<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
---
name: analyzing-mobile-app-authentication-flows
description: >-
  Analyze mobile application authentication mechanisms including OAuth 2.0,
  OIDC, biometric authentication, session management, token storage, and
  multi-factor authentication bypass using Frida, Burp Suite, and objection
  for runtime interception on Android and iOS.
domain: cybersecurity
subdomain: mobile-security
tags:
  - authentication
  - oauth
  - session-management
  - biometric
  - token-storage
  - mfa-bypass
  - frida
  - burp-suite
  - objection
version: "1.0"
author: defconxt
license: AGPL-3.0
metadata:
  mitre-attack: ["T1111", "T1539", "T1556"]
  owasp-mobile: ["M4", "M6"]
  tools: ["frida", "objection", "burp-suite", "mitmproxy", "jadx"]
---

# Analyzing Mobile App Authentication Flows

## Overview

Mobile authentication analysis examines how apps verify user identity,
manage sessions, store credentials, and handle token lifecycle. Weak
implementations expose session hijacking, credential theft, biometric bypass,
and OAuth misconfiguration. Testing covers both client-side logic and the
interaction with backend authentication services.

## Prerequisites

```bash
pip install frida-tools objection mitmproxy
apt install apktool
# Burp Suite: https://portswigger.net/burp
# jadx: https://github.com/skylot/jadx/releases
```

## Workflow

### Step 1: Authentication Flow Mapping

```bash
# Intercept authentication traffic with mitmproxy
mitmproxy --mode regular --listen-port 8080 --showhost

# Identify authentication endpoints
mitmdump -r capture.flow --set flow_detail=3 | grep -iE 'login|auth|token|session|oauth'

# Map OAuth 2.0 / OIDC flow
# Look for: authorization_endpoint, token_endpoint, redirect_uri
# Check: response_type, code_challenge (PKCE), state parameter

# Burp Suite — active proxy interception
# Configure device to proxy through Burp
# Intercept login request → inspect credentials transport
```

### Step 2: Credential Storage Analysis

```bash
# Android — check credential storage locations
objection -g com.target.app explore
# env                                    # list data directories
# android keystore list                  # list KeyStore entries
# android clipboard monitor              # watch clipboard

# Check SharedPreferences for stored tokens
adb shell run-as com.target.app cat shared_prefs/*.xml | grep -iE 'token|session|auth|key'

# Check SQLite databases
adb shell run-as com.target.app ls databases/
adb shell run-as com.target.app sqlite3 databases/app.db ".tables"

# iOS — check Keychain
objection -g com.target.app explore -c "ios keychain dump"
objection -g com.target.app explore -c "ios nsuserdefaults get"
objection -g com.target.app explore -c "ios plist cat"
```

### Step 3: Token Security Assessment

```bash
# Decode and inspect JWT tokens
# Extract token from intercepted traffic or storage
echo "JWT_TOKEN" | cut -d. -f2 | base64 -d 2>/dev/null | python3 -m json.tool

# Check JWT vulnerabilities
# - Algorithm: "none" or "HS256" with weak secret
# - Missing expiration (exp claim)
# - Excessive scope or permissions
# - Sensitive data in payload

# Frida — intercept token usage at runtime
frida -U -f com.target.app -l hook_auth.js --no-pause

# Test token expiration — use old token after expected lifetime
curl -H "Authorization: Bearer OLD_TOKEN" https://api.target.com/me
```

### Step 4: Biometric Authentication Bypass

```bash
# Android — hook BiometricPrompt
frida -U -f com.target.app -l bypass_biometric.js --no-pause

# Frida script hooks BiometricPrompt.AuthenticationCallback.onAuthenticationSucceeded
# and calls it directly to bypass fingerprint/face check

# objection biometric bypass
objection -g com.target.app explore -c "android hooking watch class \
  android.hardware.biometrics.BiometricPrompt\$AuthenticationCallback"

# iOS — hook LAContext
frida -U -f com.target.app -l bypass_touchid.js --no-pause
# Hook LAContext.evaluatePolicy to always return success

# Check if biometric protects KeyStore key or just UI gate
grep -rn 'setUserAuthenticationRequired\|BiometricPrompt' jadx_out/
```

### Step 5: OAuth and SSO Testing

```bash
# Check for PKCE implementation
# Intercept authorization request — look for code_challenge parameter
mitmdump -r capture.flow | grep 'code_challenge'

# Test redirect_uri validation
# Modify redirect_uri to attacker-controlled domain
curl "https://auth.target.com/authorize?client_id=ID&redirect_uri=https://evil.com/callback&response_type=code"

# Test state parameter for CSRF
# Remove or replay state parameter in authorization response

# Check token exchange — authorization code should be single-use
curl -X POST https://auth.target.com/token \
  -d "grant_type=authorization_code&code=USED_CODE&client_id=ID"

# Inspect deep link handlers for authorization callback
grep -rn 'intent-filter\|scheme.*oauth\|scheme.*callback' apktool_out/AndroidManifest.xml
```

### Step 6: Session Management Testing

```bash
# Test session fixation
# Obtain session before login, check if same session persists after login

# Test concurrent sessions
# Login from two devices, verify if first session is invalidated

# Test session timeout
# Authenticate, wait beyond expected timeout, test if session still valid

# Frida — monitor session cookie handling
frida -U -f com.target.app -l hook_cookies.js --no-pause

# Check for session tokens in URLs (leakage via referrer)
mitmdump -r capture.flow | grep -E 'session|token.*=' | grep -v 'Header'
```

## Detection Opportunities

| Signal | Source | Description |
|--------|--------|-------------|
| Cleartext credentials | Network capture | Password sent over HTTP |
| Insecure token storage | SharedPrefs/NSUserDefaults | Tokens in plaintext storage |
| No PKCE | OAuth flow | Authorization code without PKCE |
| Biometric UI-only | Code review | Biometric doesn't protect key material |
| Long-lived tokens | Token analysis | No expiration or excessive lifetime |
| Missing state | OAuth flow | CSRF in authorization flow |

```yaml
title: Mobile App Authentication Flows Detection
id: bd2855a9-1ef4-40a0-9035-532c82aee798
status: experimental
description: Detects suspicious activity related to analyzing mobile app authentication flows techniques in mobile security context
logsource:
  category: application
  product: android
detection:
  selection:
    EventType: error
  condition: selection
level: medium
tags:
  - attack.t1111
  - attack.t1539
  - attack.t1556
  - attack.initial_access
falsepositives:
  - Mobile device management platform enforcing security policies
```

## Verification

- [ ] Authentication flow mapped end-to-end
- [ ] Credential storage locations audited
- [ ] Token security (JWT, OAuth) assessed
- [ ] Biometric authentication bypass tested
- [ ] OAuth/OIDC configuration validated
- [ ] Session management controls verified

## References

- [OWASP MASTG — Authentication](https://mas.owasp.org/MASTG/techniques/android/MASTG-TECH-0013/)
- [OAuth 2.0 for Mobile Apps — RFC 8252](https://datatracker.ietf.org/doc/html/rfc8252)
- [MITRE T1539 — Steal Web Session Cookie](https://attack.mitre.org/techniques/T1539/)
