TeleGapper Black-Box Dynamic Analysis of Telegram Mini Apps ...

src/mobile-pentesting/android-app-pentesting/README.md

@@ -852,6 +852,43 @@ Once you finish the dynamic analysis with MobSF you can press on "**Start Web AP
 > adb shell settings put global http_proxy :0
 > ```
 
+### [TeleGapper](https://github.com/Mobile-IoT-Security-Lab/TeleGapper) - Telegram Mini App privacy analysis
+
+Telegram Mini Apps are third-party web applications rendered inside Telegram's Android WebView, where they can combine Telegram-provided context with normal outbound web requests. Consequently, testing only the Telegram APK misses the behaviour of each hosted Mini App. **TeleGapper** performs black-box analysis on a logged-in Android device: Appium/UiAutomator2 opens a bot, launches its Mini App, extracts runtime artifacts and correlates observed network flows with the declared privacy information.<sup>[[22]](#references)[[23]](#references)</sup>
+
+The useful testing pattern is to preserve evidence from both Android surfaces and split network collection by execution phase:<sup>[[22]](#references)[[23]](#references)</sup>
+
+1. Scrape the bot's standard or custom privacy policy before launching the Mini App.
+2. Capture the **initialization phase** separately: switch between `NATIVE_APP` and the Mini App's `WEBVIEW` context, save the native UI XML and rendered DOM HTML, and snapshot the proxy log before interaction.
+3. Exercise clickable DOM/canvas elements for a fixed budget while recording each action, URL/domain transition and click result.
+4. Capture the **exploration phase** traffic and generate per-bot JSON findings. This distinction exposes data sent automatically at startup versus data sent only after a user action; standard Telegram policies can be classified automatically, while custom policies still require manual comparison.
+
+Prepare [ADB connectivity](adb-commands.md), a ChromeDriver compatible with Telegram's WebView, [WebView debugging](webview-attacks.md#remote-debugging), and an intercepting proxy whose CA is trusted by the device ([Burp certificate and global proxy setup](install-burp-certificate.md)). Burp must continuously write requests and responses to the file configured as `BURP_LOG_FILE`; the pipeline clears/copies this file to delimit each run.<sup>[[23]](#references)</sup>
+
+A minimal local run is:<sup>[[23]](#references)</sup>
+
+```bash
+python3 -m venv venv && source venv/bin/activate
+pip install -r requirements.txt
+cp .env.example .env   # set device serial, output/Burp paths and ChromeDriver paths
+appium --allow-insecure uiautomator2:chromedriver_autodownload
+python Automator.py @TargetBot
+# batch mode: bash ./script.sh
+```
+
+The resulting evidence includes UI XML, Mini App HTML, privacy-policy copies, phase-specific Burp traffic, interaction logs and JSON reports with extracted sensitive-data indicators. Review all of them together: keyword hits in HTML/XML show what was rendered, whereas the proxy traces show what actually left the device.<sup>[[23]](#references)</sup>
+
+For a USB device with the Python pipeline in Docker, keep the ADB server, Appium, ChromeDriver and Burp on the host, then expose only the control endpoints needed by the container:<sup>[[23]](#references)</sup>
+
+```bash
+adb kill-server && adb -a -P 5037 nodaemon server &
+appium --address 0.0.0.0 --allow-insecure uiautomator2:chromedriver_autodownload
+docker compose build
+docker compose run --rm pipeline python Automator.py @TargetBot
+```
+
+`adb -a` and Appium on `0.0.0.0` listen beyond loopback; restrict ports `5037`/`4723` with the host firewall and stop the exposed ADB server after the run.<sup>[[23]](#references)</sup>
+
 ### Assisted Dynamic Analysis with Inspeckage
 
 You can get the tool from [**Inspeckage**](https://github.com/ac-pm/Inspeckage).\
@@ -1027,5 +1064,7 @@ AndroL4b is an Android security virtual machine based on ubuntu-mate includes th
 - [19] [android-developers.googleblog.com - Run Arm Apps On Android Emulator](https://android-developers.googleblog.com/2020/03/run-arm-apps-on-android-emulator.html)
 - [20] [Zero-Click File Drop on Xiaomi ShareMe (MiDrop)](https://blog.byterialab.com/zero-click-file-drop-on-xiaomi-shareme-midrop/)
 - [21] [Byterialab mishare-zero-click-file-drop PoC repository](https://github.com/Byterialab/mishare-zero-click-file-drop)
+- [22] [TeleGapper: On the (un)reliability of Privacy Policies in Telegram Mini apps](https://arxiv.org/abs/2608.13390)
+- [23] [TeleGapper source repository and usage documentation](https://github.com/Mobile-IoT-Security-Lab/TeleGapper)
 
 {{#include ../../banners/hacktricks-training.md}}