From f1d366646ebdb4f3aa972bb561225bb2a6877c2f Mon Sep 17 00:00:00 2001 From: HackTricks News Bot Date: Sun, 20 Sep 2026 11:35:19 +0000 Subject: [PATCH] Add content from: TeleGapper: Black-Box Dynamic Analysis of Telegram Mini Apps... --- .../android-app-pentesting/README.md | 39 +++++++++++++++++++ 1 file changed, 39 insertions(+) diff --git a/src/mobile-pentesting/android-app-pentesting/README.md b/src/mobile-pentesting/android-app-pentesting/README.md index 4336bcabbff..72a319558ae 100644 --- a/src/mobile-pentesting/android-app-pentesting/README.md +++ b/src/mobile-pentesting/android-app-pentesting/README.md @@ -852,6 +852,43 @@ Once you finish the dynamic analysis with MobSF you can press on "**Start Web AP > adb shell settings put global http_proxy :0 > ``` +### [TeleGapper](https://github.com/Mobile-IoT-Security-Lab/TeleGapper) - Telegram Mini App privacy analysis + +Telegram Mini Apps are third-party web applications rendered inside Telegram's Android WebView, where they can combine Telegram-provided context with normal outbound web requests. Consequently, testing only the Telegram APK misses the behaviour of each hosted Mini App. **TeleGapper** performs black-box analysis on a logged-in Android device: Appium/UiAutomator2 opens a bot, launches its Mini App, extracts runtime artifacts and correlates observed network flows with the declared privacy information.[[22]](#references)[[23]](#references) + +The useful testing pattern is to preserve evidence from both Android surfaces and split network collection by execution phase:[[22]](#references)[[23]](#references) + +1. Scrape the bot's standard or custom privacy policy before launching the Mini App. +2. Capture the **initialization phase** separately: switch between `NATIVE_APP` and the Mini App's `WEBVIEW` context, save the native UI XML and rendered DOM HTML, and snapshot the proxy log before interaction. +3. Exercise clickable DOM/canvas elements for a fixed budget while recording each action, URL/domain transition and click result. +4. Capture the **exploration phase** traffic and generate per-bot JSON findings. This distinction exposes data sent automatically at startup versus data sent only after a user action; standard Telegram policies can be classified automatically, while custom policies still require manual comparison. + +Prepare [ADB connectivity](adb-commands.md), a ChromeDriver compatible with Telegram's WebView, [WebView debugging](webview-attacks.md#remote-debugging), and an intercepting proxy whose CA is trusted by the device ([Burp certificate and global proxy setup](install-burp-certificate.md)). Burp must continuously write requests and responses to the file configured as `BURP_LOG_FILE`; the pipeline clears/copies this file to delimit each run.[[23]](#references) + +A minimal local run is:[[23]](#references) + +```bash +python3 -m venv venv && source venv/bin/activate +pip install -r requirements.txt +cp .env.example .env # set device serial, output/Burp paths and ChromeDriver paths +appium --allow-insecure uiautomator2:chromedriver_autodownload +python Automator.py @TargetBot +# batch mode: bash ./script.sh +``` + +The resulting evidence includes UI XML, Mini App HTML, privacy-policy copies, phase-specific Burp traffic, interaction logs and JSON reports with extracted sensitive-data indicators. Review all of them together: keyword hits in HTML/XML show what was rendered, whereas the proxy traces show what actually left the device.[[23]](#references) + +For a USB device with the Python pipeline in Docker, keep the ADB server, Appium, ChromeDriver and Burp on the host, then expose only the control endpoints needed by the container:[[23]](#references) + +```bash +adb kill-server && adb -a -P 5037 nodaemon server & +appium --address 0.0.0.0 --allow-insecure uiautomator2:chromedriver_autodownload +docker compose build +docker compose run --rm pipeline python Automator.py @TargetBot +``` + +`adb -a` and Appium on `0.0.0.0` listen beyond loopback; restrict ports `5037`/`4723` with the host firewall and stop the exposed ADB server after the run.[[23]](#references) + ### Assisted Dynamic Analysis with Inspeckage You can get the tool from [**Inspeckage**](https://github.com/ac-pm/Inspeckage).\ @@ -1027,5 +1064,7 @@ AndroL4b is an Android security virtual machine based on ubuntu-mate includes th - [19] [android-developers.googleblog.com - Run Arm Apps On Android Emulator](https://android-developers.googleblog.com/2020/03/run-arm-apps-on-android-emulator.html) - [20] [Zero-Click File Drop on Xiaomi ShareMe (MiDrop)](https://blog.byterialab.com/zero-click-file-drop-on-xiaomi-shareme-midrop/) - [21] [Byterialab mishare-zero-click-file-drop PoC repository](https://github.com/Byterialab/mishare-zero-click-file-drop) +- [22] [TeleGapper: On the (un)reliability of Privacy Policies in Telegram Mini apps](https://arxiv.org/abs/2608.13390) +- [23] [TeleGapper source repository and usage documentation](https://github.com/Mobile-IoT-Security-Lab/TeleGapper) {{#include ../../banners/hacktricks-training.md}}