Overview

This test intercepts the app's incoming and outgoing network traffic, and checks for any cleartext communication.
Whilst the static checks can only show _potential_ cleartext traffic, this dynamic test shows all communication the application definitely makes.

Limitation

  • Intercepting traffic on a network level will show all traffic _the device_ performs, not only the single app. Linking the traffic back to a specific app can be difficult, especially when more apps are installed on the device.
  • Linking the intercepted traffic back to specific locations in the app can be difficult and requires manual analysis of the code.
  • Dynamic analysis works best when you interact extensively with the app. But even then there could be corner cases which are difficult or impossible to execute on every device. The results from this test therefore are likely not exhaustive.

Steps

You can use one of the following approaches:

Notes:

Observation

The output should contain the captured network traffic.

Evaluation

The test case fails if any clear text traffic originates from the target app.

Note

This can be challenging to determine because traffic can potentially come from any app on the device. See the [Overview](#overview) section.