TeleGapper Black-Box Dynamic Analysis of Telegram Mini Apps ...

[carlospolop]

🤖 Automated Content Update

This PR was automatically generated by the HackTricks News Bot based on a technical blog post.

📝 Source Information

• Blog URL: https://github.com/Mobile-IoT-Security-Lab/TeleGapper
• Blog Title: TeleGapper: Black-Box Dynamic Analysis of Telegram Mini Apps on Android
• Suggested Section: Mobile Pentesting > Android Applications Pentesting, with cross-references to Webview Attacks, ADB Commands, and proxy-based traffic analysis

🎯 Content Summary

Overview and security scope

TeleGapper is a black-box dynamic-analysis tool for Telegram Mini Apps running on Android devices. It uses Appium to drive Telegram, opens a target bot, launches its Mini App, extracts native UI and WebView content, copies proxy traffic, and generates JSON reports containing extracted sensitive-data indicators.

This is a defensive security-analysis project rather than...

🔧 Technical Details

Automated bot and Mini App execution: A security analyst can use Appium to search for a Telegram handle such as @bot, open the chat, launch the Mini App, and exercise its workflow on a logged-in Android device. This turns a manual Telegram interaction into a repeatable dynamic-analysis process.

Native/WebView dual-surface inspection: Telegram Mini Apps expose both native Telegram UI state and embedded WebView content. Collecting Android XML UI dumps together with HTML source allows an analyst to inspect visible native elements, WebView content, and privacy-relevant strings that would be missed by analyzing only one surface. Matching Chromedriver binaries are required to automate the Telegram WebView.

Startup-versus-interaction traffic separation: Route the Android device through a logging proxy such as Burp Suite, capture traffic during Mini App initialization, then drive the UI while recording a click log a...

🤖 Agent Actions

Plan:

1. Map the Android/mobile documentation and inspect at least five relevant pages.
2. Compare existing coverage with TeleGapper’s actual implementation and primary research.
3. Add only non-duplicative, technique-focused content to the best existing page, with numbered citations.
4. Validate the markdown, references, paths, and final diff.
   Repository mapping is complete. Next I’m checking six candidate pages for overlap, style, and citation structure before selecting the single edit location.
   The best fit is the existing Android application pentesting page under Automatic Analysis: it already covers assisted dynamic tooling, while WebView, ADB, and proxy setup are documented separately and can be linked without duplicating them. I’m now verifying TeleGapper’s implementation and paper metadata before editing.
   Research and placement are complete. The edit will be limited to android-app-pentesting/README.md: one concise TeleGapper subsection plus two primary references, with links to the existing WebView, ADB, and Burp pages instead of repeating their content.
   Implementation is complete. I’m validating that the internal links/anchor resolve, citations are unique and ordered, forbidden domains were not introduced, and the mdBook still builds.
   Validation passed: all three internal links resolve, the WebView anchor exists, citations [22]/[23] are ordered and unique in the reference list, the diff has no whitespace errors, and no forbidden-source links were added. mdbook is not installed in the environment, so a full book build could not be run.
   Updated src/mobile-pentesting/android-app-pentesting/README.md with:

• TeleGapper black-box Telegram Mini App analysis workflow.
• Native UI/WebView artifact collection.
• Startup-versus-interaction traffic analysis.
• Local and Docker execution commands.
• Cross-references to ADB, WebView debugging, and Burp proxy setup.
• Numbered citations to the original paper and repository.

Validation:

• git diff --check passed.
• Internal links and anchor verified.
• No forbidden sources added.
• mdbook build skipped because mdbook is unavailable.

---

This PR was automatically created by the HackTricks Feed Bot. Please review the changes carefully before merging.

[carlospolop]

🔗 Additional Context

Original Blog Post: https://github.com/Mobile-IoT-Security-Lab/TeleGapper

Content Categories: Based on the analysis, this content was categorized under "Mobile Pentesting > Android Applications Pentesting, with cross-references to Webview Attacks, ADB Commands, and proxy-based traffic analysis".

Repository Maintenance:

• MD Files Formatting: 1032 files processed

Review Notes:

• This content was automatically processed and may require human review for accuracy
• Check that the placement within the repository structure is appropriate
• Verify that all technical details are correct and up-to-date
• All .md files have been checked for proper formatting (headers, includes, etc.)

Bot Version: HackTricks News Bot v1.0