Testing Instant Apps is now in 0x05b (Basic Security Testing)

Document/0x05b-Basic-Security_Testing.md

@@ -326,6 +326,59 @@ The APK will be downloaded in your working directory.
 
 Alternatively, there are also apps like [APK Extractor](https://play.google.com/store/apps/details?id=com.ext.ui "APK Extractor") that do not require root and can even share the extracted APK via your preferred method. This can be useful if you don't feel like connecting the device or setting up adb over the network to transfer the file.
 
+#### Testing Instant Apps
+
+With [Google Play Instant](https://developer.android.com/topic/google-play-instant/overview "Google Play Instant") you can create Instant apps which can be instantly launched from a browser or the "try now" button from the app store from Android 5.0 (API level 21) onward. They do not require any form of installation. There are a few challenges with an instant app:
+
+- There is a limited amount of size you can have with an instant app.
+- Only a reduced number of permissions can be used, which are documented at [Android Instant app documentation](https://developer.android.com/topic/google-play-instant/getting-started/instant-enabled-app-bundle?tenant=irina#request-supported-permissions "Permission documentation for Android Instant Apps").
+
+The combination of these can lead to insecure decisions, such as: stripping too much of the authorization/authentication/confidentiality logic from an app, which allows for information leakage.
+
+Note: Instant apps require an App Bundle. App Bundles are described in the "[App Bundles](0x05a-Platform-Overview.md#app-bundles)" section of the "Android Platform Overview" chapter.
+
+#### Static Analysis Considerations
+
+Static analysis can be either done after reverse engineering a downloaded instant app, or by analyzing the App Bundle. When you analyze the App Bundle, check the Android Manifest to see whether `dist:module dist:instant="true"` is set for a given module (either the base or a specific module with `dist:module` set). Next, check for the various entry points, which entry points are set (by means of `<data android:path="</PATH/HERE>" />`).
+
+Now follow the entry points, like you would do for any Activity and check:
+
+- Is there any data retrieved by the app which should require privacy protection of that data? If so, are all required controls in place?
+- Are all communications secured?
+- When you need more functionalities, are the right security controls downloaded as well?
+
+### Dynamic Analysis Considerations
+
+There are multiple ways to start the dynamic analysis of your instant app. In all cases, you will first have to install the support for instant apps and add the `ia` executable to your `$PATH`.
+
+The installation of instant app support is taken care off through the following command:
+
+```bash
+$ cd path/to/android/sdk/tools/bin && ./sdkmanager 'extras;google;instantapps'
+```
+
+Next, you have to add `path/to/android/sdk/extras/google/instantapps/ia` to your `$PATH`.
+
+After the preparation, you can test instant apps locally on a device running Android 8.1 (API level 27) or later. The app can be tested in different ways:
+
+- Test the app locally:
+  Deploy the app via Android Studio (and enable the `Deploy as instant app` checkbox in the Run/Configuration dialog) or deploy the app using the following command:
+
+  ```bash
+  $ ia run output-from-build-command <app-artifact>
+  ```
+
+- Test the app using the Play Console:
+  1. Upload your App Bundle to the Google Play Console
+  2. Prepare the uploaded bundle for a release to the internal test track.
+  3. Sign into an internal tester account on a device, then launch your instant experience from either an external prepared link or via the `try now` button in the App store from the testers account.
+
+Now that you can test the app, check whether:
+
+- There are any data which require privacy controls and whether these controls are in place.
+- All communications are sufficiently secured.
+- When you need more functionalities, are the right security controls downloaded as well for these functionalities?
+
 ### Installing Apps
 
 Use `adb install` to install an APK on an emulator or connected device.

Document/0x05h-Testing-Platform-Interaction.md

@@ -674,61 +674,6 @@ $ adb shell am start
         -d "https://www.myapp.com/my/app/path?dataparam=0" com.myapp.android
 ```
 
-## Testing for Insecure Configuration of Instant Apps (MSTG-ARCH-1, MSTG-ARCH-7)
-
-### Overview
-
-With [Google Play Instant](https://developer.android.com/topic/google-play-instant/overview "Google Play Instant") you can now create Instant apps. An instant apps can be instantly launched from a browser or the "try now" button from the app store from Android 5.0 (API level 21) onward. They do not require any form of installation. There are a few challenges with an instant app:
-
-- There is a limited amount of size you can have with an instant app.
-- Only a reduced number of permissions can be used, which are documented at [Android Instant app documentation](https://developer.android.com/topic/google-play-instant/getting-started/instant-enabled-app-bundle?tenant=irina#request-supported-permissions "Permission documentation for Android Instant Apps").
-
-The combination of these can lead to insecure decisions, such as: stripping too much of the authorization/authentication/confidentiality logic from an app, which allows for information leakage.
-
-Note: Instant apps require an App Bundle. App Bundles are described in the "[App Bundles](0x05a-Platform-Overview.md#app-bundles)" section of the "Android Platform Overview" chapter.
-
-### Static Analysis
-
-Static analysis can be either done after reverse engineering a downloaded instant app, or by analyzing the App Bundle. When you analyze the App Bundle, check the Android Manifest to see whether `dist:module dist:instant="true"` is set for a given module (either the base or a specific module with `dist:module` set). Next, check for the various entry points, which entry points are set (by means of `<data android:path="</PATH/HERE>" />`).
-
-Now follow the entry points, like you would do for any Activity and check:
-
-- Is there any data retrieved by the app which should require privacy protection of that data? If so, are all required controls in place?
-- Are all communications secured?
-- When you need more functionalities, are the right security controls downloaded as well?
-
-### Dynamic Analysis
-
-There are multiple ways to start the dynamic analysis of your instant app. In all cases, you will first have to install the support for instant apps and add the `ia` executable to your `$PATH`.
-
-The installation of instant app support is taken care off through the following command:
-
-```bash
-$ cd path/to/android/sdk/tools/bin && ./sdkmanager 'extras;google;instantapps'
-```
-
-Next, you have to add `path/to/android/sdk/extras/google/instantapps/ia` to your `$PATH`.
-
-After the preparation, you can test instant apps locally on a device running Android 8.1 (API level 27) or later. The app can be tested in different ways:
-
-- Test the app locally:
-  Deploy the app via Android Studio (and enable the `Deploy as instant app` checkbox in the Run/Configuration dialog) or deploy the app using the following command:
-
-  ```bash
-  $ ia run output-from-build-command <app-artifact>
-  ```
-
-- Test the app using the Play Console:
-  1. Upload your App Bundle to the Google Play Console
-  2. Prepare the uploaded bundle for a release to the internal test track.
-  3. Sign into an internal tester account on a device, then launch your instant experience from either an external prepared link or via the `try now` button in the App store from the testers account.
-
-Now that you can test the app, check whether:
-
-- There are any data which require privacy controls and whether these controls are in place.
-- All communications are sufficiently secured.
-- When you need more functionalities, are the right security controls downloaded as well for these functionalities?
-
 ## Testing for Sensitive Functionality Exposure Through IPC (MSTG-PLATFORM-4)
 
 ### Overview