate Validation
- MASVS-CODE-4 — The app validates and sanitizes all untrusted inputs.
- CWE-94 — Improper Control of Generation of Code ('Code Injection')
- CWE-79 — Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
- MASVS-RESILIENCE-1 — The app validates the integrity of the platform.
- MASVS-RESILIENCE-2 — The app implements anti-tampering mechanisms.
- CWE-347 — Improper Verification of Cryptographic Signature
- CWE-494 — Download of Code Without Integrity Check
- MASVS-CODE-2 — The app has a mechanism for enforcing app updates.
- CWE-829 — Inclusion of Functionality from Untrusted Control Sphere
- CWE-807 — Reliance on Untrusted Inputs in a Security Decision
- CWE-121 — Stack-based Buffer Overflow
- CWE-787 — Out-of-bounds Write
- CWE-122 — Heap-based Buffer Overflow
- CWE-416 — Use After Free
- CWE-415 — Double Free
- CWE-134 — Use of Externally-Controlled Format String
- MASVS-STORAGE-1 — The app securely stores sensitive data.
- MASVS-RESILIENCE-3 — The app implements anti-static analysis mechanisms.
- CWE-798 — Use of Hard-coded Credentials
- CWE-321 — Use of Hard-coded Cryptographic Key
- CWE-190 — Integer Overflow or Wraparound
- CWE-680 — Integer Overflow to Buffer Overflow
- CWE-191 — Integer Underflow (Wrap or Wraparound)
- CWE-125 — Out-of-bounds Read
Tell us what the system does and what worries you.
If a penetration test is not what you need yet, we will say so.